Endpoint Protection

Hi Everyone,

I think there is a bug in the new RU7 release of SEP 11 (this includes RU7 MP1). On Windows XP machines, the RU7 client seems to get stuck in an MSI installer loop. The installer loop goes like this - 1. The SMC client will disappear from the system tray, 2. The SMC will reappear in the system tray but will report problems with PTP and NTP defs. Looking at the event logs, it looks like SEP is in an MSI installer loop. I've tested with fresh installs of SEP, clean installs of Windows XP, upgrading the clients from RU6 to RU MP1, etc...

Event Type:    Warning
Event Source:    MsiInstaller
Event Category:    None
Event ID:    1001
Date:        11/9/2011
Time:        4:00:16 PM
User:        NT AUTHORITY\SYSTEM
Description:
Detection of product '{8461C192-EA40-4F9F-AA0A-47C17399AEF9}', feature 'Core' failed during request for component '{30466A58-8174-4ED4-9171-A4D739E84E3A}'

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The impact is only for Windows XP - Windows Vista and Windows 7 clients are OK. Is anyone els seeing this problem?

Thanks,

Mike

Hello Mike ,

on problem machine go to task manager processess tab and kill msiexe process running should be 3 in total

go to add remove program on the same problem machine check for sep hit change and repair this sep client

reboot the machine and check if it happens again ,if no

go to sepm >admin>install package >client install settings tab>select remove all previous logs and policies option >

export a new packge with setting created and deploy it on few machine which you seem to have problem

allow them to reboot and check adding article below how to creat client install package

http://www.symantec.com/business/support/index?page=content&id=TECH102817

http://support.microsoft.com/kb/319624

Method 1: Unregister and re-register the Windows Installer

1. Click Start, click Run, type MSIEXEC /UNREGISTER, and then click OK. Even if you do this correctly, it may look like nothing occurs.
2. Click Start, click Run, type MSIEXEC /REGSERVER, and then click OK. Even if you do this correctly, it may look like nothing occurs, or you may briefly see an hourglass. After you run this command, the operation is complete.
3. Try your Windows Installer-based application again.

From the behavior your describing it sounds like the crypt32 memory leak issue that only affects XP SP3. There is a hotfix issued for this from Microsoft. Below is our official documentation regarding the issue.

http://www.symantec.com/docs/TECH170667

Thank you for the information. It looks like the crypt32 is the issue. This issue has had me scratching my head for the last few weeks.

Mike