KB40222 - Restricted users are unable to upgrade PCS clients although the Installer Service is installed.

The Network Connect NCService component is not running.

(nc.windows.app.23786)

Cannot start the Network Connect service. Please re-install Network Connect. (nc.windows.app.23787)

• When upgrading from build which has not been fully re-branded with the Pulse Connect Secure (PCS) corporate logo (Ex: 7.0Rx, 8.0Rx, 8.1Rx) to a build which has been Pulse Secure re-branded (8.2R1, 8.2R1.1, 8.2R2), Network Connect will look for the (C:\Users\Public\Pulse Secure\Logging) directory which is missing from the system.  Restricted users receive the admin prompt in order to add and install into that directory, followed by error "The Network Connect NCService component is not running. nc.windows.app.23786". If the user already has admin privileges, they will immediately receive "Cannot start the Network Connect service. Please re-install Network Connect. (nc.windows.app.23787)".

NOTE: PCS software versions 8.0R12.1+, 8.1R1+, and 8.2R1+ have been re-branded with the new Pulse Secure corporate logo, but a full Pulse Secure re-branding which includes the removal of Juniper branding from software artifacts (e.g., filenames, directory names) was not fully integrated until 8.2R1+. 

NOTE: These issue(s) will occur only when attempting to install or upgrade the PCS client components from a Web browser after downloading the installer from a secure session.  This is because the Installer Service standalone client can only be invoked by the Pulse Secure Setup Client running inside the user’s Web browser. The Pulse desktop client installer for Windows includes the Pulse Secure Installer Service component which allows an upgrade directly from NC to Pulse without issues. The built-in Installer Service component is not available on Mac OS x. The Pulse Client upgrade message will look as follows:

• When upgrading client components to 8.1R8, the Pulse Installer Service rejects any PCS client installer signed by the SHA-2 Pulse Secure code-signing certificate and does not get upgrade.  This results in restricted users receiving a prompt for administrator credentials.  This is because all prior versions of Installer Service would only accept binaries signed by the Juniper Networks code-signing certificate. As of 8.1R8 and above, all PCS client access binaries were signed with a SHA-2 Pulse Secure code-signing certificate to improve security and to ensure compatibility with the new restrictions enforced by Microsoft Operating System(s) in 2016.