Endpoint Protection

Hello,

We have to run client package when upgrading SAV10.1.9 clients to SEP RU5.

Setup:  We have a SAV10.1.9 and SEP RU5 environment running in parallel, and slowly moving clients from sav to sep.  After upgrading our SEPMs from MR4MP2 to RU5, there was no problem in upgrading MR4MP2 clients using "Upgrade Groups with Pacakge" from the console to RU5.   And there is no problem when we install RU5 on new machines.

Unfortunately when I run a client package (SEPRU5) on a client machine (either xp, vista, or 2003 server) with has sav10.1.9.  The package does uninstall sav10 and then nothing happens for hrs.  I tried try to restart thinking that installation process will continue after restart.   But when I run same package again on the same machine then SEP R5 installation completes without any problem. 

Thinking that may be there is any problem in my package, I have "exported client install package" couple of times, but every time i have to run setup.exe (single file executable, since that is the only way we deploy through web on our campus) to migrate sav clients.  It does not matter type of client OS, it is same on XP, Vista, or 2003.

It was not like this when I had MR4MP2 SEPMs.  I had to run only once setup.exe on a new client or one with sav, and SEP install will complete (little longer on machine with sav since it has to uninstall sav).

A case has been openned with Symantec platinum (bcs now) support for sometime without any progress yet.

Any idea or help will be highy appreciated.

Sincere regards,

 Have you already tried non-single exe package ?
Are your SAV clients SEP Migration ready? -- Disable Schedule Scan,no scan should be running at the time of migration, No liveupdate running,no uninstall password.

I think it might be helpful to get some information on one of the machines that failed to install SEP. So on one of the machine that failed the install the first time (prior to you deploying the install again) please post the diagnostic info of the install. Diagnostic information can be found in the SEP_INST.LOG file. To access this file, click >Start >Run and type %temp% in the Open field. Please look for the first return value 3 and post the 10 or so lines above it.

Thanks
Grant

You mentioned "when I run a client package (SEPRU5) on a client machine (either xp, vista, or 2003 server". Is there a single machine with any OS on which the installation has gone through. 

The logs asked by Grant would definetly help us to narrow down the issue.

First of all sorry for a delay...

I did not try full package as our campus has only 60% machines in domain, so for deployment we have to use single file that way users can download from web site to install.  And we did not have this situation when our SEP environment was on MR4MP2.   Schedule scan and uninstall password was also there when we were upgrading sav clients to MR4 MP2

New installation of RU5 went fine on all type clients, XP, Vista, or 2003.  Only problem is when running installation on a client which has sav client.  Uninstall goes smooth, then nothing happens. 

Here are portion of SEP_INST.log, around first instance of "return value 3"

Module: ImagePath=C:\WINDOWS\system32\ADVAPI32.dll
Module: ImagePath=C:\WINDOWS\system32\RPCRT4.dll
Module: ImagePath=C:\WINDOWS\system32\GDI32.dll
Module: ImagePath=C:\WINDOWS\system32\SHLWAPI.dll
Module: ImagePath=C:\WINDOWS\system32\Secur32.dll
Module: ImagePath=C:\WINDOWS\system32\kernel32.dll
Module: ImagePath=C:\WINDOWS\system32\ntdll.dll
Module: ImagePath=C:\WINDOWS\system32\SHELL32.dll
Module: ImagePath=C:\WINDOWS\System32\msi.dll
Module: ImagePath=C:\WINDOWS\system32\USER32.dll
Module: ImagePath=C:\WINDOWS\System32\SXS.DLL
MSI (s) (C0:3C) [11:31:07:968]: User policy value 'DisableRollback' is 0
MSI (s) (C0:3C) [11:31:07:968]: Machine policy value 'DisableRollback' is 0
Action ended 11:31:07: InstallFinalize. Return value 3.
MSI (s) (C0:3C) [11:31:08:874]: Executing op: Header(Signature=1397708873,Version=301,Timestamp=1010916270,LangId=1033,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
MSI (s) (C0:3C) [11:31:08:874]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (C0:3C) [11:31:08:874]: Executing op: DialogInfo(Type=1,Argument=Symantec Endpoint Protection)
MSI (s) (C0:3C) [11:31:08:874]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (C0:3C) [11:31:08:889]: Executing op: ActionStart(Name=CcSetMgrStart.D3A883B9_8F94_4E7D_96B6_852388CE5647,,)
MSI (s) (C0:3C) [11:31:08:889]: Executing op: ProductInfo(ProductKey={2EFCC193-D915-4CCB-9201-31773A27BC06},ProductName=Symantec Endpoint Protection,PackageName=Symantec AntiVirus.msi,Language=1033,Version=184554378,Assignment=1,ObsoleteArg=0,ProductIcon=ARPPRODUCTICON.exe,,PackageCode={F62D9433-DFA4-4A64-A178-6FFB9D82148A},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0)
MSI (s) (C0:3C) [11:31:08:889]: Executing op: ActionStart(Name=CcSetMgrStart_Rol.D3A883B9_8F94_4E7D_96B6_852388CE5647,,)
MSI (s) (C0:3C) [11:31:08:889]: Executing op: CustomActionRollback(Action=CcSetMgrStart_Rol.D3A883B9_8F94_4E7D_96B6_852388CE5647,ActionType=3329,Source=BinaryData,Target=_CcSetMgrShutdown@4,)
MSI (s) (C0:B0) [11:31:08:889]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI10C.tmp, Entrypoint: _CcSetMgrShutdown@4
2010-02-01-11-31-09-046 : cc::StopServiceAndDepAtAnyCost(380) : The service ccSetMgr is already stopped. Current state=1
MSIRESULT PASS - CcSetMgrShutdown:  Able to successfully stop ccSetMgr:
MSIASSERT - 2010-02-01-11-31-09-077 : CMutex::Open() : OpenMutex() == NULL, Global\ccSetMgr_Single_Instance_Lock, 0x00000002
:
CcSetMgrShutdown:

Meantime I might try as Vikram suggested, though we can not use in our environment.

Sincere regards,

 Try turning off Tamper Protection on the SAV client while doing to the install.

Hello,

I have tried with non-single file package too, but it was same.
The I tried by disabling Tamper Protection and also windows firewall.  Interestingly it does successfully unistall sav without any problem (there is no password to uninstall on sav), but for some reason not able to start installation of sep.

Sincere regards,

So does that mean even after disabling Tamper Protection you have to push the package twice ?

I have spent some time this week trying to recreate this issue in my sandbox but was unable to. From your logs it looks like there might be "pending file system changes" that need to happen before SEP can install. However I don't see why the install would work when you push it out again. I am going to try to look into this a little further, so it would be helpful if I could get your case number so I can see what the other techs have done so far. You can post it here or PM me. 

I appreciate it thanks,
Grant

Hello Grant_Hall,

I do restart couple of time even do microsoft updates and restart before running setup.exe install package first time.   As you mentioned, I never had problem running setup.exe again, which does conplete installation.  I have tried different gaps between running twice, from one hr to one day, that is leave machine as it is after starting first instance of setup.exe.  And when I see sav has been removed followed by no activity for long time....then I restart machine and see if setup.exe resumes.  But setup.exe does not start to complete SEP installation, then I run setup.exe again..At this point it will complete the installation successfully.

I had submitted SEP_INST.log in two separate groups,  one set representing log created after running first time, and 2nd set when it finishes SEP install.

Sincere regards,