Endpoint Protection

Hi everyone,

I am having trouble getting my Endpoint client Version 11 MR4 installed on my Windows server 2008 64 bit server.  This is the first 64 bit 2008 server I have tried to install this on.

I have packaged the 64 bit version, I even make a version that prompts me for settings in hopes of seeing errors.

I see no errors on the screen during the attempted install.

If I try to use the compatability troubleshooter I get a message saying changes have ebeen made to the registry and the system needs to be rebooted.  After reboot I get the same message in compatability troubleshooter.

The event log shows the installer starting and stoping but no errors.

Any help is appreciated

Thanks

Kevin Pulford
Systems Administrator
Harmon City, Inc.

Hello KevinP
Open regedit and navigate to HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\
and delete  PendingFileRenameOperations after that install your sep again. without restart
Thanks
Fatih

 Perhaps you should try a newer build of SEP?

 Fatih is right...delete the key  PendingFileRenameOperations

do not restart your computer after deleting the key
Install SEP
then you can reboot..

One more confusion over here is it is not FileRenameOperation that is below Session manager
but it is PendingFileRenameOperations that is on the right hand side value after you highlight Session Manager.
I don't think MR5 affect this issue still running the Latest build is recommended as it has resolved the issues of breaking File Share on 2008 64 bit and it will be much stable than MR4 on 2008 64 bit

I don't show in my end point manager as having anything newer than the MR4 I received in Jan.  Is MR5 not going to get placed there through normal update processes?

 you will have to download MR5 from https://fileconnect.symantec.com then upgrade the Manager from that and clients can be upgraded from the manager.

I have tried this two times now with the install, then deleting the key mentioned then installing again.  With no new results to report.

The other thing I noticed is this:

1) The default, even though its a 64bit app the settings are defaulted to program files (x86)
2) After installation in all attempts so far.  No symantec folder is ever left in the program files or programs fiels (x86) folders.

Also after the install I get the PendingFileRenameOperations show back up in the reg again.

I should point out I am installing as the administrator of the server.

Thanks

Kevin Pulford
Systems Administrator
Harmon City, Inc.

 delete the key run the install again
once it fails
go to start - run %temp%\SEP_INST.log

if not here then 

%windir%\temp\SEP_INST.log
Open the log search for the first return value 3

copy the 10-15 lines above return value 3 and post it here

1. SEP is mostly a 32bit app, with some 64bit drivers and etc so we expect to see it in the x86 directory.

2. HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\
is only for the current windows session. Try HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001 and other numbers that may be present and see if any of those include the pending keys, as that will also halt your install.

Thanks all, 
Here is what I think your asking for. 

Thanks for your help.


MSI (s) (38:E8) [11:40:18:745]: Executing op: ActionStart(Name=MSIAddWFPAppException.17E5C180_F281_4425_9348_3E891E7F8D1F,,)
Action 11:40:18: MSIAddWFPAppException.17E5C180_F281_4425_9348_3E891E7F8D1F.
MSI (s) (38:E8) [11:40:18:746]: Executing op: CustomActionSchedule(Action=MSIAddWFPAppException.17E5C180_F281_4425_9348_3E891E7F8D1F,ActionType=3073,Source=BinaryData,Target=MSIAddWFPAppException,CustomActionData=SMC Service;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe;SNAC64 Service;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE;Symantec Email;C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe;)
MSI (s) (38:78) [11:40:18:747]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIDC36.tmp, Entrypoint: MSIAddWFPAppException
WinFWConfigCA: MSIChangeWFPAppException: CustomActionData dwlen 245, SMC Service;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe;SNAC64 Service;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE;Symantec Email;C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe;.
WinFWConfigCA: MSIChangeWFPAppException: strName SMC Service, strPath C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe.
WinFWConfigCA: MSIModifyWFPAppException: strExceptionName = SMC Service.
WinFWConfigCA: MSIModifyWFPAppException: strFilePath = C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe.
WinFWConfigCA: WindowsFirewallModifyApp: fwProcessImageFileName=C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe fwName=SMC Service
WinFWConfigCA: WindowsFirewallAppIsEnabled: Authorized application C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe is was not in the collection.
WinFWConfigCA: WindowsFirewallModifyApp: Authorized application C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe is now enabled in the firewall.
WinFWConfigCA: MSIChangeWFPAppException: strName SNAC64 Service, strPath C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE.
WinFWConfigCA: MSIModifyWFPAppException: strExceptionName = SNAC64 Service.
WinFWConfigCA: MSIModifyWFPAppException: strFilePath = C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE.
WinFWConfigCA: WindowsFirewallModifyApp: fwProcessImageFileName=C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE fwName=SNAC64 Service
WinFWConfigCA: WindowsFirewallAppIsEnabled: Authorized application C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE is was not in the collection.
WinFWConfigCA: WindowsFirewallModifyApp: Authorized application C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE is now enabled in the firewall.
WinFWConfigCA: MSIChangeWFPAppException: strName Symantec Email, strPath C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe.
WinFWConfigCA: MSIModifyWFPAppException: strExceptionName = Symantec Email.
WinFWConfigCA: MSIModifyWFPAppException: strFilePath = C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe.
WinFWConfigCA: WindowsFirewallModifyApp: fwProcessImageFileName=C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe fwName=Symantec Email
WinFWConfigCA: WindowsFirewallAppIsEnabled: Authorized application C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe is was not in the collection.
WinFWConfigCA: WindowsFirewallModifyApp: Authorized application C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe is now enabled in the firewall.
MSI (s) (38:E8) [11:40:18:821]: Executing op: ActionStart(Name=MSIAddWFPAppException_RB.17E5C180_F281_4425_9348_3E891E7F8D1F,,)
Action 11:40:18: MSIAddWFPAppException_RB.17E5C180_F281_4425_9348_3E891E7F8D1F.
MSI (s) (38:E8) [11:40:18:822]: Executing op: CustomActionSchedule(Action=MSIAddWFPAppException_RB.17E5C180_F281_4425_9348_3E891E7F8D1F,ActionType=3329,Source=BinaryData,Target=MSIRemoveWFPAppException,CustomActionData=SMC Service;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe;SNAC64 Service;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE;Symantec Email;C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe;)
MSI (s) (38:E8) [11:40:18:823]: Executing op: ActionStart(Name=LU_Register_Decomposer_ABI.Rol.611D9A69_39FC_4998_998E_1ECADF28A979,,)
Action 11:40:18: LU_Register_Decomposer_ABI.Rol.611D9A69_39FC_4998_998E_1ECADF28A979.
MSI (s) (38:E8) [11:40:18:824]: Executing op: CustomActionSchedule(Action=LU_Register_Decomposer_ABI.Rol.611D9A69_39FC_4998_998E_1ECADF28A979,ActionType=1281,Source=BinaryData,Target=_LURollbackDecomposerABI@4,CustomActionData=not installed:not installed)
MSI (s) (38:E8) [11:40:18:824]: Executing op: ActionStart(Name=LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979,,)
Action 11:40:18: LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979.
MSI (s) (38:E8) [11:40:18:824]: Executing op: CustomActionSchedule(Action=LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979,ActionType=1025,Source=BinaryData,Target=_LURegisterDecomposerABI@4,)
MSI (s) (38:A0) [11:40:18:826]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIDC85.tmp, Entrypoint: _LURegisterDecomposerABI@4
-- DECABI_LOGGING --   Enter LURegisterDecomposerABI()
-- DECABI_LOGGING --   LiveUpdate registration failed. (HRESULT=-2147221164)
CustomAction LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

Log shows it is due to liveupdate : DECABI_LOGGING --   Enter LURegisterDecomposerABI()
-- DECABI_LOGGING --   LiveUpdate registration failed. (HRESULT=-2147221164)

Delete the reg key
then
Delete the following folders (if they exist):
C:\Program Files(x86)\Symantec
C:\Program Files(x86)\Symantec Antivirus
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate 
on 2008 it should be in
C:\ProgramData\Symantec\
(ProgramData would be hidden folder)

then try installing SEP

Ref :http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007111309305048

Okay I am probably missing something so let me first say.

I can find no references to anything Symantec in a serch even with hidden files and folders showing.
I did find the programdata folder you mentioend , and again no foder or file that looks liek Liveupdate or symantec.

The install looks like it is being interrupted, but I am guessig this is the error you found in the logs.

Did I mentioned this is Server 2008 R2?  If not I am sorry about that.  This server was a new install last Friday and hasn't yet been put intot production.

It has 6 GB of RAm as well if for some reason that makes a difference.

One more thing.  I did create this install package from my SEP manager, but it is not Silent.  Is there perhaps somethign I should have included or not included in the setup file?

Thanks again for all of your help

Ok..Have you exported single exe or its MSI package ?
If MSI then install LuSetup.exe first then try installing SEP.
if Single exe then copy the SEP64 folder from CD1  and then try installing LuSetup.exe first ( liveupdate )
to me it also looks like it can be a permission issue on ProgramData folder make sure System,Administrators, Domain Users, Authenticated users have permission on this folder.

As the Log shows it tries installing SEP it suceeds but when it comes to install Liveupdate it rolls back..

Vikram,

That was the winner!

I created a new package but unticked the box next to make a single exe file.   Once the package was made, there was a LUsetup.exe whcih installed fine.

Then I ran the setup.exe from the folder and that also installed fine.

I really appreciate your help with this issue.

Thanks so much.

Sincerely,

Kevin Pulford
System Administrator
Harmon City, Inc.