Run script and review response codes

Now that your batch file contains the necessary commands to install and configure Trust Protection Foundation, you're ready to run the script (with elevated privileges) on each Trust Protection Foundation server. For example, with the batch file created in the previous sections, you could right-click on the file and select Run as Administrator.

Response codes

When running the command line configuration utility, you will get one of the following response codes after the configuration script runs. This list provides the response codes and a description of what the response code means, as well as the action you should take to remedy the situation.

Code	Description	Additional Information
0	The Trust Protection Foundation configuration completed successfully
1	The specified XML file could not be opened, or does not exist	Check the spelling and directory information to ensure the file is in the specified location.
2	An error occurred trying to process the XML file	The XML answer file's password might be incorrect, or the XML file contains invalid syntax, or contains unexpected properties or values.
3	The installation process failed
4	The system could not detect the installation mode, or it is configured but its stored configuration cannot be read	Starting in 26.2, `-install` returns this code instead of running a first-time installation over a server that is already configured. The server's stored configuration is encrypted with a key the server can no longer use, usually because the HSM no longer accepts the server's PIN, or because the software encryption key is missing or has changed. Repair the HSM connection with `-hsmpin`, or restore the software encryption key with `-keyimport`, and then run the command again. The command reports the reason and logs event 87 in the Windows Application log, under the source `Trust Protection Foundation MMC Snap-In`.
5	The system is already up to date with the latest code.	No action was taken. If this is unexpected, verify that you have the latest version of Palo Alto Networkssoftware.
6	TppConfiguration.exe was called without administrator rights.	Your command prompt must have administrative permissions to complete this action. Run the command prompt as an administrator.
100	TppConfiguration.exe encountered an unexpected failure (exception)	Error details are written to the log file. Review the details and, if necessary, contact Palo Alto Networks Support.
200	TppConfiguration.exe failed to add a third-party trusted signer.
201	TppConfiguration.exe failed to remove a third-party trusted signer.
202	TppConfiguration.exe failed to read the third-party DLL.
401	TppConfiguration.exe failed to store the system HSM PIN on this server.	Nothing was changed. Error details are written to the log file. Review the details and, if necessary, contact Palo Alto Networks Support.
402	TppConfiguration.exe encountered an unexpected failure (exception) while storing the system HSM PIN on this server.	Nothing was changed. Error details are written to the log file. Review the details and, if necessary, contact Palo Alto Networks Support.
403	TppConfiguration could not open the HSM with the new system HSM pin, so nothing was changed.	New in 26.2. `-hsmpin` tests the new PIN against the HSM before it stores anything, and this code means the test failed: either the HSM refused the PIN, or the configured key could not be found on the token. Change the PIN on the HSM partition before you run the command, and make sure the HSM is reachable. IMPORTANT Every refused PIN counts toward the HSM's login lockout. Confirm the PIN before you run the command again.
404	TppConfiguration stored the system HSM pin but failed to update the encryption driver. Correct the reported problem and run it again.	New in 26.2. The server's own copy of the PIN was stored, but the HSM connectors in the configuration database were not updated, so the platform still cannot log in to the HSM. This code is also returned when the master administrator credentials you supplied are rejected, because Trust Protection Foundation checks them after it stores the server's copy. Correct the problem the command reports, then run the command again. Re-running is safe: connectors that already hold the new PIN are left alone.