error during install

[sidomir7]

Hi, when I want to install Win-For v 11.01 I have this errors.

2026-01-06 20:00:47 - Network connection detected, continuing...
2026-01-06 20:00:47 - Win-FOR v11.1.0
2026-01-06 20:00:47 - X-Ways is not selected and will not be downloaded / installed
2026-01-06 20:00:47 - No theme has been selected.
2026-01-06 20:00:47 - WSL is not selected.
2026-01-06 20:00:47 - Selected user is analyst
2026-01-06 20:00:47 - Standalones path box was empty - default will be used - C:\standalone
2026-01-06 20:00:47 - C:\winfor-temp\ is being created for temporary storage of required files
2026-01-06 20:00:47 - Git 2.49.0.windows.1 is not installed
2026-01-06 20:00:47 - Found previous download of Git - comparing hash
2026-01-06 20:00:47 - File Hash: 726056328967f242fe6e9afbfe7823903a928aff577dcf6f517f2fb6da6ce83c
2026-01-06 20:00:47 - Given Hash: 726056328967f242fe6e9afbfe7823903a928aff577dcf6f517f2fb6da6ce83c
2026-01-06 20:00:47 - Hash value for C:\winfor-temp\Git-2.49.0-64-bit.exe is correct, continuing...
2026-01-06 20:00:47 - Installing Git 2.49.0
2026-01-06 20:00:50 - Installation of Git v2.49.0 is complete
2026-01-06 20:00:50 - SaltStack 3007.2 is already installed
2026-01-06 20:00:50 - Current release of WIN-FOR is v2026.0.0
2026-01-06 20:00:50 - C:\winfor-temp\v2026.0.0.zip and C:\winfor-temp\v2026.0.0.zip.sha256 already exist and not zero-byte files.
2026-01-06 20:00:50 - Comparing hashes...
2026-01-06 20:00:51 - File Hash: 3d1fdf241e06eac0ee8409e4013b6e2c6a895c948e4ec2d601ea2c166178b276
2026-01-06 20:00:51 - Given Hash: 3d1fdf241e06eac0ee8409e4013b6e2c6a895c948e4ec2d601ea2c166178b276
2026-01-06 20:00:51 - Hashes match, continuing...
2026-01-06 20:00:51 - Extracting archive...
2026-01-06 20:00:51 - Checking for and removing previous repo folder
2026-01-06 20:00:51 - Extracting C:\winfor-temp\v2026.0.0.zip to C:\winfor-temp\
2026-01-06 20:00:53 - Moving C:\winfor-temp\winfor-salt-2026.0.0\winfor folder to C:\ProgramData\Salt Project\Salt\srv\salt\winfor
2026-01-06 20:00:54 - Custom state custom.sls copied to the SaltStack winfor directory
2026-01-06 20:00:54 - Installing the selected states.
Log File: C:\winfor-saltstack-v2026.0.0.log
Executing: salt call with the following variables
  winfor.custom
  { 'winfor_user': 'analyst', 'inpath': 'C:\standalone'}

2026-01-06 20:00:59 - [INFO    ] Executing command C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE in directory 'C:\Users\analyst'
2026-01-06 20:01:06 - [INFO    ] Loading fresh modules for state activity
2026-01-06 20:01:06 - [INFO    ] Fetching file from saltenv 'base', ** done ** 'winfor/custom.sls'
2026-01-06 20:01:07 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:10 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:13 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:16 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:19 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:21 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:24 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:27 - [CRITICAL] Rendering SLS 'base:winfor.packages.ksdumper11' failed: while parsing a block mapping
2026-01-06 20:01:27 -   in "<unicode string>", line 19, column 7
2026-01-06 20:01:27 - did not find expected key
2026-01-06 20:01:27 -   in "<unicode string>", line 20, column 85
2026-01-06 20:01:28 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:31 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:33 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:36 - [CRITICAL] Rendering SLS 'base:winfor.standalones.chainsaw' failed: while parsing a block mapping
2026-01-06 20:01:36 -   in "<unicode string>", line 19, column 7
2026-01-06 20:01:36 - did not find expected key
2026-01-06 20:01:36 -   in "<unicode string>", line 20, column 85
2026-01-06 20:01:38 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:40 - [CRITICAL] Rendering SLS 'base:winfor.standalones.hayabusa' failed: while parsing a block mapping
2026-01-06 20:01:40 -   in "<unicode string>", line 19, column 7
2026-01-06 20:01:40 - did not find expected key
2026-01-06 20:01:40 -   in "<unicode string>", line 20, column 85
2026-01-06 20:01:41 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:43 - [CRITICAL] Rendering SLS 'base:winfor.standalones.zircolite' failed: while parsing a block mapping
2026-01-06 20:01:43 -   in "<unicode string>", line 22, column 7
2026-01-06 20:01:43 - did not find expected key
2026-01-06 20:01:43 -   in "<unicode string>", line 23, column 85
2026-01-06 20:01:43 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:46 - [CRITICAL] Rendering SLS 'base:winfor.standalones.mimikatz' failed: while parsing a block mapping
2026-01-06 20:01:46 -   in "<unicode string>", line 18, column 7
2026-01-06 20:01:46 - did not find expected key
2026-01-06 20:01:46 -   in "<unicode string>", line 19, column 85
2026-01-06 20:01:46 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:49 - [CRITICAL] Rendering SLS 'base:winfor.standalones.nirsoft' failed: while parsing a block mapping
2026-01-06 20:01:49 -   in "<unicode string>", line 25, column 7
2026-01-06 20:01:49 - did not find expected key
2026-01-06 20:01:49 -   in "<unicode string>", line 26, column 85
2026-01-06 20:01:49 - [INFO    ] Executing command 'powershell' in directory 'C:\Users\analyst'
2026-01-06 20:01:51 - [CRITICAL] Rendering SLS 'base:winfor.standalones.procdot' failed: while parsing a block mapping
2026-01-06 20:01:51 -   in "<unicode string>", line 23, column 7
2026-01-06 20:01:52 - did not find expected key
2026-01-06 20:01:52 -   in "<unicode string>", line 24, column 85
2026-01-06 20:01:53 - 
Exited		: 26/01/06 20:01:53
Exit code 	: 1
Elapsed time	: 59205
2026-01-06 20:01:53 - Installation has ended with errors.

[sidomir7]

I have defender disabled totaly so it could be problem that because It looks like all errors are related to.

cmd.run:
{% if defender_status == "Running" %}
    - names:
      - 'echo "Defender is {{ defender_status }}"'
      - 'Add-MpPreference -ExclusionPath "{{ inpath }}"'
      - 'Add-MpPreference -ExclusionPath "C:\salt\tempdownload"'
      - 'Add-MpPreference -ExclusionPath "{{ PROGRAMDATA }}\Salt Project\Salt\var"'
{% else %}
    - name:
      - 'echo "Defender is {{ defender_status }}"'
{% endif %}
    - shell: powershell

[digitalsleuth]

Hi @sidomir7 , can you provide a copy of your winfor-saltstack-v2026.0.0.log file from the root of your C:\ drive? I suspect you are correct, that it is related to Defender. I should be able to identify the issue from the log file, but can you also tell me precisely what version of Windows you're running?

[sidomir7]

winfor-saltstack-v2026.0.0.log

[sidomir7]

Systeminfo

Host Name:                 DESKTOP-AD398BB
OS Name:                   Microsoft Windows 11 Pro
OS Version:                10.0.22631 N/A Build 22631
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          analyst
Registered Organization:
Product ID:                00330-80201-23193-AA990
Original Install Date:     25/01/08, 06:04:45
System Boot Time:          26/01/07, 14:00:28
System Manufacturer:       VMware, Inc.
System Model:              VMware20,1
System Type:               x64-based PC
Processor(s):              2 Processor(s) Installed.
                           [01]: Intel64 Family 6 Model 94 Stepping 3 GenuineIntel ~3504 Mhz
                           [02]: Intel64 Family 6 Model 94 Stepping 3 GenuineIntel ~3504 Mhz
BIOS Version:              VMware, Inc. VMW201.00V.24006586.B64.2406042154, 24/06/04
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC+01:00) Belgrade, Bratislava, Budapest, Ljubljana, Prague
Total Physical Memory:     8,779 MB
Available Physical Memory: 5,447 MB
Virtual Memory: Max Size:  10,827 MB
Virtual Memory: Available: 7,495 MB
Virtual Memory: In Use:    3,332 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    WORKGROUP
Logon Server:              \\DESKTOP-AD398BB
Hotfix(s):                 4 Hotfix(s) Installed.
                           [01]: KB5066133
                           [02]: KB5027397
                           [03]: KB5068865
                           [04]: KB5068070
Network Card(s):           2 NIC(s) Installed.
                           [01]: Intel(R) 82574L Gigabit Network Connection
                                 Connection Name: Ethernet0
                                 DHCP Enabled:    Yes
                                 DHCP Server:     192.168.75.254
                                 IP address(es)
                                 [01]: 192.168.75.128
                                 [02]: fe80::9635:9f48:2777:ef36
                           [02]: Wintun Userspace Tunnel
                                 Connection Name: Tailscale
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 100.71.161.17
                                 [02]: fe80::d8ff:5060:f230:9168
                                 [03]: fd7a:115c:a1e0::3501:a111
Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.

[digitalsleuth]

Hi @sidomir7 , I've got a patch ready to roll, but I'm just attempting to duplicate the error before I submit it and I have yet to be able to do so. Can you tell me if you "removed" the WinDefend service vice disabling it or stopping it? And if possible, would you be able to provide me the output of the PowerShell command Get-Service? If you'd rather not share that output here, you can email me directly via github [at] digitalsleuth [dot] ca.