Can't Install Elastic Agent On Windows Server

Elastic Stack Elastic Agent
1

Environment Context:

  • OS: Windows (x86_64)

  • Elastic Agent Version: 9.5.1

  • Deployment: Fleet-managed (On-Prem/Self-Managed Fleet Server)

  • Endpoint Protection: Kaspersky EDR (Disabled during troubleshooting)

Issue Summary: I am experiencing a persistent installation and startup failure with Elastic Agent 9.5.1 on a Windows host. The background daemon crashes immediately upon startup, failing to open the local IPC named pipe. This appears to be triggered by a missing component binary (elastic-otel-collector.exe) despite the presence of its configuration spec (.spec.yml).

Chronological Error Chain:

1. Component Validation Failure (Seen during uninstall and install): When running uninstall or install --force, the agent fails with:

Error: error uninstalling agent: error uninstalling components: failed to detect inputs and outputs: missing matching binary for C:\Program Files\Elastic\Agent\data\elastic-agent-9.5.1-59b3fd\components\elastic-otel-collector.spec.yml

2. Daemon Crash / Pipe Timeout (Seen during enrollment loop): During a fresh install attempt, the agent hangs on Waiting For Enroll... and fails with:

Restart attempt 3 failed: 'rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: open \\.\pipe\elastic-agent-system: The system cannot find the file specified."'

Troubleshooting Steps Already Completed: To isolate the issue, I have already performed the following steps:

  1. EDR Isolation: Completely disabled Kaspersky EDR to prevent binary locking or quarantining during ZIP extraction and runtime execution.

  2. Clean Wipe & Re-extract:

    • Stopped the Windows Service and deleted it via sc.exe delete "Elastic Agent".

    • Force-removed the C:\Program Files\Elastic directory entirely.

    • Deleted the old downloaded .zip and extracted folder. Downloaded and extracted a fresh copy of elastic-agent-9.5.1-windows-x86_64.zip.

  3. Port Conflict Check: Verified via netstat -ano that internal gRPC ports 6789 and 6790 are completely free.

  4. Bypass Flags: Executed the installation with install --force --insecure.