Before You Start: Collect the Installer Logs
Both error codes require log files to diagnose accurately. Collect these before attempting any fix — support will ask for them.
Open an elevated Command Prompt (Run as Administrator).
Re-run the installer with logging enabled:
Wait for the installer to fail, then locate the log file at the path you specified.
Also collect the Windows Event Viewer logs: open Event Viewer → Windows Logs → Application, filter by Source = MsiInstaller, and export the relevant entries.
msiexec /i SentinelOneInstaller.msi /l*v C:\Temp\S1_install.log
If the installer package itself is missing, download it from the Guardz console: Security Controls → Endpoint Security → Deploy (at the Single Customer scope), or from the SentinelOne console under Sentinels → Packages.
Exit Code 206 — Insufficient Permissions or Policy Block
Exit code 206 typically indicates the installer was blocked by a permissions restriction or a system policy. Common causes:
The installer was not run with administrator privileges.
A Group Policy Object (GPO) is blocking MSI installations from the path you used.
Windows Installer service is disabled or not running.
An existing SentinelOne agent installation is in a broken or partial state, preventing a clean install or upgrade.
Anti-tampering is enabled on an existing agent, requiring the uninstall passphrase before a new installation can proceed.
Resolution steps for exit code 206
Confirm you are running the installer from an elevated Command Prompt (right-click → Run as Administrator). Running from a standard user session will produce a 206 even if the account has local admin rights.
Check whether Windows Installer is running: open Services (services.msc), locate Windows Installer, and confirm its status is Running. If it is Stopped or Disabled, start it and retry.
Move the installer file to a local path (e.g., C:\Temp\) and re-run from there. GPO restrictions often block installer execution from network shares or Downloads folders.
Check for an existing broken SentinelOne installation: open Add/Remove Programs and search for SentinelOne. If an entry is present but the agent does not appear in the SentinelOne console, the existing installation must be fully removed first. See the article on uninstalling the Windows agent using the SentinelOneInstaller package for the removal procedure.
If anti-tampering is enabled on the existing agent, retrieve the uninstall passphrase from the SentinelOne console (Sentinels → locate the device → Agent Details → Passphrase) before attempting removal.
If the error persists after these steps, share the installer log and Event Viewer output with Guardz Support.
Exit Code 2000 — Installation Rollback or Internal Failure
Exit code 2000 indicates the MSI installation started but was rolled back before completing. This is usually caused by one of the following:
A conflicting security product (another EDR or AV) is blocking SentinelOne from writing its drivers or service files.
The endpoint does not meet the minimum OS version or patch level required by the agent version being installed.
Disk space on the system drive (C:\) is insufficient — SentinelOne requires at least 1 GB free during installation.
A previous SentinelOne installation left behind residual files or registry entries that cause the new install to conflict with itself.
Windows Defender or another AV quarantined a SentinelOne installer component mid-installation.
Resolution steps for exit code 2000
Check available disk space on C:\. If it is below 2 GB, free space before retrying.
Temporarily disable any third-party AV or EDR product on the endpoint, then retry the installation. Re-enable it once SentinelOne is installed and the agent appears as Active in the Guardz console.
Verify the OS version: open System Properties (sysdm.cpl) and confirm the Windows version and build number meet the requirements for the agent version you are installing. Refer to the SentinelOne release notes for the specific agent version's OS compatibility matrix.
Check for residual SentinelOne files: navigate to C:\Program Files\SentinelOne\ and C:\ProgramData\Sentinel. If either folder exists after a failed install, delete them and retry. Also check for lingering SentinelOne registry keys under HKLM\SYSTEM\CurrentControlSet\Services\.
Open Windows Defender Security Center → Protection History and check whether any SentinelOne installer components were quarantined. If so, restore them and add an exclusion for the installer directory before retrying.
If the rollback is still occurring after these steps, share the full installer log (C:\Temp\S1_install.log) with Guardz Support — the log will identify the exact step at which the rollback was triggered.
When to Contact Guardz Support
Contact Guardz Support directly if:
You have completed all steps above and the installer still fails with the same exit code.
The installer log shows an error referencing a SentinelOne console or management component — this may require a backend reset.
The device was previously managed by a different SentinelOne console (for example, a previous distributor's console). In this case, contact SentinelOne Support directly and reference 'Moving Agents from one Management Console to another Management Console.'