Video Screencast Help

Pending File Rename Operations

Created: 14 Dec 2009 | 10 comments
Language Translations
P_K_'s picture
+17 17 Votes
Login to vote
 
Most of the time when we are in a process of installing Symantec Products , we get an error “Symantec Endpoint Protection has detected that there are pending system changes that require a reboot. Please reboot the system and rerun the installation.”
 
What we do is open the registry and navigate to
 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager and locate
PendingFileRenameOperations and rename it to  PendingFileRenameOperations2 and then try to install the product.
 
 
But why do we get the error?
 
 
 
The fact that executable images and DLLs are memory-mapped when they are used makes it impossible to update core system files after Windows has finished booting. The MoveFileEx Windows API has an option to specify that a file move be delayed until the next boot. Service Packs and hotfixes that must update in-use memory mapped files install replacement files onto a system in temporary locations and use the MoveFileEx API to have them replace otherwise in-use files. When used with that option,
MoveFileEx simply records commands in the PendingFileRenameOperations and PendingFileRenameOperations2 values under HKLM\SYSTEM\CurrentControlSet\
Control\Session Manager. These registry values are of type MULTI_SZ, where each operation is specified in pairs of file names: the first file name is the source location, and the second is the target location. Delete operations use an empty string as their target path.
 
 
 
The PendingFileRenameOperations key stores the names of files to be renamed when the system restarts. It consists of pairs of file names. The file specified in the first item of the pair is renamed to match the second item of the pair. The system adds this entry to the registry when a user or program tries to rename a file that is in use. The file names are stored in the value of this entry until the system is restarted and they are renamed. This entry is not created by the Operating System.
 
In order to prevent such things from happening in the, it is mandatory to reboot the server after installing any application/driver when it requests for a reboot immediately.

Comments 10 CommentsJump to latest comment

Fatih Teke's picture

Thank you Prachand I say delete pending rename options everytime but i have no idea why it happend before. But i know now.
thank you.

Regards.
Fatih

 Everything works better when everything works together.

+2
Login to vote
tekkid's picture

It's interesting that you bring this up.   Recently, we noticed that the update of Proactive Threat definitions have triggered this registry key thus preventing our Patch Management System from deploying security updates to managed computers.   FYI. 

+1
Login to vote
sezam's picture

 You forget to mention about  PendingFileRenameOperations  values which are situated in:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet00[x]\Control\SessionManager
where x is number from 1 to 9.

and this values  should be deleted not renamed.
Please read our internal KBs more deeper.
They will cause a problem. 


+2
Login to vote
BeachwoodBruin's picture

How about a link the actual article?  I too have been struggling with this... Reg hacks, reinstalls, local admins, domain admins, eliminating UAC, you name it....

 

Does anyone have a link that WORKS? Testing this Win7 rollout has been smooth up until S.A.V.... Help?

 

BWB

+2
Login to vote
JustinAndersen's picture

Linking to another thread about Reboot pending that I had some opinions about..

www-secure.symantec.com/connect/forums/what-does-restart-required-mean-sep11-client-does-it-affect-performance

Looking further into the launch conditions within the msi I see the MsiSystemRebootPending Property being used. If you read the requirements it states:
" Windows Installer 5.0 on Windows Server 2008 R2 or Windows 7. Windows Installer 4.0 or Windows Installer 4.5 on Windows Server 2008 or Windows Vista. Windows Installer 4.5 on Windows Server 2003 or Windows XP"

Not Supported in Windows Installer 3.1 and earlier versions I find this interesting considering SEP11 is checking for WI 3.1

Tools such as PendMove are using this same API process which may lead to more failed installations during the deployment phase. Not everyone has the opportunity to utilize server services and the Symantec Deployment tool. I'd like to see more effort into whether a pending reboot is really needed prior to the installation.

+2
Login to vote
Symanticus's picture

Hi All,

I need to delete the content of: HKEY_LOCAL_MACHINE\SYSTEM\ControlSetXXX\Control\SessionManager\PendingFileRenameOperations to enable 64 bit client AV install, I've done manually on several workstation but how to automate this process in more than 10 clients ? sounds ridiculous if i have to send email for every affected users or even call them one by one to use regedit ?

/* Infrastructure Support Engineer */

+3
Login to vote
SymSEP's picture

Changed the value did not help

+4
Login to vote
P_K_'s picture

Try http://support.microsoft.com/kb/555175

MCT MCSE-2012 Symantec Technical Specialist (SCTS)

+6
Login to vote
gjb145's picture

Try this article.  There is another key at the bottom with windowsupdate that you could try too.  My SEP install script looks at these and fixes them if you would like it.

http://service1.symantec.com/support/ent-security....

+3
Login to vote
John Santana's picture

Cool, this article is a life saver and time saver as well :-)

Thank you for sharing !

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

0
Login to vote