Windows 7 / 2008 R2 - SEP Client installation rolls back.

Article:TECH97223

Created: 2009-01-04

Updated: 2010-01-12

Article URL http://www.symantec.com/docs/TECH97223

Article Type
Technical Solution

Product(s)

Show all

Languages

Show all

Problem

Customer is trying to install a Symantec Endpoint Protection 11.0 client on a clean Windows 7 or Windows 2008 R2 and the installation rolls back at the registration with LiveUpdate.

Symptoms
Installation rolls back with Event ID 11708 and 1033 in Application Event log.

In the MSI log you can see the following information:

MSI (s) (70:E8) [10:03:30:718]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI9DA.tmp, Entrypoint: _LURegisterDecomposerABI@4
-- DECABI_LOGGING -- Enter LURegisterDecomposerABI()
-- DECABI_LOGGING -- GetDecomposerABIProperties Registry created.
-- DECABI_LOGGING -- GetDecABIDirectory() -- failed to get Installed Apps key from registry.
-- DECABI_LOGGING -- Decomposer ABI DLL version is: not installed
-- DECABI_LOGGING -- Could not get Decomposer ABI version from LiveUpdate. (HRESULT=-2147221164)
-- DECABI_LOGGING -- Decomposer ABI version registered with LiveUpdate is: not installed
-- DECABI_LOGGING -- Decomposer ABI sequence number registered with LiveUpdate is: not installed
-- DECABI_LOGGING -- For rollback using Decomposer ABI custom action property: sizeof= 130 not installed:not installed
-- DECABI_LOGGING -- LiveUpdate registration failed. (HRESULT=-2147221164)
CustomAction LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (70:6C) [10:03:30:921]: User policy value 'DisableRollback' is 0
MSI (s) (70:6C) [10:03:30:921]: Machine policy value 'DisableRollback' is 0
Action ended 10:03:30: InstallFinalize. Return value 3.

Cause

Symantec is currently investigating this issue and will update this document when a solution becomes available. This install error occurs because the LiveUpdate installer package did not update correctly when the client package was downloaded via LiveUpdate. Windows 7 and Windows 2008 R2 require a newer version of LiveUpdate than was included prior to Symantec Endpoint Protection RU5.

Solution

Workaround for issue:

Open and log into Symantec Endpoint Protection Manager
Select Admin
Select the 11.0.5002.0 package you wish to deploy (either WIN32BIT or WIN64BIT)
Click on Export Client Install Package
Enter the folder location for the client package
Uncheck the box for create a single .EXE file for this package.
Select Settings and Features desired and Policy settings and Mode and click on OK
After the package has finished exporting open the Symantec_Endpoint_Protection_11.0.5002.333_RU5 CD 1\SEP directory and copy the LuCheck.exe and LUSETUP.EXE in to the folder where expanded package was exported overwriting the existing LuCheck.exe and LUSETUP.EXE.
The package can then be deployed via the Migration and Deployment Wizard

This will need to be done for both the 32bit and 64bit clients.

Technical Information
Client install packages for RU5 that were downloaded from LiveUpdate in certain cases do not have updated LiveUpdate install files. These package will generally show in the SEPM client package list as being version 11.0.5002.0. If the package was imported from the CD or installed as part of the SEPM RU5 install process the package will display as version 11.0.5002.333.

Supplemental Materials

Source	ETrack
Value	1948992, 2006121

Legacy ID

2009110411364348