Endpoint Protection

Hello, I'm unable to either install locally or deploy remotely Endpoint portection 12.1.6 MP4 on WIndows 10 (fully updated).

Fisrt failures in installation log say:

MSI (s) (00!68) [10:28:00:933]: PROPERTY CHANGE: Modifying ValidInstallDir property. Its current value is '0'. Its new value: '1'.
CEmbDependencyChecker::CheckServiceWithOpenedSCM OpenService failed for ewf. Error: 1060
clientca:   : Exit.

...

​MSI (s) (00!28) [10:28:04:183]: Note: 1: 2259 2:  3:  4: 
ScriptGen:   to: 800002
ScriptGen: MsiViewExecute failed with result 65b GetLastError() 0
MSI (s) (00!28) [10:28:04:183]: Note: 1: 2259 2:  3:  4: 
ScriptGen: ScriptBuilder::CSymRegAction::UnInstall: Unable to add registry key for delete: SOFTWARE\Microsoft\Exchange\Client\Extensions to the registry table for delete. Component:
ScriptGen: MsiViewExecute failed with result 65b GetLastError() 0
ScriptGen: ScriptBuilder::CSymRegAction::UnInstall: Unable to add registry key for delete: SOFTWARE\Microsoft\Exchange\Client\Extensions to the registry table for delete. Component:
ScriptGen: Not adding registry key for delete: .DEFAULT\Software\Microsoft\Office\Outlook\Addins\SEPOutlookAddin.OutlookAddin\-(2)
ScriptGen: Not adding registry key for delete: S-1-5-19\Software\Microsoft\Office\Outlook\Addins\SEPOutlookAddin.OutlookAddin\-(2)
MSI (s) (00!28) [10:28:04:183]: Note: 1: 2259 2:  3:  4: 
ScriptGen: Not adding registry key for delete: S-1-5-20\Software\Microsoft\Office\Outlook\Addins\SEPOutlookAddin.OutlookAddin\-(2)
ScriptGen: MsiViewExecute failed with result 65b GetLastError() 0
ScriptGen: ScriptBuilder::CSymRegAction::uninstallUserKeys: Unable to add registry key for delete: S-1-5-21-789336058-884357618-725345543-500\Software\Microsoft\Office\Outlook\Addins\SEPOutlookAddin.OutlookAddin to the registry table for delete. Component:
ScriptGen: Not adding registry key for delete: S-1-5-21-789336058-884357618-725345543-500_Classes\Software\Microsoft\Office\Outlook\Addins\SEPOutlookAddin.OutlookAddin\-(2)
ScriptGen: Not adding registry key for delete: S-1-5-18\Software\Microsoft\Office\Outlook\Addins\SEPOutlookAddin.OutlookAddin\-(2)
ScriptGen: Action end WriteRegistryValues 10:28:4.183

...

MSI (s) (00:8C) [10:28:08:980]: Doing action: installFailure
Fine operazione 10:28:08: SetARPINSTALLLOCATION. Valore restituito 1.
Inizio operazione 10:28:08: installFailure.

....

MSI (s) (00:8C) [10:28:10:418]: Executing op: ActionStart(Name=setiCollect_RemoveFile,Description=Raccolta informazioni dettagliate...,Template=[1])
clientca: Fail to Recover the disable key for Windows Defender!

....

Around 10:30 (apparently after installation failure) I find in the Windows system registry an error 7000 - start failure for service IDSVia64 (impossible to find the specified procedure)

We are in the process of renewing the subscription ans I can't currently fill a suppoort case, any hints to solve the issue? Note that the issue is reporducible on several machines.

In a couple of machines the Endpoint protection client was already installed when the OS was updated from Windows 8.1 to Windows 10. In that cases the client started, but with a couple of errors. I tried to uninstall and reinstall teh client, but reinstallation failed.

Best regards,

Federico

Is it happening on all the win 10 or on just few?

Can you post the complete files of SEP_Inst.log and SIS_inst.log?

All the windows 10 machines (that are all updated, italian version 64 bit).

I don't have the original SIS_inst, I'm attaching the SEP_Inst.log from which I took the text I previously uploaded as SEP_Inst_old.log, as well as  SEP_Inst and SIS_inst from another failed installation (on the same machine, I "cleanwiped" before retrying)

Just to elaborate, I just found that a local installation in unmanaged mode (with the same features) did work, while I confirm that installation in managed mode (either remote or local from an exported package) fails systematiccally. I then converted the unmanaged client in a managed one, and it apparently works flawlessly.

In other words, it looks like that  managed client deployment procedure try to install the "intrusion prevention" feature even if not selected. The installation of unwanted features in case of managed client deployment looks like a further (independent) bug, that I catched just because apparently one of these unselcted features crashes the targed PCs.

Best, federico

Have you tried installing SEP with onl core components?

I didn't, the installation that works if unmanaged but does not work if managed is the following:

-Basic virus protection YES

--advanced download protection YES

--Microsoft Outlook protection YES

--Lotus notes protection NO

--POP3/SMTP protection NO

-Proactive protection YES

--SONAR YES

--Application and devices audit NO

-Network protection (and all subitems) NO

The install unmanaged and make it managed by replacing the sylink file.

Why do I need to replace the client-server communications file on the client computer?

Yes, as I said in my 2nd message it works, and it was what actually I did for my 12 Windows 10 clients. However, both standard deployment options for managed clients fail, and I think that Symantec should fix this. In any case,thank you.