Parallels RAS 21.1.26691 Update — Watch Out for the Enrollment Server

Parallels RAS 21.1.26691 was released on Tuesday, April 22, 2026. The update goes smoothly on Brokers and Secure Gateways. However, if your farm includes Enrollment Servers, there is a strong chance the update will fail. Read this before launching the upgrade.

The Problem

Updating the Enrollment Server through the RAS Console fails with error 1603 — whether you use the automatic push from the console or run the MSI interactively. The issue is reproducible across multiple servers, including clean installations. This appears to be a bug in the 21.1.26691 package specifically on the upgrade path for the F_EnrollmentServer component.

Brokers and Secure Gateways are not affected and update normally.

The Workaround

The solution is to manually remove all artifacts from the previous installation, then reinstall the Enrollment Server component as a fresh install.

Prerequisites: RDP access with a local administrator account on the ES server, and the MSI RASInstaller-21.1.26691.msi copied to C:\Windows\Temp\.

Step 1 — Remove the services

sc delete "RAS Enrollment Server"
sc delete "RAS Service Watchdog"
sc delete "RAS Telegraf"
taskkill /F /IM RASEnrollServer.exe

Step 2 — Clean up the MSI registry keys

reg delete "HKLM\SOFTWARE\Classes\Installer\Products\24474D2DADB634E4D8A9A50BED9A2D75" /f
reg delete "HKLM\SOFTWARE\Classes\Installer\Features\24474D2DADB634E4D8A9A50BED9A2D75" /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2D47442-6BDA-4E43-8D9A-5AB0DEA9D257}" /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\24474D2DADB634E4D8A9A50BED9A2D75" /f
reg delete "HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\EC90378A7A607AA4F99A1E13EB8C7D9B" /f

Verify the keys are gone:

reg query "HKLM\SOFTWARE\Classes\Installer\Products\24474D2DADB634E4D8A9A50BED9A2D75"
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D2D47442-6BDA-4E43-8D9A-5AB0DEA9D257}"

Both should return “ERROR: The system was unable to find the specified registry key or value”.

Step 3 — Remove the cached MSI

del "C:\Windows\Installer\2672dc38.msi" /f

Step 4 — Reboot

Reboot the server before launching the reinstallation.

Step 5 — Fresh install of 26691

msiexec /i "C:\Windows\Temp\RASInstaller-21.1.26691.msi" ADDLOCAL=F_EnrollmentServer ADDFWRULES=1 /qn /l*vx+ C:\Windows\Temp\ES_fresh.log

Step 6 — Final reboot and verification

Get-Service "RAS Enrollment Server"

The service should be in Running state. Then verify in the RAS Console that the ES shows green under Farm > Site > Enrollment Servers.

Your SAML configuration and AD Integration are preserved — they are stored on the Broker side, not on the ES server itself.