I tried running an SEP single executable package ver 11.0.6100 on a machine that already have 11.0.6300.

Now, it is attempting to install everytime I start it up.

I found these in SEP_INST.LOG:

MSI (s) (9C:20) [15:40:12:579]: Doing action: DowngradeError
Action ended 15:40:12: IsSourceDirAtRoot. Return value 1.
Action start 15:40:12: DowngradeError.
MSI (s) (9C:20) [15:40:12:579]: Product: Symantec Endpoint Protection -- A newer version of this software is already installed on this machine.

A newer version of this software is already installed on this machine.
Action ended 15:40:12: DowngradeError. Return value 3.
Action ended 15:40:12: INSTALL. Return value 3.

Followed by this in the end:

Property(S): MsiLogFileLocation = C:\DOCUME~1\GLOCAL~1\LOCALS~1\Temp\SEP_INST.LOG
MSI (s) (9C:20) [15:40:12:736]: Note: 1: 1708
MSI (s) (9C:20) [15:40:12:736]: Product: Symantec Endpoint Protection -- Installation operation failed.

MSI (s) (9C:20) [15:40:12:736]: Windows Installer installed the product. Product Name: Symantec Endpoint Protection. Product Version: 11.0.6100.645. Product Language: 1033. Installation success or error status: 1603.

MSI (s) (9C:20) [15:40:14:282]: Cleaning up uninstalled install packages, if any exist
MSI (s) (9C:20) [15:40:14:282]: MainEngineThread is returning 1603
MSI (s) (9C:54) [15:40:14:282]: No System Restore sequence number for this installation.
=== Logging stopped: 1/3/2012  15:40:12 ===
MSI (s) (9C:54) [15:40:14:282]: User policy value 'DisableRollback' is 0
MSI (s) (9C:54) [15:40:14:282]: Machine policy value 'DisableRollback' is 0
MSI (s) (9C:54) [15:40:14:282]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (9C:54) [15:40:14:282]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (9C:54) [15:40:14:282]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (9C:54) [15:40:14:282]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2
MSI (s) (9C:54) [15:40:14:282]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2
MSI (s) (9C:54) [15:40:14:282]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (s) (9C:54) [15:40:14:282]: Restoring environment variables
MSI (c) (44:94) [15:40:14:329]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (44:94) [15:40:14:329]: MainEngineThread is returning 1603
=== Verbose logging stopped: 1/3/2012  15:40:14 ===

I have attached the full logs.

Thanks in advance.

Attachment(s)

SEP_INST.LOG_.txt   250 KB 1 version

I had a similar issue, i tried uninstalling the SEP Client using the Cleanwipe utility and reinstalled the package using the.MSI

Thanks Ajit,

I was hoping it wouldnt come to that.

hi,

check if ADC policy  related to client registry access/service is set on this client. If yes, copy default ADC on to this client.

Hi,

Try to use MSI cleanup utility to remove SEP (msi) installation instance.

I haven't done anything yet, but the installer did not run today. I have a feeling that this will return either the next day or the one that follows.

Is there anywhere in the registry I can find this?

Assign "modify" permissions for the user in C:\Document & Settings\All Users\Application Data.

The accounts I use is for Power Users or Administrator.

C:\>cacls "Documents and Settings\All Users\Application Data"

C:\Documents and Settings\All Users\Application Data NT AUTHORITY\SYSTEM:(OI)(CI)F
                                                     BUILTIN\Administrators:(OI)(CI)F
                                                     CREATOR OWNER:(OI)(CI)(IO)F
                                                     BUILTIN\Power Users:(OI)(CI)C
                                                     BUILTIN\Users:(OI)(CI)R
                                                     BUILTIN\Users:(CI)(specialaccess:)
                                                                       FILE_WRITE_DATA
                                                                       FILE_APPEND_DATA
                                                                       FILE_WRITE_EA
                                                                       FILE_WRITE_ATTRIBUTES

Set the Windows Installer service startup type to disabled:

• 1. Click Start > Run
  2. Type: services.msc
  3. Click OK
  4. Right-click Windows Installer and click Properties
  5. In the Startup type drop-down box choose Disabled
  6. Click OK

1. Log out and back in to the current profile or restart the machine
   • The install loop should stop now
2. Use Add or Remove Programs to remove Symantec Endpoint Protection from the machine
3. Delete any folders left behind
   • For reference see: Manual uninstallation documents for Symantec Endpoint Protection
4. Restart the machine
5. Install Symantec Endpoint Protection
6. Re-enable the Windows Installer service

Try to Use the Microsoft Fix for the Windows Installer:

How to fix MSI software update registration corruption issues

http://support.microsoft.com/kb/971187

References
Manual uninstallation documents for Symantec Endpoint Protection
http://service1.symantec.com/support/ent-security.nsf/docid/2009102111584948

That executable is a bit hard to find...it brought me to these pages.

http://msdn.microsoft.com/en-us/library/aa370523.aspx

http://support.microsoft.com/mats/Program_Install_and_Uninstall

This is CleanWipe v12.0.120.4 sitting on a PC running SEP12.1

I'm looking into this process:

http://www.symantec.com/business/support/index?page=content&id=TECH104368

You could give it a shot with it.

The "SEP Installing" pop-up only shows up whenever I open the GUI the first time after PC startup.

So, I just uninstalled the current SEP and installed again. It worked. Although, still not sure as to the cause of this problem.

The SEP install or the Windows installer may have got corrupt due to some reason causing this issue.