Awaiting completion... Installing Wireshark via Intune v.4.1.7

The Toolkit General Discussion
1

Hello All,
Hope you can help me

I am trying to install wireshark via Intune. So far i am testing the commands.
The install commands is:

Start-ADTProcess -FilePath 'Wireshark-4.6.4-x64.exe'

the pop-up appears and it never installs, keeps forever, when checking the logs I can see this:

[Install] :: Executing ["C:\Windows\IMECache\8a5df426-c726-4f22-9bb9-a1e221b27652_3\Files\Wireshark-4.6.4-x64.exe"]...
[Install] :: Executed ["C:\Windows\IMECache\8a5df426-c726-4f22-9bb9-a1e221b27652_3\Files\Wireshark-4.6.4-x64.exe"], awaiting completion...

but if i install it with a Silent Argument, it works perfectly, like this:

Start-ADTProcess -FilePath 'Wireshark-4.6.4-x64.exe' -ArgumentList '/S'

Any clue why when the installation needs user interaction it does not work properly ?

Thank you so much
Ricardo Alves

2

The switch

-ArgumentList '/S'

tells the WireShark Installer (Wireshark-4.6.4-x64.exe) to run silently (using all the defaults), without this switch the installer runs interactively and expects the user to step through the install wizard (as it doesn't know if you want to install it using non-default settings)

I'm assuming you are running this as a SYSTEM install (so the Wireshark Installer will be hidden from the user, it's running in the SYSTEM context awaiting input)

Let me give you an analogy:
Without the switch, It's like me asking you to walk,
your response "where do you want me to walk to?"
With the switch, it's like me asking to you to walk to the end of your road and back.
you don't need to respond as you know where you are going.

This may help:

1 Like
3

basically you are saying that if I am installing as SYSTEM it always have to be installed with the Silent Argument ?

It doesn't make sense to me or do i misunderstanding something here?

Thank you Adrian

4

No, there are ways you can show the dialogs (i.e the Wireshark Install Wizard) to the user, but why wouldn't you want to install the app silently?
Unless you are wanting to install the winpcap driver (from nmap.org) which is not allowed to be installed silently due to a WireShark licensing restriction...
But there are ways around this too (N.B. This example is for PSADT 3.8.4, so will need updating for v4.1.8 if you intend to use):
Wireshark Install and Uninstall (PowerShell) - SILENT INSTALL HQ

1 Like
5

you are right, that's what i want, to be honest i am installing Wireshark and npcap in the same packaging.

I know that npcap can not be installed silently unless we have license (which we don't have), so the only way to install npcap needed to be with user interaction before Wireshark install itself silently.

In the beginning my commands were:

Start-ADTProcess -FilePath 'npcap-1.87.exe' -ArgumentList '/winpcap_mode=enforced /dot11_support=enforced /admin_only=disabled'
Start-ADTProcess -FilePath 'Wireshark-4.6.3-x64.exe' -ArgumentList '/EXTRACOMPONENTS=androiddump,ciscodump,randpktdump,sshdump,udpdump'

when npcap starts installing i got the same error: "awaiting completion..."
So i can install wireshark silently without any problem but still have the npcap issue

6

Yes you can not use the /S switch on the free version:

image
image365×148 10.2 KB

You need an OEM Distributers licence to get hold of the OEM version.

In earlier versions the workaround mentioned on the Silent Install HQ page used to work.

You may either need to change the section of your PSADT code to run the npcap installer Interactively using the -WindowsStyle 'Normal' switch, e.g.:

Start-ADTProcess -FilePath 'npcap-1.87.exe' -ArgumentList '/winpcap_mode=enforced /dot11_support=enforced /admin_only=disabled' -WindowStyle 'Normal'

or resort to use ServiceUI.exe to bring the Setup wizard dialogs into the Users context - There are Security risks in doing this though, so I would not recommend

1 Like
7

One other thing to add v 4.6.4 of WireShark has been released recently to fix three CVEs
Wireshark • Go Deep | Wireshark • Wireshark 4.6.4 Release Notes

I have just successfully installed this silently after I had installed npcap, using your two (modified) lines - I have included the path to the installers placed in the Files folder in PSADT:

# Install npcap 1.87 - N.B. requies user to interact with install wizard
Start-ADTProcess -FilePath "$($adtSession.DirFiles)\npcap-1.87.exe" -ArgumentList '/winpcap_mode=enforced /dot11_support=enforced /admin_only=disabled' -WindowStyle 'Normal'

# Install Wireshark 4.6.4 silently
Start-ADTProcess -FilePath "$($adtSession.DirFiles)\Wireshark-4.6.4-x64.exe" -ArgumentList '/S /EXTRACOMPONENTS=androiddump,ciscodump,randpktdump,sshdump,udpdump'
8

Did you run it via intune or only via PsEXEC ?
If i run it via SYSTEM (PsEXEC) it works good, but then when i create a package to import to intune it keeps showing the same "error"... "Awaiting completion".

As you said at least to install npcap we might need to use de ServiceUI, but i was trying to avaoid that

9

I didn't - I tested it in a Sandbox

I'm not sure exactly how to solve this, I have a hunch it may require setting

$($adtSession.DeployMode) = "Interactive"

before the NPcap install, then turn it back to auto afterwards (so it still hides the WireShark install)

$($adtSession.DeployMode) = "Auto"

But beware, this 'could' have unintended consequences -as Line 67 in the PSADT 4.1.8 Invoke-AppDeployToolkit.ps1 states:

 # Default is 'Auto'. Don't hard-code this unless required.

I think I'd wait for someone else to advise on how to achieve what you are trying to achieve :slight_smile:

2 Likes
10

Repackage the NPCAP driver, to do a silent install.

1 Like