Symantec Endpoint Protection 11 Client installation rolls back on Windows 7 or Windows 2008 R2 at the registration of LiveUpdate

Article:TECH97223  |  Created: 2009-01-04  |  Updated: 2013-05-30  |  Article URL
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution


Attempts to install a Symantec Endpoint Protection 11.0 client on a clean Windows 7 or Windows 2008 R2 computer fail. The installation rolls back at the registration with LiveUpdate.



Installation rolls back with Event ID 11708 and 1033 in Application Event log.

In the MSI log you can see the following information:

MSI (s) (70:E8) [10:03:30:718]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI9DA.tmp, Entrypoint: _LURegisterDecomposerABI@4
-- DECABI_LOGGING -- Enter LURegisterDecomposerABI()
-- DECABI_LOGGING -- GetDecomposerABIProperties Registry created.
-- DECABI_LOGGING -- GetDecABIDirectory() -- failed to get Installed Apps key from registry.
-- DECABI_LOGGING -- Decomposer ABI DLL version is: not installed
-- DECABI_LOGGING -- Could not get Decomposer ABI version from LiveUpdate. (HRESULT=-2147221164)
-- DECABI_LOGGING -- Decomposer ABI version registered with LiveUpdate is: not installed
-- DECABI_LOGGING -- Decomposer ABI sequence number registered with LiveUpdate is: not installed
-- DECABI_LOGGING -- For rollback using Decomposer ABI custom action property: sizeof= 130 not installed:not installed
-- DECABI_LOGGING -- LiveUpdate registration failed. (HRESULT=-2147221164)
CustomAction LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (70:6C) [10:03:30:921]: User policy value 'DisableRollback' is 0
MSI (s) (70:6C) [10:03:30:921]: Machine policy value 'DisableRollback' is 0
Action ended 10:03:30: InstallFinalize. Return value 3.


Windows 7

Windows 2008 R2

Endpoint Protection 11.0 RU5 or earlier


This install error occurs because the LiveUpdate installer package did not update correctly when the client package was downloaded via LiveUpdate.

Windows 7 and Windows 2008 R2 require a newer version of LiveUpdate than was included prior to Symantec Endpoint Protection RU5.


To take advantage of the latest enhancements and improvements, install the latest available release of SEP on the Windows 7 or Windows 2008 R2 computer.  Newer releases (SEP 11 RU6a onwards) and/or clean install of RU5 should not show this problem, according to Release Notes:

'While installing a Symantec Endpoint Protection client locally, the install fails and rolls back with an error
Fix ID: 1545935
Symptom: Installation of Symantec Endpoint Protection fails and the SEP_INST.log contains a reference to "LiveUpdate registration failed"
Solution: Changes to the LiveUpdate installer to work around a COM failure caused by InstallShield in Microsoft Windows classes.'


Should it not be possible to use a later release, this process serves as one workaround for issue:

  1. Open and log into Symantec Endpoint Protection Manager (SEPM) console
  2. Select Admin
  3. Select the 11.0.5002.0 package you wish to deploy (either WIN32BIT or WIN64BIT)
  4. Click on Export Client Install Package
  5. Enter the folder location for the client package
  6. Uncheck the box for create a single .EXE file for this package.
  7. Select Settings and Features desired and Policy settings and Mode and click on OK
  8. After the package has finished exporting open the Symantec_Endpoint_Protection_11.0.5002.333_RU5 CD 1\SEP directory and copy the LuCheck.exe and LUSETUP.EXE in to the folder where expanded package was exported overwriting the existing LuCheck.exe and LUSETUP.EXE.
  9. The package can then be deployed via the Migration and Deployment Wizard

This will need to be done for both the 32-bit and 64-bit clients.


Another workaround is to uninstall Liveupdate and delete all the related folders. Then first run the LUSETUP.exe and then run the Setup of SEP as Administrator. 

Technical Information
Client install packages for RU5 that were downloaded from LiveUpdate in certain cases do not have updated LiveUpdate install files. These package will generally show in the SEPM client package list as being version 11.0.5002.0. If the package was imported from the CD or installed as part of the SEPM RU5 install process the package will display as version 11.0.5002.333.


Supplemental Materials

Value1948992, 2006121

Legacy ID


Article URL

Terms of use for this information are found in Legal Notices