CiscoVPN Client / 32-Bit Vista / Error 1720

I just spent 4 hours trying to figure out why the latest version of CiscoVPN Client wouldn’t install, and kept giving me this:

Error 1720: There is a problem with this Windows Installer package. A script required for this install to compelete could not be run. Contact your support personnel or package vendor.

When I tried to google the error (and an unreal number of permutations of it), the results came up with all kinds of suggestions (specifically, re-download the file, clean your registry, clean your partial installs, and re-install windows installer package.) Unfortunately for me, none of those worked – the problem wasn’t a corrupted file, a glitch in the registry or an outdated installer package.

I uninstalled my anti-virus and even disabled UAC, it didn’t make a difference. I downloaded 4 different versions of the VPN Client, all of which failed at the exact same point with the exact same un-informative “Error 1720″ error message.

After some digging I was able to see that the .exe I downloaded actually just extracted an .msi and some other files (12 in total). Realizing I could run msiexec in verbose mode and dump it to a log file:

C:\Users\{username}\AppData\Local\Temp>msiexec /i vpnclient-setup.msi /l*vx vpn.log

… I did just that.

I got a whole bunch of spew and somewhere buried was this error:

MSI (s) (80:84) [21:53:31:545]: Doing action: CsCa_GetLocalPrivName
Action 21:53:31: CsCa_GetLocalPrivName.
Action start 21:53:31: CsCa_GetLocalPrivName.
MSI (s) (80:84) [21:53:31:549]: Creating MSIHANDLE (894) of type 790542 for thread 7556
MSI (s) (80:F4) [21:53:31:549]: Creating MSIHANDLE (895) of type 0 for thread 7412
DEBUG: Error 2835:  The control ErrorIcon was not found on dialog ErrorDialog
Internal Error 2835. ErrorIcon, ErrorDialog
Error 1720. There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor.  Custom action CsCa_GetLocalPrivName script error -2146827858, Microsoft VBScript runtime error: Class doesn't support Automation Line 9, Column 1,
MSI (s) (80:F4) [21:53:33:888]: Product: Cisco Systems VPN Client 5.0.05.0290 -- Error 1720. There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor.  Custom action CsCa_GetLocalPrivName script error -2146827858, Microsoft VBScript runtime error: Class doesn't support Automation Line 9, Column 1,

To be honest, I really have no idea what that means, even now after fixing the installer. I spent some time on google looking for the missing control ErrorIcon – that turned out to be a red herring and not really even a problem.

I then spent time looking up this: CsCa_GetLocalPrivName

This looked a little more promising and I found this link.

It said:

Had some problems with 5.0.02.6060 when logged in to a domain, using localized (Swedish) Windows so I’m not sure if the problem exists on other configurations.

The installation took about 35 minutes to complete if the computer where attached to the network when installing, when logged in locally it took 4 minutes.

Solved it by make an MST and remove custom action CsCa_GetLocalPrivName and then set these properties with custom actions:
GROUP_INTERACTIVE
GROUP_USERS
GROUP_LOCAL_SYSTEM
GROUP_ADMINISTRATORS

Now I consider myself a pretty proficient power user, but this just baffled me. WTF is an MST, what are custom actions, and what are these groups all about?

After some more googling, I found Orca, available here. Orca is an amazing utility that allows you to edit many of the parameters contained within a .msi installer file.

So going headfirst, I backed up the vpnclient_setup.msi and started up Orca and opened the msi.

Orca now opened a whole slew of tables, each of which I could click on and edit the data inside — pretty cool!

The first thing I did was go under the CustomAction table and find the CsCa_GetLocalPrivName Action. Sure enough it was there. Simply right clicking on the row and selecting “Drop Row” took care of that – deleted.

Could it be that easy? I saved, closed it in Orca (otherwise it will not allow you to run the .msi) and attempted to run the .msi file.

It got past the sticking point that it had always failed at, proceeded to do a few more things and failed again — this time with Error 1721.

Before I went and did the whole diagnostic thing (with verbose logging), I tried to do the rest of the steps in the linked post, remember? The stuff about adding properties with CustomActions…

Well I have no idea about CustomActions, so I tried searching for how to set properties with CustomActions and couldn’t figure it out quick enough. From the random snippets of pages I read about CustomActions in Orca, I ended up getting enough confidence to just add the properties in the Property table and hope for the best.

I added the keys (Properties) but didn’t know what to put for the value… hmm.

I searched for one of the Properties I added: GROUP_USERS. It came up with the key I just added (obviously), but one press of F3 came up with an entry in the LockPermissions table:

LockObject Table Domain User Permission
INSTALLDIR CreateFolder [GROUP_USERS] -1610612736

Farther down in the table was a row with LockObject=registry7 that had User=Everyone.

That’s interesting. It looks like the [GROUP_USERS] is just some sort of variable. I took a guess that a reference to [FOO] would really just evaluate to the corresponding value of the FOO key in the Property table — it seemed logical.

Before I left the LockPermissions table, I noted that that acceptable permissions were “Everyone” and “Administrators”.

I thought, I’ll just go into Users and Group Management, find out the group names, and replace them as values to the appropriate keys in the Property table. Almost! The box I was working on was running Vista Home Premium Edition, and I couldn’t add the User and Group Management snap-on to mmc, of course not, why would it be that easy?

I said screw it, and just picked values I knew were acceptable “Everyone” and “Administrators”.

I assigned the value “Everyone” to GROUP_INTERACTIVE, GROUP_USERS, and GROUP_LOCAL_SYSTEM and assigned the value “Administrators” to GROUP_ADMINISTRATORS — seems good to me?

After that, I was feeling pretty good, saved the .msi file, closed it from Orca and ran it again — voila! It got past the first sticking point (Error 1720), the most recent error (Error 1721) and continued installation all the way to successful completion — It worked!

After a quick reboot I was up and running the VPN Client I have spent hours trying to get working.

I’ll recap the fix for those in a hurry, but before I do that, I’m going to list some of the versions of software that I was using:

  • VPN Client Version: vpnclient-win-msi-5.0.05.0290-k9.exe
  • Windows Vista: Windows Vista Home Premium SP1
  • Orca: Version 3.1.4000.2049

Presented below are the quick steps to fix the problem:

NOTE: I include some steps here that are, in actuality, optional, but its good practice to make sure you’re having the same problem (or at least the same error message) I was, otherwise you could be spending a lot of time tweaking the .msi for no reason.

  1. Run the unpackager (vpnclient-win-msi-5.0.05.0290-k9.exe).

  2. Make note of the “Unzip to folder” location (copying it to the clipboard is useful), uncheck the “When done unzipping open” box and click “Unzip”

  3. Open a console window (might want to run as Administrator just to be safe) – Start, Run, “cmd”, Hold Ctrl+Shift and Press Enter

  4. Navigate to the “Unizp to folder” location. Mine was C:\Users\{username}\AppData\Local\Temp\

  5. Run msiexec in verbose logging mode: msiexec /i vpnclient-setup.msi /l*vx vpn.log

  6. Follow through with the installer that pops up as you would any other time.

  7. Allow it to fail at Error 1720, roll back and exit.

  8. Open up notepad and navigate to the same “Unzip to Folder” – you can paste the path in the filename box or you can navigate there manually (you may have to manually type AppData into the filename box and press enter when you get there, as it is hidden by default. Remember, there is no space between AppData and the A and D are capitalized. If you did it correctly, no error will pop up and you should see the Local folder to continue navigating.

  9. Open the vpn.log file.

  10. Search for “1720″ and verify that you see the same error as I listed above.

  11. If you don’t, you can certainly continue, but this may not work at all.

  12. Close the notepad.

  13. Download, install and run Orca.

  14. Navigate to the path (or paste the location in the filename box) and open the .msi file (mine was called vpnclient-setup.msi).

  15. Backup the msi by clicking File->Save As and renaming a copy as vpnclient-setup-backup.msi.

  16. Close the backup, and open the vpnclient-setup.msi

  17. In the left panel select CustomAction

  18. In the newly populated right panel find the Action titled CsCa_GetLocalPrivName, right click on it and select Drop Row. Confirm by clicking OK.

  19. In the left panel select Property

  20. Ensure the right panel has column headers “Property” and “Value”

  21. Right click in the right panel, and select Add Row.

  22. In the Add Row Dialog, select Property (under Name), ensure it says Property above the text box and type “GROUP_INTERACTIVE” without quotes (and without brackets).

  23. Now select Value (under Name), ensure it says Value above the text box and type “Everyone” without quotes.

  24. Confirm by clicking OK

  25. Complete steps 21-24 for the last three entries (assigning the value “Everyone” to GROUP_INTERACTIVE, GROUP_USERS, and GROUP_LOCAL_SYSTEM and assigning the value “Administrators” to GROUP_ADMINISTRATORS)

  26. Save the tweaked .msi by clicking File-Save.

  27. Close the tweaked .msi by clicking File-Close.

  28. In the command window / terminal, try the install again (verbose logging is optional). Alternatively, run the installer from an Explorer window by navigating to the folder and double clicking on it.

  29. If you did everything correctly, and had the same problem as me, you should be off to the races!

Good Luck!

Posted Tuesday, September 15th, 2009 under windows.

Tags: ,

64 comments

  1. Mariana says:
    September 17, 2009 at 10:19 pm

    Thank you! Thank you! Thank you! :)
    I was so frustrated, googling and reading and trying everything to no avail, until I found your article. It totally worked!!!

  2. Ted says:
    September 19, 2009 at 9:27 pm

    Sounds like a lot of work! Good Stuff.

  3. Sean says:
    September 21, 2009 at 12:46 am

    amazing, worked perfectly!!!

  4. Frank says:
    September 25, 2009 at 5:12 am

    Excellent, Excellent !!! You saved me a lot of time and effort. Thumbs up !

    THANKS

  5. Vince says:
    September 29, 2009 at 12:35 am

    A thousand blessings on your head!!!!! Fantastic sleuthing, and detailed steps. Worked like a charm. Finally, I can go to bed! THANK YOU!

  6. Grey says:
    September 29, 2009 at 7:34 pm

    You win the internet!

    I would give you a hug, but I imagine you will find my resisting such form of gratitude an even greater reward.

  7. Fosi says:
    October 1, 2009 at 11:25 am

    “Complete steps 21-24 for the last three entries”

    Which last three? I don’t get it. Thx

  8. Jim says:
    October 1, 2009 at 12:02 pm

    Hi Fosi,

    Repeat steps 21-24 and instead of setting the value of GROUP_INTERACTIVE to “Everyone”:
    Set the value of GROUP_USERS to “Everyone”
    Set the value of GROUP_LOCAL_SYSTEM to “Everyone”
    Set the value of GROUP_ADMINISTRATORS to “Administrators”

    Regards,
    Jim

  9. Fosi says:
    October 1, 2009 at 12:31 pm

    Worked! But still a little confusing! Perfekt! Thx

  10. Jim says:
    October 1, 2009 at 7:18 pm

    Great! Sorry for the confusion.

    Regards,
    Jim

  11. Bo Andersen says:
    November 9, 2009 at 10:34 am

    Luv u man

  12. Sammy Van den Broeke says:
    November 13, 2009 at 1:37 pm

    Damn nice work man that must indeed have costed u alot of work congratz and thanks alot ! Saved me some headache ^^

  13. Mihail Kalmykov says:
    November 17, 2009 at 10:02 am

    Thank you!
    It works!

  14. Jovan says:
    November 29, 2009 at 9:44 am

    You are GREAT !!! Please tell to CISCO to correct their MSI file :)

    REGARDS,
    Jovan.

  15. Ryan says:
    December 28, 2009 at 1:52 pm

    I must say that I am so happy I could scream. This is an amazing piece of work you have accomplished. Fantastic job! Worked for me and perfectly!

  16. Damien B says:
    January 18, 2010 at 8:50 am

    It just works. I’ve spent hours trying to install it and my IT hadn’t a clue about was going wrong. Many thanks for this page!

  17. JON O says:
    January 29, 2010 at 11:45 am

    I’m the head of my IT department and I was baffled. This helped me out so much! Thanks a million for writing this up! It saved me hours!!!

  18. Pablo says:
    February 1, 2010 at 10:10 am

    Now if you can only solve “442 failed to enable virtual adaptor” error, without using one of the continually repeated solutions all over the web with one of yours that works i’ll be eternally grateful :-)

  19. Felix Ufer says:
    February 4, 2010 at 8:21 am

    Thanks a lot for this contribution! It really helped me and saved a lot of time.
    Thanks again!

  20. RichL says:
    February 4, 2010 at 4:41 pm

    I’d like to chime in on thanking you for the quality and effort it must have taken to get to this point. I’m an advanced MSI repackager and this issue \ error had even me baffled after looking at CISCO’s verbose error logs and their MSI source code.

    What still has me puzzled is the following. We use automation heavily for just about everything -> including VPN upgrades. With great power comes great responsibility -> and when a very small % of our deployments hit this snag (2% or less0 it was a concern. Still can’t wrap my head around why this is only required on a few -> all of whose root level folder permissions (e.g. the permissions toteh PFIles fodler and user profiles) seem identical to other machines where it installs fine. Given the locked down nature of our environmetn -> the failures are still a puzzle.

    No Q your solution and its explicit lock permissions table definitions for the install works -> just wondering why its needed in the first place.

  21. Beaujean says:
    February 18, 2010 at 9:44 am

    HELL, tried everything from reinstalling/updating all kinds of things, disabling UAC, cleaning/editing registries. Had almost given up until I stumbled upon your solution, this FINALLY did the trick for me.
    Beats the crap out of me how you found this stuff out but you are DEFINITLY the man! THUMBS UP!!

    greetz,

    B.

  22. Pete d'Angelo says:
    March 9, 2010 at 12:34 pm

    thanks so much, worked perfectly!!

  23. PD says:
    March 11, 2010 at 9:12 pm

    Great solution, this also works for Win2K3 x86 server on VMWare, I just had to make a simple DCOM setting change to netman….

    Thanks!

  24. Rokson says:
    March 15, 2010 at 9:49 am

    Another eternally grateful soul here!
    Thank you!

  25. Igor says:
    May 6, 2010 at 2:59 pm

    My gratitude for our help!!!

    * VPN Client Version: vpnclient-win-msi-5.0.07.0290-k9.exe
    * Windows XP SP3 (Localized)
    * Orca: Version 3.1.4000.2049

  26. ChrisL says:
    May 21, 2010 at 10:16 am

    Thank you so very much! Incredibly helpful!

  27. avel says:
    June 1, 2010 at 10:23 am

    thanks man you are great

  28. jglc says:
    June 8, 2010 at 11:27 pm

    Incredible. A life-saver – perhaps literally. Thanks!!

  29. DB says:
    June 10, 2010 at 2:49 pm

    This solution was incredible. I have no idea how you figured this out but you are amazing!!! – It worked perfectly for me the first time. Let’s hope that Cisco fixes this ASAP. Cheers!

  30. Ravi says:
    June 16, 2010 at 12:35 pm

    Thanks you so much for spending time in proving the descriptive steps. Very useful.

  31. Olaf says:
    June 23, 2010 at 4:30 am

    Thank you! It helped me very much.

  32. Rocky says:
    June 29, 2010 at 7:51 am

    Greaaaat!!! :-) ))

  33. Ricky says:
    July 31, 2010 at 1:13 am

    great!! it works!!! hahaha… thanks man!

  34. Debbie says:
    August 25, 2010 at 6:22 am

    Thank you so much it worked and saved me so much stress. Thank you so so much :-)

  35. Mario says:
    September 17, 2010 at 11:47 am

    Thanks a lot for this contribution! It really helped me and worked perfectly.

    Thanks again!!!

  36. Vivek says:
    September 26, 2010 at 10:48 am

    Thank you so much for the article. Works great !

  37. Akiva says:
    September 26, 2010 at 2:09 pm

    Excellent documentation. Worked like a charm. Much appreciated.

  38. CAG says:
    October 1, 2010 at 12:54 am

    Thank you so much! My IT was scratching their heads. The best they could do was suggest upgrading my Windows. I’m running 64-bit Vista, and it worked beautifully. Your efforts, documentation and time are greatly appreciated!

  39. Murali says:
    October 9, 2010 at 10:35 am

    Thanks bro!!!. U saved my time.. Indeed a great tweak…

    Thanks one again!!!

  40. PDrudy says:
    November 30, 2010 at 11:10 am

    You are just wonderful. Worked like a charm.
    Thanks God for people like you.

  41. Thankful Dude says:
    December 8, 2010 at 2:10 am

    Amazing!!!! It still works perfect… What the has wrong with these cisco guys???

    Cisco Systems VPN Client 5.0.07.0290

  42. vaibhav says:
    December 29, 2010 at 11:41 pm

    Tht was indeed awesome. My support guy had asked me to format to resolve this issue. I myself had searched a lot for possible solution but nothing seemed to work. But ur post was just Superb. thanks a lot.

  43. Snookums says:
    January 10, 2011 at 2:53 pm

    You are the man <3

  44. Glyn Jones says:
    January 12, 2011 at 5:40 pm

    Incredible. 29 steps to victory!

  45. tinkureddy says:
    January 15, 2011 at 12:41 am

    thank you sooooo much

  46. Osarbu says:
    January 15, 2011 at 4:38 pm

    You are the best!! Thank you very much!!!

  47. Nick says:
    January 19, 2011 at 10:13 am

    Thanks, this really helped I was banging my head against the wall. We are prepping to move to Windows 7 and this program is a must so having a solution is great.

    Ran into this error on Windows 7 64-bit with Cisco VPN 5.0.07.0290.

  48. sunny says:
    February 14, 2011 at 1:39 am

    This problem blocking me for several week, and IS guy didn’t help to solve this. Thanks to your guide, it works perfectly…thank you so much…

  49. Alessandro says:
    February 16, 2011 at 12:53 pm

    Thank you very much!!! Works fine with 5.0.07.0410 32bits

  50. Troy Thomas says:
    March 15, 2011 at 8:11 pm

    Grats, you are my Hero for the Day.

    Thanks.

Newer Comments »

Leave a Reply