• VDA installation fails with error "Installation of the VDA Monitor Plug-in failed with error code 1603."

• In XenDesktop Installation.log saved at C:\Users\<Install User>\AppData\Local\Temp\Citrix\XenDesktop Installer, the below failure was seen.

20:21:46.5890 : XenDesktopSetup:Process completed with error code 0x00000643
20:21:46.5900 $ERR$ : XenDesktopSetup:Installation of MSI File 'VdaMonitorPlugin_x64.Msi' failed with code 'InstallFailure' (1603).
20:21:46.5920 $ERR$ : XenDesktopSetup:InstallComponent: Failed to install component 'VDA Monitor Plug-in'. Installation of MSI File 'VdaMonitorPlugin_x64.Msi' failed with code 'InstallFailure' (1603).

• Enabled MSI verbose logging (https://docs.microsoft.com/en-us/troubleshoot/windows-client/application-management/enable-windows-installer-logging ) and collect Process Monitor logs while capturing the installation failure

In MSI logs created for VdaMonitorPlugin_x64 the below error got logged:

MSI (s) (28:E4) [20:21:46:564]: Note: 1: 1708
MSI (s) (28:E4) [20:21:46:564]: Product: Citrix Monitor Service VDA Plugin -- Installation failed.

MSI (s) (28:E4) [20:21:46:223]: Product: Citrix Monitor Service VDA Plugin -- Error 1920. Service 'Citrix Desktop Service' (BrokerAgent) failed to start. Verify that you have sufficient privileges to start system services 
 

• As per procmon logs we saw ACCESS DENIED for BrokerAgent.exe (which runs under NT AUTHORITY\NETWORK SERVICE) on file

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config.

00:51:15.7172558             BrokerAgent.exe             13728    CreateFile                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config ACCESS DENIED Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: n/a, ShareMode: Read, AllocationSize: n/a     NT AUTHORITY\NETWORK SERVICE         0


 

The issue was resolved after assigning default permissions to below accounts on on C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config.

Users
All Application Packages
All Restricted Application Packages

---

Problem Cause

On comparing  the permissions from the working and non-working machines it was found that the default permissions for the below accounts were missing  on C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config

Users
All Application Packages
All Restricted Application Packages