Error: "...pending system changes that require a reboot" when installing Endpoint Protection

Article:TECH103109  |  Created: 2007-01-16  |  Updated: 2015-02-18  |  Article URL
Article Type
Technical Solution




Symantec Endpoint Protection (SEP) fails to install when there are pending file rename operations on the computer. This affects SEP 11 and 12.1.

This issue has been reported on several computers with differing specifications and configurations, including the following:

  • The system is running Windows XP SP 3 or later, Windows Vista RTM or later, or Windows 2008 RTM or later.
  • An application or driver was installed or uninstalled previously to SEP which requires a reboot to complete some actions.
  • A reboot may or may not have been performed between the previous install/uninstall and the SEP installation attempt.
  • The installation attempt of SEP 11 fails with the message "Pending system changes that require a reboot have been detected".


The Microsoft Installer (MSI) package used to install the SEP client makes several checks during the install process to ensure that the installation will not cause system instability or possible damage to other application installations on the system it is being installed to.

One of these checks verifies that Windows is not configured to rename or move any files after the next reboot.

If there are file names present under the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations" registry value, the checks implemented by SEP will fail, and a "Pending system changes that require a reboot have been detected" message will be generated.

Files will be listed in the above registry key for several possible reasons:

  • An application installation attempted to update a file currently in use by Windows or another application.
  • A user or application attempted to delete, move or rename a file they may not have had permissions to.

It has become common practice for some applications which are not written to Microsoft's standards to write to the PendingFileRenameOperations registry value instead of directly renaming or deleting files.

This has been fixed in SEP 11 RU6a by removing the check of "PendingFileRenameOperations" registry key from the installer.


To resolve this issue, upgrade to the latest version of Symantec Endpoint Protection.

Workaround (if not upgrading)

The PendingFileRenameOperations registry value can be backed up and deleted. Symantec Endpoint Protection can then be installed, and the PendingFileRenameOperations value can then be replaced in order to facilitate installing Symantec Endpoint Protection without affecting the operating system or 3rd party applications negatively.

Note: This method will leave several temporary installation files in the logged-in user's temp directory that would normally be deleted after a reboot.

  1. Open the Windows Registry editor (regedit.exe) and browse to the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
  2. Verify the following Reg Multi String value PendingFileRenameOperations exists under this key.

    Note: If you do not find the PendingFileRenameOperations value in the location above, this error message can be generated if there are pending changes in:

  3. Right-click on the SessionManager registry key that contains the PendingFileRenameOperations value and choose Export
  4. Provide a file name and location for the exported registry key and click Save
  5. Delete the PendingFileRenameOperations value from the registry
  6. If HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired exists, right-click on the RebootRequired registry key and choose Export.
  7. Provide a different file name than in step 4 for the exported registry key and click Save
  8. Delete the RebootRequired sub-key
  9. Install Symantec Endpoint Protection normally
  10. Before rebooting, double-click on the .reg files created in Step 4 and 7 to merge the previous PendingFileRenameOperations value and RebootRequired sub-key.


Technical Information

Regarding "Pending system changes" and SEP installation rollback: RU6 removed the check of PendingFileRenameOperations registry key because many third-party programs do not use this key correctly and it may remain populated even after a reboot. However, there are still valid reasons for which our installer will terminate when there are pending changes detected.

The important question: does the SEP 11 RU6 installer work OK after rebooting the system? If so, that is the solution. We are concerned only if our installer fails for the same reason after rebooting the machine.


Legacy ID


Article URL

Terms of use for this information are found in Legal Notices