I tried SEP version 11.5 and had the same results.

I isolated all of the Layers from each other and the install completed. Does any one know why that would allow endpoint to install?

1. Check if Event Log is Started and set as automatic  in services.msc. If this service is stopped, then,
2. Download eventlog.dll file and copy it in C:\WINDOWS\system32
3. Start the Event Log services and install SEP11

I checked on the event log service and it is working. No need to copy the .dll file. This is a fresh install of Windows XP it definately has something to do with SWV and the layers not bieng compatible with Symantec Endpoint. On the last PC I tried it installs fine with the layers disabled but when the machine restarts with the layers enabled it tries to reinstall Endpoint and ends in a rollback. At that point nothing will stop it from this behavior it just keeps reinstalling and rolling back.

I just tried to isolate the layers from each other but it didn't help this time. If I disable all layers and install symantec then reboot with the layers disabled it doesn't try to rollback. I then had the layers be actived on startup now endpoint says it has multiple problem. If I deactivate the layers it fixes the problems. After that I enabled all of my layers again without a reboot and endpoint remains error free. It seems like the initial activation of the layers on boot up is causing the faluire. Any thoughts?

I have pinpointed it down too 2 layers Google Earth 5 and Quicktime 7.6.4. If they aren't active on startup symantec has no errors.  Has any one run into problems when virtualizing these programs? I see no simularites other than installer cache folders.