Symantec Endpoint Protection Client (SEP) installation fails and rolls back. Install log shows "( LUCHECK.EXE ) returned 206"

Article:TECH96534  |  Created: 2009-01-02  |  Updated: 2010-08-13  |  Article URL
Article Type
Technical Solution



Installation of Symantec Endpoint Protection (SEP) Client fails, rolls back.
LuCheck.exe returns value 206 in SEP_INST.LOG file.

Line items in the install log preceding the "Return value 3" notation resemble the following:

MSI (s) (64:C8) [17:35:58:446]: Executing op: ActionStart(Name=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,,)
Action 17:35:58: InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644.
MSI (s) (64:C8) [17:35:58:446]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,ActionType=3073,Source=BinaryData,Target=InstallLiveUpdate,CustomActionData=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ZLIUCRWD\LiveUpdate\lucheck.exe)
MSI (s) (64:54) [17:35:58:446]: Invoking remote custom action. DLL: C:\Windows\Installer\MSICA36.tmp, Entrypoint: InstallLiveUpdate
LUCA: InstallLiveUpdate enter.
LUCA: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ZLIUCRWD\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWaitC( LUCHECK.EXE ) returned 206
Action ended 17:36:22: InstallFinalize. Return value 3.



LiveUpdate conflict with DCOM settings.


Install the current LiveUpdate (LUSETUP.EXE).
LiveUpdate install program can be obtained from:
1. ) SEP 11 CD:
2. ) Symantec FTP site.

With LiveUpdate in place, make the following change to the DCOM settings for LuComServer:

  1. Click on Start
  2. Select Run
  3. Type: dcomcnfg
  4. Expand the Component Services
  5. Expand Computers
  6. Expand My Computer
  7. Expand DCOM Config
  8. Right-click LuComServer and select Properties
  9. Click on Identity tab,
  10. Select the "This user" option and choose a Local Administrator account.
    NOTE: use the Browse button if necessary; the account name must be prefixed by machine name to be recognized.
  11. Click OK,
  12. Restart the computer
  13. Retry the Symantec Endpoint Protection installation.


Legacy ID


Article URL

Terms of use for this information are found in Legal Notices