Repository: clong/DetectionLab

Issue #33:     wef: Exception calling "DownloadFile" with "2" argument(s): "The remote name could not be resolved: 'download.splunk.com'"
Created: 2017-12-15T23:40:20Z
I commented out the deployment of the logger and the DC seemed to go successfully however the WEF system failed and as a result I think the desktop didn't deploy.
wef: Downloading Splunk
  wef: Installing & Starting Splunk
  wef: Exception calling "DownloadFile" with "2" argument(s): "The remote name could not be resolved: 'download.splunk.com'"
  wef: At C:\tmp\vagrant-shell.ps1:8 char:3
  wef: +   (New-Object System.Net.WebClient).DownloadFile('https://www.splunk. ...
  wef: +   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  wef:     + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
  wef:     + FullyQualifiedErrorId : WebException
  wef: Splunk installation complete!
==> wef: Running provisioner: shell...
  wef: Running: scripts/install-windows_ta.ps1 as c:\tmp\vagrant-shell.ps1
  wef: Installing the Windows TA for Splunk
  wef: Installing the Windows TA
  wef:     Directory: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows
  wef: Mode                LastWriteTime         Length Name
  wef: ----                -------------         ------ ----
  wef: d-----       12/15/2017  11:27 PM                local
  wef: Sleeping for 15 seconds
  wef: Start-Process : This command cannot be run due to the error: The system cannot find the file specified.
  wef: At C:\tmp\vagrant-shell.ps1:15 char:1
  wef: + Start-Process -FilePath "C:\Program Files\SplunkUniversalForwarder\bi ...
  wef: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  wef:     + CategoryInfo          : InvalidOperation: (:) [Start-Process], InvalidOperationException
  wef:     + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand
  wef: Something went wrong during installation.
The following WinRM command responded with a non-zero exit status.
Vagrant assumes that this means the command failed!

powershell -ExecutionPolicy Bypass -OutputFormat Text -file "c:\tmp\vagrant-shell.ps1"

Stdout from the command:

Installing the Windows TA for Splunk
Installing the Windows TA


  Directory: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----       12/15/2017  11:27 PM                local
Sleeping for 15 seconds
Something went wrong during installation.


Stderr from the command:

Start-Process : This command cannot be run due to the error: The system cannot find the file specified.
At C:\tmp\vagrant-shell.ps1:15 char:1
+ Start-Process -FilePath "C:\Program Files\SplunkUniversalForwarder\bi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  + CategoryInfo          : InvalidOperation: (:) [Start-Process], InvalidOperationException
  + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand

Duplicate issue #34: win10: deployment errors
Created: 2017-12-16T00:05:22Z
Sorry for another one, I kicked off just the win10 machine and got a few errors. Looks like atom stuff and splunk.
win10: gyp info it worked if it ends with ok
  win10: gyp info using node-gyp@3.4.0
  win10: gyp info using node@6.9.5 | win32 | x64
  win10: gyp http GET https://atom.io/download/electron/v1.6.15/iojs-v1.6.15.tar.gz
  win10: gyp http 200 https://atom.io/download/electron/v1.6.15/iojs-v1.6.15.tar.gz
  win10: gyp http GET https://atom.io/download/electron/v1.6.15/SHASUMS256.txt
  win10: gyp http GET https://atom.io/download/electron/v1.6.15/win-x86/iojs.lib
  win10: gyp http GET https://atom.io/download/electron/v1.6.15/win-x64/iojs.lib
  win10: gyp WARN install got an error, rolling back install
  win10: gyp ERR! install error
  win10: gyp ERR! stack Error: getaddrinfo ENOTFOUND atom.io atom.io:443
  win10: gyp ERR! stack     at errnoException (dns.js:28:10)
  win10: gyp ERR! stack     at GetAddrInfoReqWrap.onlookup [as oncomplete] (dns.js:76:26)
  win10: gyp ERR! System Windows_NT 10.0.15063
  win10: gyp ERR! command "C:\\Users\\vagrant\\AppData\\Local\\atom\\app-1.23.1\\resources\\app\\apm\\bin\\node.exe" "C:\\Users\\vagrant\\AppData\\Local\\atom\\app-1.23.1\\resources\\app\\apm\\node_modules\\node-gyp\\bin\\node-gyp.js" "install" "--runtime=electron" "--target=1.6.15" "--dist-url=https://atom.io/download/electron" "--arch=x64" "--ensure"
  win10: gyp ERR! cwd C:\Users\vagrant\.atom
  win10: gyp ERR! node -v v6.9.5
  win10: gyp ERR! node-gyp -v v3.4.0
  win10: gyp ERR! not ok
  win10:

Another error
win10: Stop-Service : Service 'SplunkForwarder Service (splunkforwarder)' cannot be stopped due to the following error:
    win10: Cannot stop splunkforwarder service on computer '.'.
    win10: At C:\tmp\vagrant-shell.ps1:7 char:1
    win10: + Stop-Service splunkforwarder
    win10: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    win10:     + CategoryInfo          : CloseError: (System.ServiceProcess.ServiceController:ServiceController) [Stop-Service],
    win10:    ServiceCommandException
    win10:     + FullyQualifiedErrorId : CouldNotStopService,Microsoft.PowerShell.Commands.StopServiceCommand
    win10: WARNING: Waiting for service 'SplunkForwarder Service (splunkforwarder)' to start...
    win10: WARNING: Waiting for service 'SplunkForwarder Service (splunkforwarder)' to start...

Closing comment (2017-12-16T05:17:17Z): This issue looks to be related to #33 - DNS resolution is failing, which probably means:

DC was not online when this host was provisioning
DC didn't have internet access
Win10 was unable to contact the DNS server on DC

Can you confirm if any of these are the case?