Endpoint Protection

Hi,

We're in the process of getting workstations upgraded to base version RU6a, butr apparently some, not all, have some kind of failure. We're pushing the packages through SCCM and looks like failed machines become unresponsive, they can't boot up normally and only option in to start them in SAFE MODE and from there perform a removal. I am attaching the install log, I didn't see any Return Value 3, but there seem to be other errors in there, so I'd appreciate any help. 

Attachment(s)

SEP_11.0.6005.562_01.txt   4.52 MB 1 version

Hello,

Upon checking the Logs, we found....

Property(S): ProductToBeRegistered = 1
Property(S): MsiFilterRebootMode_RebootAtEndModeBefore = 1
=== Logging stopped: 5/23/2011  19:10:37 ===
MSI (c) (3C:24) [19:10:37:242]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (3C:24) [19:10:37:242]: MainEngineThread is returning 3010
=== Verbose logging stopped: 5/23/2011  19:10:37 ===

Hello,

Checking the Logs more in detail

We Found Failed Errors -

MSIRESULT !!FAILED!! - CheckExistingCCInstalledApps: Unable to open key. Return:2: 

LUCA: CheckForRunningLU: Failed to open LU mutex, can not check for running LU.

AgentMainCA: ERROR: MsiEnumRelatedProducts failed with error 259

Try checking Permissions for the InstalledApps registry key (HKLM\Software\Symantec\InstalledApps) may be incorrect.

The permissions may also be wrong on HKLM\Software\Symantec\Common Client\  
 

It could also be resolved by uninstalling the client, deleting the faulty registry keys, and reinstalling.  
 

If there are other Symantec products on the system, you could just adjust the permissions on the keys as well. 

These keys should have System, Creator Owner, Administrators, and Users (read)

Also TRY: 

One possible solution is to use a silent install package and pass it force options. (the force options do not work with interactive, or unattended installs - ONLY with silent)

msiexec.exe /i symantec antivirus.msi /q /forcerestart

OR

Using the SEPM, create a client install package:

Add Client Install Settings:
Set to Silent install
Restart after installation
Upgrade settings - Remove all previous logs 

Add Client Install Feature set:

AV/AS
NTP
PTP

Export Package:

Set export path
Include Client Install Settings / Client Install Feature set
Select client group
Click ok to export package

Copy export package to client machine - 

Open Task manager to search for msi's due to silent install
Wait for the icon to appear in the system try and view the SEP_Inst log.
The installation is successful but the client may never go for reboots.

Hello again, I have not yet fixed this issue, we're still seeing test machines freezing while upgrading from MR4, which keeps us behind with mass deployment.

Basically, machines hang, users don't get the windows logon screen, ctrl+alt+del does not bring the credentials prompt. Only option is safe mode, where cleanwipe is used to remove SEP. After that, the next restart allows normal logon to Windows.

It's not only RU6a, I tried RU6 and RU6MP2 as well. Tried installing without NTP, it installed, but soon computer froze and had to go all the way again with the removal process in Safe Mode.

I am not sure if it's a permission issue as legacy client, MR4, which was originally deployed on our Vista machines, still installs and works just fine, with all components up and running.

Have you disabled UAC for the deployment on a machine or via GPO?

Actually UAC is enabled across the environment. Out of our 20 pilot machines, 5 caused issues as explained before. The successful 15 ones have UAC on, so .... Anyway, to be on safe side I did turn UAC off on one the failed machines, but unfortunately the results were no better. So, apparently UAC is not the issue. By the way, running Sep Support Tool finds no problems prior clean install or upgrades. But we can't get to run SST on a failed install because SST does not start in Safe Mode.