Endpoint Protection

09:56:53    INFO    Initializing removal engine...

09:56:53    INFO    Engine version: 12.1.4100.4126

09:56:53    INFO    Engine initalized succesfully.

09:56:53    INFO    [1/22]: Scanning Windows Installer cache

09:56:59    INFO    [2/22]: Collecting product information

09:57:00    INFO    [3/22]: Processing collected information

09:57:00    INFO    [4/22]: Preparing to remove products

09:57:00    INFO    [5/22]: Unregistering products from Windows Installer database

09:57:00    INFO    [6/22]: Stopping LiveUpdate

09:57:00    INFO    [7/22]: Stopping and removing services

09:57:00    WARN   Unable to reset service DACL. SetNamedSecurityInfo failed. Error code: 0 (0x0): The operation completed successfully.

09:57:00    WARN   Exception caught: QueryServiceStatusEx failed. Error code: 2 (0x2): The system cannot find the file specified.

09:57:07    WARN   Teefer uninstaller returned 4. See teeferInstall.log for details.

09:57:07    INFO    [8/22]: Unregistering EventLog sources

09:57:07    INFO    [9/22]: Disabling startup items

09:57:07    INFO    [10/22]: Verifying whether a reboot is required

09:57:37    ERROR Failed to initialize SEPRemovalToolNative. WaitForSingleObject returned 258. Last error: 0. Check C:\WINDOWS\Temp\CleanWipe_201405010956315\SepRemovalToolNative_x86.log file.

The installation rolls back. This is on an exchange server, so I have to be very careful with it.

SAV or SEP? What version?

How to uninstall Symantec Antivirus, Symantec Endpoint Protection,and Symantec Endpoint Protection Manager, and what to do if that fails

Can try a manual uninstall?

Trying to remove any remnants of SAV and attempting to install SEP. I did the manual fixes of removing the directories from the local drive and the registry and that was a "no go" Tried CW and encountered that.

Try a manual uninstall

http://www.symantec.com/docs/TECH99631

Ran the clienwipe as local admin?

Hi,

I am wondering SAV which is out of support was protecting Exchange Server.

Cleanwipe tool requires a reboot though with the latest version you can reboot later on.

If it's exchange server then you need to take down time prior to run this tool.

I would also suggest to go with Manual uninstall process however this process also need a reboot.

Out of curiosity, are you running the latest CW version, 12.1.4100.4126?

Yes

I think the latest installation/rollback is what is preventing the Cleanwipe from doing its job. Once we restart I will try the Cleanwipe again and see if that works. I will not do a manual uninstall without an open case from Symantec, I have had issues in the past where I did a manual uninstall and the server did not come back up. I cannot have that happen in this instance.

I will have the server restarted after hours, then I will try the cleanwipe and see how it goes.

Only with an open case. This server is our most critical of all.

I would've tried a manual uninstall before running CW

I may still try it since CW didn't work

Cleanwipe did the trick, and then when I went to install it, the entire program installed in like 20 seconds. I was shocked to see how fast the installation took place.

good deal

Boss man says Cleanwipe didn't work, I wonder why the install went so smoothly this time?

...because cleanwipe worked