Network Management

SolarWinds Agent upgrade fails because the signing chain terminates at an untrusted Microsoft root certificate

Remote deployment of SolarWinds-Agent.msi can fail when the target machine does not trust Microsoft Identity Verification Root Certificate Authority 2020. In this case, Windows signature validation fails during WinVerifyTrust, and the agent installer is rejected even though the MSI itself is signed.

First published date

4/16/2026 10:30 AM

Last published date

4/16/2026 10:30 AM

Overview

After an upgrade, the SolarWinds platform sends SolarWinds-Agent.msi to a target endpoint, the endpoint validates the MSI digital signature before allowing the install to proceed.

The certificate path for the MSI signer ends at Microsoft Identity Verification Root Certificate Authority 2020, but that root is not present in the Trusted Root Certification Authorities store on the target machine.

The agent log (C:\ProgramData\SolarWinds\Logs\Agent\SolarWinds.Agent.Service.exe.XXXXX.log) shows the MSI is saved locally and then fails digital signature verification with WinVerifyTrust failed. Error Code [-2146762487]. After that, the task is rejected and the install does not continue.

[INFO] RegisterTaskHandler::OnReceived - saving agent install into file [C:\ProgramData\SolarWinds\Agent\Plugins\SolarWinds-Agent.msi]
[WARN] ewCore::verifydigitalcertificate - WinVerifyTrust failed. Error Code [-2146762487]
[WARN] RegisterTaskHandler::OnReceived - deviceID [911794e1-eb6c-4283-8007-72c7c510335b.AMSF], TaskID [83b14822-eb42-4c2d-911b-66409c7d5055], digital signature verification had failed for install file [C:\ProgramData\SolarWinds\Agent\Plugins\SolarWinds-Agent.msi]

SolarWinds validation in this path relies on the Windows WinVerifyTrust API for Authenticode verification, so trust evaluation depends on the endpoint's Windows certificate chain state rather than only on the MSI contents.

So when you go to the Settings > Manage Agents, you can see some Windows Agents are connected, but showing Updating in Progress.

Product section

Orion Platform

Cause

The issue occurs because the Remote Agent node does not trust the root CA required to complete the MSI signing chain. 

The certificate UI shows the chain terminating in Microsoft Identity Verification Root Certificate Authority 2020 and explicitly reports that the CA root certificate is not trusted because it is not in the Trusted Root Certification Authorities store.

As a result, Windows cannot complete trust validation for the signer certificate, and WinVerifyTrust returns a failure during MSI verification.

If you go to the C:\Program Files\SolarWinds\Orion\AgentManagement\Installers and right click on the SolarWinds-Agent.MSI

Click on Digital Signatures > Details > You can see the Digital Signature Information not trusted.

Click on View Certificate > Certification Path > Microsoft Identify Verification Root Certificate Authority 2020

It will shown "The CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store.

Resolution

In the certification path, select the Microsoft Identify Verification Root Certificate Authority 2020 and then click on view certificate.

 

Click on Install Certificate > Local Machine > Place all certificates in the following Store > select Trusted Root Certification Authorities

Once you complete it, it will import the certificate to the remote Agent device and the certificate error will disappear.

 

Once you restart the Solarwinds Module Engine on the poller which the agent is assigned, it will reinstall the Agent correctly, and the following log will appear:

 

[INFO] RegisterTaskHandler::OnReceived - create_directories [C:\ProgramData\SolarWinds\Agent\Plugins] returned code [errorcode:0, category:system, message:"The operation completed successfully"]
[INFO] RegisterTaskHandler::OnReceived - saving agent install into file [C:\ProgramData\SolarWinds\Agent\Plugins\SolarWinds-Agent.msi]
[INFO] RegisterTaskHandler::OnReceived - deviceID [911794e1-eb6c-4283-8007-72c7c510335b.AMSF], TaskID [52b5c361-2db1-4641-98eb-37a132693629], install file [C:\ProgramData\SolarWinds\Agent\Plugins\SolarWinds-Agent.msi] digital signature was verified.
[INFO] RegisterTaskHandler::OnReceived - deviceID [911794e1-eb6c-4283-8007-72c7c510335b.AMSF], TaskID [52b5c361-2db1-4641-98eb-37a132693629], installing agent from file [C:\ProgramData\SolarWinds\Agent\Plugins\SolarWinds-Agent.msi]

 

Although you can sometimes view the certificate path from the MSI properties UI, the required root certificate is not always recoverable directly from the MSI in an automated way on an affected machine.

This is because Windows may be constructing the visible certification path by using local trust stores and chain-building behavior, while PowerShell access to the MSI signature usually exposes only the signer certificate directly.

Because of that, the most reliable remediation is:

  1. Export the required root certificate from a healthy machine that already trusts it.

  2. Copy the .cer file to affected endpoints. (Can be done via GPO)

  3. Import it into Cert:\LocalMachine\Root. (Can be done via GPO)

  4. Retry the SolarWinds Agent deployment.

Example PowerShell import
Import-Certificate -FilePath 'C:\Temp\Microsoft Identity Verification Root Certificate Authority 2020.cer' -CertStoreLocation Cert:\LocalMachine\Root