Symantec Endpoint Protection installation fails with "CreateProcessAndWait( LUCHECK.EXE ) returned 206" in the installation log

Article:TECH96559  |  Created: 2009-01-05  |  Updated: 2013-06-10  |  Article URL
Article Type
Technical Solution



The installation of a Symantec Endpoint Protection (SEP) client or a Symantec Endpoint Protection Manager (SEPM) fails.  The process rolls back with "CreateProcessAndWait( LUCHECK.EXE ) returned 206" in the installation log


The install log contains:

LUCA: InstallLiveUpdate enter.
LUCA: C:\Users\ADMINI~1\AppData\Local\Temp\VFCCFIRX\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 206
MSI (s) (A8:F4) [16:31:20:736]: User policy value 'DisableRollback' is 0
MSI (s) (A8:F4) [16:31:20:736]: Machine policy value 'DisableRollback' is 0
Action ended 16:31:20: InstallFinalize. Return value 3.


This error can occur during the installation of a:

  • SEP 11 client
  • SEP 11 SEPM
  • SEP 12.1 SEPM

SEP 12.1 clients will not encounter this error, as they use a different tool called LUE for updating their definitions


There are a multiple causes (and solutions) for this "CreateProcessAndWait( LUCHECK.EXE ) returned 206" issue. Please work through the following possible solutions.  When installing, be sure to use the correct version of the LiveUpdate client for your release of SEP client or SEPM. The articles referenced at the botom of this page can provide an up-to-date LiveUpdate client, if needed.

  1. Remove old LiveUpdate folders:
    • Navigate to C:\ProgramData\Symantec and delete LiveUpdate (if present).
    • Navigate to C:\Documents and Settings\All Users\Application Data\Symantec and delete LiveUpdate (if present).
    • Start the installation of the SEP client or SEPM.
  2. Fix the %AppData% variable for the SYSTEM account.
    • Open 'regedit' from a run prompt.
    • Navigate to HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders.
    • Make sure that the AppData string is set to:
      %USERPROFILE%\Application Data for Windows XP/ Windows Server 2003  or
      %USERPROFILE%\AppData\Roaming for Windows Vista/ Windows 7/ Windows Server 2008.

      Note: Any other values here that do not have %USERPROFILE% may be incorrect as well and could cause issues.
    • Start the installation of the SEP client or SEPM.
  3. Correct incorrect permissions for LuComServer:
    • Start - Run - Dcomcnfg: Component Services, Computers, My Computer, DCOM Config, LuComServer,
    • Select Properties, Identity tab
    • Select the "This user" option
    • Choose a Local Administrator account. Use the Browse button if necessary; the account name must be prefixed by machine name to be recognized.

    • (Note: If you have not installed LiveUpdate before the installation of Symantec Endpoint Protection, LuComServer will not exist in DCom Config.)

Legacy ID


Article URL

Terms of use for this information are found in Legal Notices