Reset Search
 

 

Article

KB40222 - Restricted users are unable to upgrade PCS clients although the Installer Service is installed.

« Go Back

Information

 
Last Modified Date10/18/2018 6:19 PM
Synopsis
Restricted Windows users are unable to upgrade PCS client software even though the Installer Service is installed.
 
Problem or Goal
Restricted Windows users are prompted for administrator credentials when attempting to upgrade Network Connect and other Pulse Secure client software.  The user is presented with the following User Account Control prompt: 
 

User-added image

Additionally, the Network Connect Service (NCService) component does not starting after upgrading to PCS OS 8.2R1 or higher, even if admin credentials are entered. The following error(s) will be observed:
 
The Network Connect NCService component is not running.

(nc.windows.app.23786)


User-added image

If the user is logged on as administrator, the following error is observed. 
 
Cannot start the Network Connect service. Please re-install Network Connect. (nc.windows.app.23787)


User-added image

 
Cause
These issues are related to upgrading client software from version 8.1 and below to 8.2 and above and occur in the following scenarios:
  • When upgrading from build which has not been fully re-branded with the Pulse Connect Secure (PCS) corporate logo (Ex: 7.0Rx, 8.0Rx, 8.1Rx) to a build which has been Pulse Secure re-branded (8.2R1, 8.2R1.1, 8.2R2), Network Connect will look for the (C:\Users\Public\Pulse Secure\Logging) directory which is missing from the system.  Restricted users receive the admin prompt in order to add and install into that directory, followed by error "The Network Connect NCService component is not running. nc.windows.app.23786". If the user already has admin privileges, they will immediately receive "Cannot start the Network Connect service. Please re-install Network Connect. (nc.windows.app.23787)".
NOTE: PCS software versions 8.0R12.1+, 8.1R1+, and 8.2R1+ have been re-branded with the new Pulse Secure corporate logo, but a full Pulse Secure re-branding which includes the removal of Juniper branding from software artifacts (e.g., filenames, directory names) was not fully integrated until 8.2R1+. 

NOTE: These issue(s) will occur only when attempting to install or upgrade the PCS client components from a Web browser after downloading the installer from a secure session.  This is because the Installer Service standalone client can only be invoked by the Pulse Secure Setup Client running inside the user’s Web browser. The Pulse desktop client installer for Windows includes the Pulse Secure Installer Service component which allows an upgrade directly from NC to Pulse without issues. The built-in Installer Service component is not available on Mac OS x. The Pulse Client upgrade message will look as follows:

User-added image
  • When upgrading client components to 8.1R8, the Pulse Installer Service rejects any PCS client installer signed by the SHA-2 Pulse Secure code-signing certificate and does not get upgrade.  This results in restricted users receiving a prompt for administrator credentials.  This is because all prior versions of Installer Service would only accept binaries signed by the Juniper Networks code-signing certificate. As of 8.1R8 and above, all PCS client access binaries were signed with a SHA-2 Pulse Secure code-signing certificate to improve security and to ensure compatibility with the new restrictions enforced by Microsoft Operating System(s) in 2016.
NOTE: This issue only affects client software installations delivered from a Web browser.  Pulse Desktop client installation/upgrade is not affected by this issue. 


 
Solution
The fix for these issue are in the following releases: (It is necessary to upgrade to the PCS server to implement the fix.)

*PCS OS 8.1R9 and up
**PCS OS 8.2R3 and up

*When upgrading to PCS OS 8.1R9 it is not necessary to upgrade the Pulse Installer Service on client machines first.
**When upgrading to PCS OS 8.2R3 and up, it will be necessary to pre-install the Pulse Installer Service on clients running Windows OS before they connect.  (The Pulse Installer Service MSI installer is included with each version of PCS OS and can be downloaded from the PSA device by navigating to System > Installers.)
 
 


 
Related Links
Attachment 1 
Created ByAbigail Glasco

Feedback

 

Was this article helpful?


   

Feedback

Please tell us how we can make this article more useful.

Characters Remaining: 255