| When installing the Windows Agent using the PowerShell Installation Instructions, a WriteErrorException error is encountered when running the installation script: PS C:\Users\Administrator> .\Install-LWDataCollector.ps1 -MSIURL https://updates.lacework.net/win-1.7.0.3913-2023-08-29-release-1.7.0-c0beb397d1b089571ae00cec5722a8d112e25f17/LWDataCollector.msi -AccessToken xxxxxxxxxxxxxxxxxx -ServerURL examplecustomer.
lacework.net -Defender
Downloading Lacework Windows Agent
Installing Lacework Windows Agent using access token
InstallWithToken : Error installing Lacework Windows Agent
At C:\Users\Administrator\Install-LWDataCollector.ps1:181 char:9
+ InstallWithToken $AccessToken $ServerURL
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,InstallWithToken
If installing via PowerShell window in a Windows GUI environment, this error will also be accompanied by the following: "An incorrect AccessToken value was entered in the -AccessToken argument." While the error itself suggests a connectivity error, an incorrect AccessToken will manifest similarly and should be validated when encountering this error. If the token is bad, you’ll see a ‘specific access token is invalid’ message prior to the connectivity error in the install logs: 15::24::35::] InstallerLog.cpp (45): ********************Install Begins********************
[2023-11-1-15::24::35::] ExecuteActions.cpp (468): Token based installation. Creating a new config.json
[2023-11-1-15::24::35::] ExecuteActions.cpp (535): Auto-upgrade setting used enabled
[2023-11-1-15::24::35::] ExecuteActions.cpp (599): Created config.json file
[2023-11-1-15::24::35::] ExecuteActions.cpp (954): Checking network connection to lwcs.lacework.net
[2023-11-1-15::24::36::] ExecuteActions.cpp (961): The specified access token is invalid. HTTP response from backend: 401
[2023-11-1-15::24::36::] ExecuteActions.cpp (29): Is Installer running in silent mode = 0
[2023-11-1-15::29::9::] ExecuteActions.cpp (750): Could not verify connectivity to Lacework backend or update server (updates.lacework.net) -- are they allowed through your proxy/firewall settings? (LW Error = 0x88000f)
[2023-11-1-15::29::9::] InstallerLog.cpp (45): ********************Rolling back installation due to error Begins********************
[2023-11-1-15::29::9::] ExecuteActions.cpp (858): ParseCustomActionData entry
[2023-11-1-15::29::9::] ExecuteActions.cpp (866): need 0 characters
[2023-11-1-15::29::9::] ExecuteActions.cpp (883): no more separators, leaving
[2023-11-1-15::29::9::] ExecuteActions.cpp (910): ParseCustomActionData exit
[2023-11-1-15::29::9::] InstallerLog.cpp (45): ********************Uninstall Begins********************
To address this: - Review the install logs in C:\Users\<user_who_ran_the_script>\AppData\Local\Temp\Lacework, if present, for additional details
- Validate the AccessToken value and make sure the correct token is being used in -AccessToken in the installation script command.
- Note: this should be a value from Settings → Agent tokens, not Settings→API Keys.
- If the correct token is in place in the command and the connectivity error is still present, ensure that the requirements outlined in Required Connectivity, Proxies, and Certificates are in place for communication with the Lacework platform.
- If both the AccessToken and connectivity requirements are in place and the error is still present, reach out to Lacework support for further assistance.
| 
