Windows Installer (.msi) command-line reference for Symantec Client Security 3.x and Symantec AntiVirus 10.x

Article:TECH101190  |  Created: 2005-01-05  |  Updated: 2010-08-13  |  Article URL http://www.symantec.com/docs/TECH101190
Article Type
Technical Solution

Product(s)

Environment

Issue



You want to create a customized Symantec Client Security or Symantec AntiVirus installation package by using the Windows Installer.

 


Solution



Installing Symantec Client Security using command-line parameters
The Symantec Client Security client and server installation programs use Windows Installer (.msi) packages for installation and deployment. If you are using the command line to install or deploy an installation package, you can use the standard Windows Installer switches and Symantec-specific parameters to customize the installation.

For more information on using the standard Windows Installer commands, see the documents provided by Microsoft. For help with deploying a customized installation package using third-party deployment tools such as SMS or Tivoli, see the documentation that is provided with the deployment tool.

Default Symantec Client Security server installation
The default Symantec Client Security server installation package includes the following installation components:

  • Symantec Client Security server base files (including the user interface) are installed.
  • Symantec Client Security Help files are installed.
  • LiveUpdate is installed and updated virus definitions files are downloaded from the Symantec Web site (if the server is connected to the Internet).


The default Symantec Client Security server installation package includes the following installation settings:

  • Computer restart is required.
  • Auto-Protect is enabled after the computer is restarted.


Default Symantec Client Security client installation
The default Symantec Client Security client installation package includes the following installation components:

  • Symantec Client Security client base files (including the user interface) are installed, including the Symantec Client Security firewall client
  • Symantec Client Security Help files are installed.
  • Auto-Protect Email Snap-Ins (including Microsoft Exchange, Lotus Notes, and Internet Email) are installed and enabled if the corresponding Microsoft Exchange, Outlook, or Lotus Notes clients are detected. The Internet Email Snap-In is installed by default.
  • Symantec Quarantine client files are installed.
  • LiveUpdate is installed and updated virus definitions files are downloaded from the Symantec Web site (if the client is connected to the Internet).
     

The default Symantec Client Security client installation package includes the following installation settings:

  • The client is installed as an unmanaged client.
  • Computer restart is required.
  • Auto-Protect is enabled after the computer is restarted.


If you want to distribute a customized Grc.dat file as part of a Symantec Client Security Windows Installer-based (.msi) installation package, drop the Grc.dat file in the same directory as the installation files that are being used or distributed by the installation package. The installation program will detect the Grc.dat file and then use the settings that it contains.

 


Note: The default Symantec Client Security installation package requires the installation of both the Symantec Client Security AntiVirus client and the Symantec Client Security firewall client. To install the stand-alone Symantec Client Security AntiVirus client (without the Symantec Client Security firewall client), use the installation files that are in the \SAV directory on the Symantec Client Security CD. Installing Symantec Client Security firewall client without Symantec Client Security AntiVirus client is not supported.
 




Windows Installer commands and properties
The Symantec Client Security installation packages use the standard Windows Installer commands as well as a set of extensions for command-line installation and deployment. See the Windows Installer documentation for further information on the usage of standard Windows Installer commands and properties.

The following table describes the basic set of commands and properties that are used for Symantec Client Security client and server installations.

 

Command or property Description
Msiexec Windows Installer executable.
Symantec Client Security.msi Symantec Client Security installation file for clients. If any msi file contains spaces, enclose the file name in quotations when used with /i.
Symantec AntiVirus.msi Symantec Client Security installation file for both servers and clients.
/i <"msi file name"> Install the specified msi file. If the file name contains spaces, enclose the file name in quotations. If the msi file is not in the same directory from which
you execute Msiexec, specify the path name. If the path name contains spaces, enclose the path name in quotations.
For example, msiexec.exe /i "C:\<Path To>\Symantec Client Security.msi"
/x Uninstall the specified components.
/qn Install silently.

Note: Silent installation of the Symantec System Center is not supported.
/qb Install the basic user interface silently.
/qr Reduced User Interface. No modal dialog box appears at the end of the installation.
/qf Full User Interface. Authored FatalError, UserExit, or Exit modal dialog boxes appear at the end.
/qn+ No User Interface except for a modal dialog box displayed at the end.
/qb+ Basic User Interface with a modal dialog box displayed at the end. The modal box is not displayed if the user cancels the installation. Use qb+! or qb!+ to hide the Cancel button.
/qb- Basic User Interface with no modal dialog boxes. Please note that /qb+- is not a supported User Interface level. Use qb-! or qb!- to hide the Cancel button.
/qb!- Basic User Interface with progress bar but no modal dialog boxes.
/l*v <log filename> Create a verbose log file, where <log filename> is the name of the log file that you want to create.
REBOOT=<value> Suppress a computer restart after installation, where <value> is a valid argument. The valid arguments include the following:
    • Force: Requires that the computer is restarted
    • Suppress: Prevents most restarts
    • ReallySuppress: Prevents all restarts as part of the installation process

Note: You cannot suppress a restart when you are performing a silent uninstallation of Symantec AntiVirus client or server.
ADDLOCAL= <feature> Select custom features to be installed, where <feature> is a specified component or list of components. If this property is not used, all applicable features are installed by default, and Auto-Protect email clients are installed for detected email programs only. To add all appropriate features for either server or client installations, use the ALL command as in ADDLOCAL=ALL. For example, on the client, this command installs all email Auto-Protect components.

Note: When specifying a new feature to be installed, you must include the names of the features that are already installed on the target computer that you want to keep. If you do not specify the features that you want to keep, Windows Installer will remove them. Specifying existing features will not overwrite the installed features. To uninstall an existing feature, use the REMOVE command.
REMOVE=<feature> Uninstall the previously installed program or a specific feature from the installed program, where <feature> is one of the following:
    • <feature>: Uninstalls the feature or list of features from the target computer.
    • ALL: Uninstalls the program and all of the installed features. This is the default.


 


Note: The ! option is available with Microsoft Windows Installer 2.0 and works only with Basic User Interface. It is not a valid argument with the Full User Interface option.
 




Symantec Client Security properties
There are many Symantec Client Security properties that are used to customize Windows Installer installation packages.

Symantec Client Security server properties
The following table describes the properties that are configurable for the Symantec Client Security server installation.

 

Property Description
INSTALLSERVER=1 Specifies that the installation to be used is the server installation. A value of 0 (the default) indicates a client installation.
SERVERGROUPNAME=<server group name> Specifies the name of a new or existing server group that the target will join. If the server group is new, the installation installs and configures the server as the group's primary server, and the default logon user name is Admin.
SERVERGROUPPASS=<password> Specifies the name of a new or existing password of the server group that the target server will join. The default is symantec.
SERVERPARENT=<parent server name> For secondary server installations, specifies the name of the parent server. When performing a deployment using the Deploy Server
user interface or the Symantec System Center, this property is not required.
ENABLEAUTOPROTECT=<val> Determines whether Auto-Protect is enabled after the installation is complete, where <val> is one of the following values:
  • 1: Enables Auto-Protect after installation. This is the default setting.
  • 0: Disables Auto-Protect after installation.
RUNLIVEUPDATE=<val> Determines whether LiveUpdate is enabled as part of the installation, where <val> is one of the following:
  • 1: Enables LiveUpdate after installation. This is the default setting.
  • 0: Disables LiveUpdate after installation.
To use this property, Administrator or Power User privileges are required. If you attempt the installation without the correct privileges, the installation may fail without notice. LiveUpdate is a required component of the Symantec Client Security installation
SYMPROTECTDISABLED=<val> Determines whether SymProtect is enabled as part of the installation, where <val> is one of the following:
  • 1: Disables SymProtect after installation.
  • 0: Enables SymProtect after installation. This is the default setting.
Optional
INSTALLDIR=<target directory> Specifies the installation directory on the target computer. The default directory is C:\Program Files\Symantec AntiVirus. If the path specified contains long file names, use quotation marks around it.



Symantec Client Security client properties
The following table describes the properties that are configurable for the Symantec Client Security client installation.

 

Property Description
INSTALLSERVER=0 Specifies that the installation to be used is the client installation. 0 is the default. A value of 1 indicates a server installation.
NETWORKTYPE=<val> Describes the management state of the target computer when installation is complete, where <val> is one of the following:
  • 1: Managed
  • 2: Unmanaged (default)
SERVERNAME=<parent server name> Specifies the name of the existing server that manages the target computer. Required if NETWORKTYPE=1.
ENABLEAUTOPROTECT=<val> Determines whether Auto-Protect is enabled after the installation is complete, where <val> is one of the following values:
  • 1: Enables Auto-Protect after installation. This is the default setting.
  • 0: Disables Auto-Protect after installation.
SYMPROTECTDISABLED=<val> Determines whether SymProtect is enabled as part of the installation, where <val> is one of the following:
  • 1: Disables SymProtect after installation.
  • 0: Enables SymProtect after installation. This is the default setting.
Optional
RUNLIVEUPDATE=<val> Determines whether LiveUpdate is enabled as part of the installation, where <val> is one of the following:
  • 1: This enables LiveUpdate after installation. This is the default setting.
  • 0: Disables LiveUpdate after installation.
To use this property, Administrator or Power User privileges are required. If you attempt the installation without the correct privileges, the installation may fail without notice. LiveUpdate is a required component of the Symantec Client Security installation.
MIGRATESETTINGS=<val> Specifies whether to install firewall policy file settings from Cpolicy.xml if the file is contained in a distribution package, where <val> is one of the following:
  • 0: If Cpolicy.xml exists, installs the policy settings contained in this file.
  • 1: if Cpolicy.xml exists, does not install the policy settings contained in this file.
INSTALLDIR= <target directory> Specifies the installation directory on the target computer. The default directory is C:\Program Files\Symantec Client Security.
If the path specified contains long file names, use quotation marks around it.


Windows Security Center features
These properties apply to unmanaged clients only. These properties are controlled by the Symantec System Center for managed clients.

The following table describes the properties that are configurable to control interaction between users and Windows Security Center (WSC) running on Windows XP Service Pack 2.

 

Property Description
WSCCONTROL=<val> Controls WSC where <val> is one of the following:
  • 0: Do not control (default).
  • 1: Disable once, the first time it is detected.
  • 2: Disable always.
  • 3: Restore if disabled.
WSCAVALERT=<val> Configures antivirus alerts for WSC where <val> is one of the following:
  • 0: Enable.
  • 1: Disable (default).
  • 2: Do not control.
WSCFWALERT=<val> Configures firewall alerts for WSC where <val> is one of the following:
  • 0: Enable.
  • 1: Disable (default).
  • 2: Do not control.
WSCAVUPTODATE=<val> Configures WSC out-of-date time for antivirus definitions where <val> is one of the following:
1—90: Number of days (default is 30).



Symantec Client Security features
There are many Symantec Client Security features that can be installed using a customized Windows Installer package. These features are used by the Windows Installer ADDLOCAL property to specify the features that are installed.

Symantec Client Security server features
The following are the features that are configurable for the Symantec Client Security server installation.

Feature Description
SAVMain Specifies the basic Symantec Client Security client files. This feature is required.
SAVUI Makes the user interface available to the target computer.
SAVHelp Lets you include Symantec Client Security Help files.


Symantec Client Security AntiVirus client features
The following are the features that are configurable for the Symantec Client Security AntiVirus client components.

Feature Description
SAVMain Specifies the basic Symantec Client Security client files. This feature is required.
SAVUI Makes the user interface available to the target computer.
SAVHelp Lets you include Symantec Client Security Help files.
EMailTools Lets you include all Auto-Protect email components.
OutlookSnapin Lets you include the Microsoft Exchange Auto-Protect email component.
NotesSnapin Lets you include the Lotus Notes Auto-Protect email component.
Pop3Smtp Lets you include the Internet Email Auto-Protect component.
QClient Lets you include the Symantec Quarantine client.


Symantec Client Security firewall client features
The following are the features that are configurable for the Symantec Client Security firewall client components. Installing firewall client components without the required AntiVirus client components is not supported.

Feature Description
SCFMain Specifies the basic Symantec Client Security firewall client files. This feature is required.
SCFHelp Lets you include Symantec Client Security firewall client Help files.
AntiSpam Used to configure the Ad Blocking component.


Windows firewall features
Windows XP contains firewalls that are enabled by default. Windows XP with Service Pack 1 includes a firewall called Internet Connection Firewall.Windows XP with Service Pack 2 includes a firewall called Windows Firewall. It is not necessary for more than one client firewall to be installed on a computer.

Since Symantec Client Security firewall client provides superior protection to the Windows firewalls, firewall installation automatically turns off a detected Windows firewall so that it does not run unless it is turned on again manually. By default, Symantec Client Security firewall client only turns off a detected Windows firewall the first time, but you can configure Symantec Client Security firewall client to check every time that it starts for a Windows firewall. If the Symantec Client Security firewall client is uninstalled, it re-enables the Windows firewall. This functionality is supported regardless of whether the Windows firewall is enabled before Symantec Client Firewall is installed or after, as is the case when Windows XP SP2 is deployed to a computer.

The following table describes the properties that you can configure to control both Windows firewalls.

 

Property Description
ICFCONTROL=<val> Controls the detected Windows firewall where <val> is one of the following:
  • 0: Do not control (default).
  • 1: Disable once, the first time it is detected.
  • 2: Disable always.
  • 3: Restore if disabled.
ICFDISABLENOTIFY=<val> Controls the Windows notification message where <val> is one of the following:
  • 0: Do not disable.
  • 1: Disable (default).



Using the log file to check for errors
The Windows Installer creates a log file that can be used to verify whether or not an installation was successful, list the components that were successfully installed, and provide a variety of further details related to the installation package. The log file can be used as an effective tool to troubleshoot an installation package that fails.

If the installation is successful, the log file includes a success entry near the end. If the installation is not successful, an entry is created that indicates that the installation failed. The log file (sav_inst.log) that is created by the default installation package (scs_inst.log) is added to the \temp directory associated with the user that is running (or deploying) the installation package.
 


Note: Each time the installation package is executed, the log file is overwritten. Appending an existing log file is not supported.
 



To identify the point of failure of an installation
You can use the log file to help identify the component or action that caused an installation to fail.

  1. In a text editor, open the log file that was generated by the installation.
  2. Search for the following:

    VALUE=3

    The action that occurred before the line that contains this entry is most likely the action that caused the failure. The lines that appear after this entry are installation components that have been rolled back because the installation was unsuccessful.



Command-line examples
The following list includes some commonly used command-line examples.

Task 1
Silently install an unmanaged Symantec Client Security client with default settings to the c:\SFN directory. On the command line type the following:
 

    msiexec /i "Symantec Client Security.msi" INSTALLDIR=C:\SFN /qn


Task 2
Silently install an unmanaged Symantec Client Security client with all of the default features except QClient. Do not restart the computer after installation, and do not enable Auto-Protect when the computer is (ultimately) restarted. On the command line type the following:
 

    msiexec /i "Symantec Client Security.msi" ADDLOCAL=SAVMain,SAVUI,SAVHelp,EMailTools,OutlookSnapin,NotesSnapin,Pop3Smtp,SCFMain,SCFHelp,AntiSpam ENABLEAUTOPROTECT=0 RUNLIVEUPDATE=1 REBOOT=ReallySuppress /qn


Task 3
Silently install a managed Symantec Client Security client to the default path that is managed by the SR1 server (having the password
my$Pass) with no Symantec AntiVirus Help, no Lotus Notes snap-in, and no Firewall Help. Do not run LiveUpdate, and do not restart the computer automatically. On the command line type the following:
 

    msiexec /i "Symantec Client Security.msi" ADDLOCAL=SAVMain,SAVUI,SAVHelp,EMailTools,OutlookSnapin,Pop3Smtp,QClient,SCFMain,AntiSpam NETWORKTYPE=1 SERVERNAME=SR1 SERVERGROUPPASS="my$Pass" ENABLEAUTOPROTECT=1 RUNLIVEUPDATE=0 REBOOT=ReallySuppress /qn



References
For a full list of MSI error codes, read the Microsoft Windows Installer Error Code page.



 



Legacy ID



2005040511242648


Article URL http://www.symantec.com/docs/TECH101190


Terms of use for this information are found in Legal Notices