Endpoint Protection Small Business Edition

 View Only
Expand all | Collapse all

Install SEP 12.1.4112 rollback issue.

Migration User

Migration UserNov 05, 2014 05:47 AM

ℬrίαη

ℬrίαηNov 05, 2014 08:11 PM

  • 1.  Install SEP 12.1.4112 rollback issue.

    Posted Nov 03, 2014 04:35 AM
      |   view attached

    Hello Team.

    I had some problem about upgrade old SEP12.1.3001.165 to SEP 12.1.4112.

    My client is Microsoft Windows Server 2003 R2 Standard Edition 64-bit.

    My last actions

    - Used CleanWipe to uninstall SEP12.1.3001.165 from the client with Administrator User and reboot : success.

    - Install Cert VeriSign_Class_3_Code_Signing_2010_CA and VeriSign Class 3 Public Primary Certification Authority - G5

    - Install package SEP 12.1.4112 and found rollback and fail event on Application logs.

    - After error issue I found some folder and Symantec service was create and running but not showin task bar.

    -------------

    - I try to uninstall but denine.

    - I download new CleanWipe version and used to uninstall SEP 12.1.4112 from my meachine : success.

    - I try to install SEP 12.1.4112. again and again but every time the installer was roll back.

     

    Please help me to resolve this issue.

    Thank you.

     - SEP Logs is in attachment.

    ----------------------Windows logs----------------------

    Event Type:    Error
    Event Source:    MsiInstaller
    Event Category:    None
    Event ID:    11708
    Date:        11/3/2014
    Time:        1:41:11 PM
    User:        N/A
    Computer:    SIBMOCISDB01
    Description:
    Installation failed

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 7b 38 32 37 45 33 45 41   {827E3EA
    0008: 36 2d 38 35 44 31 2d 34   6-85D1-4
    0010: 34 31 33 2d 39 36 44 38   413-96D8
    0018: 2d 32 34 42 30 46 39 42   -24B0F9B
    0020: 34 39 39 36 37 7d         49967}  
    -----------------------------------------------------
    Event Type:    Information
    Event Source:    Symantec Endpoint Protection
    Event Category:    None
    Event ID:    36
    Date:        11/3/2014
    Time:        1:41:44 PM
    User:        NT AUTHORITY\SYSTEM
    Computer:    SIBMOCISDB01
    Description:
    The description for Event ID ( 36 ) in Source ( Symantec Endpoint Protection ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: SepMasterService.
    -----------------------------------------------------
    Event Type:    Information
    Event Source:    Symantec Endpoint Protection
    Event Category:    None
    Event ID:    37
    Date:        11/3/2014
    Time:        1:41:44 PM
    User:        NT AUTHORITY\SYSTEM
    Computer:    SIBMOCISDB01
    Description:
    The description for Event ID ( 37 ) in Source ( Symantec Endpoint Protection ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: SepMasterService.
    -----------------------------------------------------
    Event Type:    Information
    Event Source:    MsiInstaller
    Event Category:    None
    Event ID:    11708
    Date:        11/3/2014
    Time:        1:42:14 PM
    User:        MINORGROUP\kamonwan_bu-a
    Computer:    SIBMOCISDB01
    Description:
    Product: Symantec Endpoint Protection -- Installation operation failed.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 7b 38 32 37 45 33 45 41   {827E3EA
    0008: 36 2d 38 35 44 31 2d 34   6-85D1-4
    0010: 34 31 33 2d 39 36 44 38   413-96D8
    0018: 2d 32 34 42 30 46 39 42   -24B0F9B
    0020: 34 39 39 36 37 7d         49967}  

    -----------------------------------------------------

    Attachment(s)

    zip
    SEP_INST.zip   182 KB 1 version


  • 2.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 03, 2014 01:59 PM

    Please see these:

    Certificate error occurs when attempting to install or upgrade Symantec Endpoint Protection

    http://www.symantec.com/docs/TECH218029

    Symantec Endpoint Protection 12.1 RU4 installation or migration on Windows fails due to outdated root certificate

    http://www.symantec.com/docs/TECH217284



  • 3.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 04, 2014 12:16 AM

    Dear Brian and all.

    - I had been  installed two of certs before.

    VeriSign_Class_3_Code_Signing_2010_CA and VeriSign Class 3 Public Primary Certification Authority - G5

    But for prove your solution , I try to remove the certs , restart and download new certs from http://www.symantec.com/docs/TECH217284

    Then I imported certs and try to install SEP12 again.

    But found the same error.

     

     

    ----------------------Windows logs----------------------

    Event Type:    Error
    Event Source:    MsiInstaller
    Event Category:    None
    Event ID:    11708
    Date:        11/3/2014
    Time:        1:41:11 PM
    User:        N/A
    Computer:    SIBMOCISDB01
    Description:
    Installation failed

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 7b 38 32 37 45 33 45 41   {827E3EA
    0008: 36 2d 38 35 44 31 2d 34   6-85D1-4
    0010: 34 31 33 2d 39 36 44 38   413-96D8
    0018: 2d 32 34 42 30 46 39 42   -24B0F9B
    0020: 34 39 39 36 37 7d         49967}  
    -----------------------------------------------------
    Event Type:    Information
    Event Source:    Symantec Endpoint Protection
    Event Category:    None
    Event ID:    36
    Date:        11/3/2014
    Time:        1:41:44 PM
    User:        NT AUTHORITY\SYSTEM
    Computer:    SIBMOCISDB01
    Description:
    The description for Event ID ( 36 ) in Source ( Symantec Endpoint Protection ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: SepMasterService.
    -----------------------------------------------------
    Event Type:    Information
    Event Source:    Symantec Endpoint Protection
    Event Category:    None
    Event ID:    37
    Date:        11/3/2014
    Time:        1:41:44 PM
    User:        NT AUTHORITY\SYSTEM
    Computer:    SIBMOCISDB01
    Description:
    The description for Event ID ( 37 ) in Source ( Symantec Endpoint Protection ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: SepMasterService.
    -----------------------------------------------------
    Event Type:    Information
    Event Source:    MsiInstaller
    Event Category:    None
    Event ID:    11708
    Date:        11/3/2014
    Time:        1:42:14 PM
    User:        MINORGROUP\kamonwan_bu-a
    Computer:    SIBMOCISDB01
    Description:
    Product: Symantec Endpoint Protection -- Installation operation failed.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 7b 38 32 37 45 33 45 41   {827E3EA
    0008: 36 2d 38 35 44 31 2d 34   6-85D1-4
    0010: 34 31 33 2d 39 36 44 38   413-96D8
    0018: 2d 32 34 42 30 46 39 42   -24B0F9B
    0020: 34 39 39 36 37 7d         49967}  

    -----------------------------------------------------



  • 4.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 04, 2014 12:19 PM

    Can you post the SIS_Inst.log as well? and also the new SEP_inst.log?

    Do you have any app installed which blocks registry access?

    http://www.symantec.com/business/support/index?page=content&id=TECH164067

    does it work if you installl any  previous version of SEP, like 12.1.2 or .3?



  • 5.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 04, 2014 12:22 PM

    See this:

    What logs do I need to gather in order to troubleshoot a failed SEP 12.1 client installation?

    http://www.symantec.com/docs/TECH164067



  • 6.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 05, 2014 03:01 AM

    Hello All.

    I got so,e logs from my computer , please help to investigate.

    1. Log from install last version SEP12.1.3 (Success)

    2. Log from uninstall last version SEP12.1.3 (Success)

    3. Log form install version SEP12.1.4 (Roll back)

     

    - Install Cert VeriSign_Class_3_Code_Signing_2010_CA and VeriSign Class 3 Public Primary Certification Authority - G5

    - Install package SEP 12.1.4112 and found rollback and fail event on Application logs.



  • 7.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 05, 2014 03:14 AM
    Have you try install latest SEP client 12.1.5 ? Download latest sep client version from fileconnect using same license key and try to install.


  • 8.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 05, 2014 03:21 AM

    Dear James007.

            I did't try to install new version because my customer don't approve to do that.

            I will try to install in temp server and report again.

            Thank you.



  • 9.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 05, 2014 03:31 AM

    Logs detail. You are require to follow the article for success

    Symantec Endpoint Protection Client installation failed: error ""Pending system changes that require a reboot have been detected" "

    Article:TECH208775  |  Created: 2013-07-19  |  Updated: 2013-08-02  |  Article URL http://www.symantec.com/docs/TECH208775 

    Communicate LC: NOT Version9X=1
    Communicate LC: VersionNT > 500=1
    Communicate LC: NOT WINDOWSFUNDAMENTALS=1
    Communicate LC: (NOT MIGRATIONPENDINGREBOOT) OR SISFAILED=1
    Communicate LC: (NOT UNINSTALLREBOOTREQUIRED) OR Installed=1

    other article

    Installation fails with the message "Pending system changes that require a reboot have been detected"

    Article:TECH103109  |  Created: 2007-01-16  |  Updated: 2013-01-11  |  Article URL http://www.symantec.com/docs/TECH103109 


  • 10.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 05, 2014 03:57 AM

    I'm try to install SEP 12.1.5 still same rollback issue.



  • 11.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 05, 2014 04:38 AM

    Have you tried my attach article steps?

    Symantec Endpoint Protection Client installation failed: error ""Pending system changes that require a reboot have been detected" "

    Article:TECH208775  |  Created: 2013-07-19  |  Updated: 2013-08-02  |  Article URL http://www.symantec.com/docs/TECH208775

    Delete the following registry key, depending on the used operating system:

    32 bit
    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec_Installer

    64 bit
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec_Installer



  • 12.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 05, 2014 05:06 AM

    Dear consoleadmin.

             I try to search in HKEY_LOCAL_MACHINE\SOFTWARE\

              But don't see the registry.

              HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec_Installer

     



  • 13.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 05, 2014 05:47 AM
    Try to run cleanwipe tool than install sep client.


  • 14.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 05, 2014 07:29 PM

    I used cleanwipe last version to revmoved (SEP fail to install) and reboot.

    Try to install SEP 12.1.14 again , got same error.



  • 15.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 05, 2014 08:11 PM

    Please contact support



  • 16.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 06, 2014 02:42 AM

    Hello all

    I opened case to support team last two days , they investigating.

    Do you have some solutions for testing?



  • 17.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 06, 2014 08:11 AM

    My final suggestion is to try installing an unmanaged client with the AV component ONLY.

    If this works, you can make it managed and add any other components you need.



  • 18.  RE: Install SEP 12.1.4112 rollback issue.

    Posted Nov 21, 2014 04:41 AM

    Hello

            I resolved this issue by the simple.
            I re-install SEP12.1.3 old version then Deploy the SEP12.1.4 package on the official site.
            The system was replaced the old version not error then replace Sylink.xml again.