Removal of SEP 12.1 client fails with error code 1603.

Article:TECH180344  |  Created: 2012-01-31  |  Updated: 2013-09-24  |  Article URL
Article Type
Technical Solution


- There is a need to remove the SEP 12.1 client on some machines or servers, but during the removal, the SEP client uninstall fails and starts a rollback with error code = 1603.


MSI (s) (B4:30) [14:11:12:277]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIC360.tmp, Entrypoint: StopSMC
stopProtectedService: Attempting to stop SmcService
stopProtectedService: Unloading BASH driver...
stopProtectedService: Failed to unload BASH with HRESULT=0x80070005
CustomAction StopSMC returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (B4:C0) [14:11:12:667]: User policy value 'DisableRollback' is 0
MSI (s) (B4:C0) [14:11:12:667]: Machine policy value 'DisableRollback' is 0
Action ended 14:11:12: InstallFinalize. Return value 3.


Windows 2008 R2 - x64


You need to remove the SEP client on some machines, but cannot use the Symantec CleanWipe utility for removal of SEP clients.


- Follow the procedures below and remove the SEP client after stopping these SEP services.

1- Open CMD

2 - Type the command lines:

 taskkill /pid smc.exe /f
 taskkill /pid ccSvcHst.exe /f

3 - Once the SEP client services have stopped, rerun the removal.

NOTE: The SC command line did not worked for stop the SEP services. <sc stop SepMasterService>

Article URL

Terms of use for this information are found in Legal Notices