Endpoint Protection

There are 6 servers with the same build, installation on 5 went thru but not the last one.

We get the below errors.

MSI (s) (60:C4) [12:32:41:637]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (s) (60:C4) [12:32:41:637]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'Axa'.
MSI (s) (60:C4) [12:32:41:637]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'AXA Tech Spain'.
MSI (s) (60:C4) [12:32:41:637]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\WINDOWS\Installer\45d62d7.msi'.
MSI (s) (60:C4) [12:32:41:637]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is '\\praessep01\d$\SEP6_ENG_x64\Symantec AntiVirus Win64.msi'.
MSI (s) (60:C4) [12:32:41:637]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (s) (60:C4) [12:32:41:637]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
MSI (s) (60:C4) [12:32:41:652]: Note: 1: 2205 2:  3: PatchPackage
MSI (s) (60:C4) [12:32:41:652]: Machine policy value 'DisableRollback' is 0
MSI (s) (60:C4) [12:32:41:652]: User policy value 'DisableRollback' is 0
MSI (s) (60:C4) [12:32:41:652]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
=== Logging started: 10/30/2012  12:32:41 ===
MSI (s) (60:C4) [12:32:41:652]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
MSI (s) (60:C4) [12:32:41:652]: Doing action: INSTALL
Action start 12:32:41: INSTALL.

MSI (s) (60:C4) [12:32:41:652]: Running ExecuteSequence
MSI (s) (60:C4) [12:32:41:652]: Doing action: System16Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
Action start 12:32:41: System16Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
MSI (s) (60:C4) [12:32:41:668]: Doing action: CommonFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
Action ended 12:32:41: System16Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
MSI (s) (60:C4) [12:32:41:684]: PROPERTY CHANGE: Adding CommonFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 property. Its value is 'C:\Program Files (x86)\Common Files\'.
Action start 12:32:41: CommonFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
MSI (s) (60:C4) [12:32:41:684]: Doing action: CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
Action ended 12:32:41: CommonFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
MSI (s) (60:C4) [12:32:41:684]: PROPERTY CHANGE: Adding CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 property. Its value is 'C:\Documents and Settings\All Users\Application Data\'.
Action start 12:32:41: CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
MSI (s) (60:C4) [12:32:41:684]: Doing action: SystemFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
Action ended 12:32:41: CommonAppDataFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
MSI (s) (60:C4) [12:32:41:699]: PROPERTY CHANGE: Adding SystemFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 property. Its value is 'C:\WINDOWS\SysWOW64\'.
Action start 12:32:41: SystemFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
MSI (s) (60:C4) [12:32:41:699]: Doing action: System64Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
Action ended 12:32:41: SystemFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
MSI (s) (60:C4) [12:32:41:699]: PROPERTY CHANGE: Adding System64Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 property. Its value is 'C:\WINDOWS\system32\'.
Action start 12:32:41: System64Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
MSI (s) (60:C4) [12:32:41:699]: Doing action: ProgramFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2
Action ended 12:32:41: System64Folder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
MSI (s) (60:C4) [12:32:41:715]: PROPERTY CHANGE: Adding ProgramFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 property. Its value is 'C:\Program Files (x86)\'.
Action start 12:32:41: ProgramFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2.
MSI (s) (60:C4) [12:32:41:715]: Doing action: ProgramFilesFolder.93C43188_D2F5_461E_B42B_C3A2A318345C
Action ended 12:32:41: ProgramFilesFolder.9DDC0E81_9620_4441_B4F7_FD077F55D6D2. Return value 1.
MSI (s) (60:C4) [12:32:41:715]: PROPERTY CHANGE: Adding ProgramFilesFolder.93C43188_D2F5_461E_B42B_C3A2A318345C property. Its value is 'C:\Program Files (x86)\'.
Action start 12:32:41: ProgramFilesFolder.93C43188_D2F5_461E_B42B_C3A2A318345C.
MSI (s) (60:C4) [12:32:41:731]: Doing action: CommonFilesFolder.AE34FE77_F4D6_42C5_A0D4_A58BE72B0219
Action ended 12:32:41: ProgramFilesFolder.93C43188_D2F5_461E_B42B_C3A2A318345C. Return value 1.
MSI (s) (60:C4) [12:32:41:731]: PROPERTY CHANGE: Adding CommonFilesFolder.AE34FE77_F4D6_42C5_A0D4_A58BE72B0219 property. Its value is 'C:\Program Files (x86)\Common Files\'.
Action start 12:32:41: CommonFilesFolder.AE34FE77_F4D6_42C5_A0D4_A58BE72B0219.
MSI (s) (60:C4) [12:32:41:731]: Doing action: CommonFilesFolder.611D9A69_39FC_4998_998E_1ECADF28A979
Action ended 12:32:41: CommonFilesFolder.AE34FE77_F4D6_42C5_A0D4_A58BE72B0219. Return value 1.
MSI (s) (60:C4) [12:32:41:746]: PROPERTY CHANGE: Adding CommonFilesFolder.611D9A69_39FC_4998_998E_1ECADF28A979 property. Its value is 'C:\Program Files (x86)\Common Files\'.
Action start 12:32:41: CommonFilesFolder.611D9A69_39FC_4998_998E_1ECADF28A979.
MSI (s) (60:C4) [12:32:41:746]: Doing action: WindowsFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E
Action ended 12:32:41: CommonFilesFolder.611D9A69_39FC_4998_998E_1ECADF28A979. Return value 1.
MSI (s) (60:C4) [12:32:41:746]: PROPERTY CHANGE: Adding WindowsFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E property. Its value is 'C:\WINDOWS\'.
Action start 12:32:41: WindowsFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E.
MSI (s) (60:C4) [12:32:41:746]: Doing action: SystemFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E
Action ended 12:32:41: WindowsFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E. Return value 1.
MSI (s) (60:C4) [12:32:41:762]: PROPERTY CHANGE: Adding SystemFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E property. Its value is 'C:\WINDOWS\SysWOW64\'.
Action start 12:32:41: SystemFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E.
MSI (s) (60:C4) [12:32:41:762]: Doing action: WindowsFolder.BDF6E439_056A_10D7_FF1F_C8B3B9A1E18E
Action ended 12:32:41: SystemFolder.D2730D3F_3C41_5884_FF1F_C8B3B9A1E18E. Return value 1.

MSI (s) (60:C4) [12:43:28:606]: Executing op: CustomActionSchedule(Action=StopCcSetMgrOnOverOrBrokenInstall.D3A883B9_8F94_4E7D_96B6_852388CE5647,ActionType=1025,Source=BinaryData,Target=_StopCcSetMgrOnOverOrBrokenInstall@4,)
MSI (s) (60:80) [12:43:28:637]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI8C.tmp, Entrypoint: _StopCcSetMgrOnOverOrBrokenInstall@4
2012-10-30-12-43-28-652 : ccLib::CRegistry::Open(101) : RegOpenKeyEx() != ERROR_SUCCESS, Software\Symantec\InstalledApps, 0x00000002

MSIASSERT - 2012-10-30-12-43-28-652 : CInstalledApps::GetInstAppsDirectory() : reg.Open() == FALSE
:
MSIASSERT - 2012-10-30-12-43-28-652 : CInstalledApps::GetCCDirectory() : GetInstAppsDirectory() == false
:
2012-10-30-12-43-28-652 : CInstalledApps::GetSymSharedDirectory() : "C:\Program Files (x86)\Common Files\Symantec Shared"

2012-10-30-12-43-28-652 : CInstalledApps::GetCCDirectory() : "C:\Program Files (x86)\Common Files\Symantec Shared"

MSIASSERT - 2012-10-30-12-43-28-652 : cc::StopServiceAndDepAtAnyCost(366) : Unable to openService ccSetMgr. Error=1060:
MSI (s) (60:C4) [12:43:28:668]: Executing op: ActionStart(Name=InstallLiveUpdate_RB.479D9157_6569_48B2_97C9_6F35A45064AC,,)
MSIASSERT - StopCcSetMgrOnOverOrBrokenInstall: Unable to stop ccSetMgr:
MSI (s) (60:C4) [12:43:28:668]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate_RB.479D9157_6569_48B2_97C9_6F35A45064AC,ActionType=3329,Source=BinaryData,Target=UnInstallLiveUpdate,CustomActionData=C:\DOCUME~1\excadmin\Local Settings\Temp\VIGJRQFT\LiveUpdate\lucheck.exe)
MSI (s) (60:C4) [12:43:28:668]: Executing op: ActionStart(Name=InstallLiveUpdate.479D9157_6569_48B2_97C9_6F35A45064AC,,)
MSI (s) (60:C4) [12:43:28:668]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate.479D9157_6569_48B2_97C9_6F35A45064AC,ActionType=3073,Source=BinaryData,Target=InstallLiveUpdate,CustomActionData=C:\DOCUME~1\excadmin\Local Settings\Temp\VIGJRQFT\LiveUpdate\lucheck.exe)
MSI (s) (60:28) [12:43:28:699]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI8D.tmp, Entrypoint: InstallLiveUpdate
LUCA: InstallLiveUpdate enter.
LUCA: C:\DOCUME~1\excadmin\Local Settings\Temp\VIGJRQFT\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 2103571981
MSI (s) (60:C4) [12:43:28:715]: User policy value 'DisableRollback' is 0
MSI (s) (60:C4) [12:43:28:715]: Machine policy value 'DisableRollback' is 0
Action ended 12:43:28: InstallFinalize. Return value 3.

Tried cleanwipe > No go.

tried LU install & then SEP > no go

No DCOM.

Let me know if you need any info. Thanks.

HI,

Do you have Client package available on Share drive ?

If yes try to copy install package on system and install.

Hello,

The Package is a 64 bit package and you are running the .msi file from the shared drive - '\\praessep01\d$\SEP6_ENG_x64\Symantec AntiVirus Win64.msi'.

It is recommended you to deploy the package via Migration and Deployment Wizard OR by copy / pasting the package on the local HDD and then running the Symantec AntiVirus Win64.msi.

Secondly, check this Error:

LUCA: C:\DOCUME~1\excadmin\Local Settings\Temp\VIGJRQFT\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 2103571981
MSI (s) (60:C4) [12:43:28:715]: User policy value 'DisableRollback' is 0
MSI (s) (60:C4) [12:43:28:715]: Machine policy value 'DisableRollback' is 0
Action ended 12:43:28: InstallFinalize. Return value 3.

Check these Threads with similar issue-

https://www-secure.symantec.com/connect/forums/i-appreciate-your-help-here-well

https://www-secure.symantec.com/connect/forums/endpoint-protection-manager-wont-install-rolls-back-every-time

Hope that helps!!

Local install did not help :(

tried without an RDP using DRAC. No go.

The forums doesn't have much, tried almost all the steps.

If it is relevant, there was 12.1 installed on this machine and removed.

Unable to run NSS. it says its supported only for Vista & above. How can i make sure this is not an infection?

You can run Symantec Power Eraser to check for an infection:

https://www.symantec.com/business/support/index?page=content&id=TECH134803

Though i agree, we are not approving power eraser on critical servers.

I was a fan of NSS. It used to help us in case of the infamous 1920 errors during SAV installations. Is there an online scan that i could use?

Logs shows that

MSIASSERT - 2012-10-30-12-43-28-652 : cc::StopServiceAndDepAtAnyCost(366) : Unable to openService ccSetMgr. Error=1060:

Solution

Thanks Riya, I will try this and update you.

*Edit

Riya,

The below Dlls were not found for MSXML 6.2 and the others register okay.

msxml4.dll
msxml5.dll

We also patched. Still the issue persists.

Any suggestions?

As silly as it may sound, it worked when we tried with a different admin account. Thanks for all your suggestions.