SEP 11.0.1000.1375 Re-Installation Failed
I am installing the SEP 11 client on the SEPM server. It was installed before, but I had problems getting it to LiveUpdate. Funny how the SEPM server's LiveUpdate is working, but not for the client on the same host. I reinstalled the client via the deploy client utility. This causes a infinite install loop, as it is failing to install. In the SEP_INST.LOG, it is reporting on the last few lines:
MSI (s) (CC:4C) [12:52:20:953]: Note: 1: 1708
MSI (s) (CC:4C) [12:52:20:953]: Product: Symantec Endpoint Protection -- Installation operation failed.
MSI (s) (CC:4C) [12:52:20:953]: Product: Symantec Endpoint Protection -- Installation operation failed.
MSI (s) (CC:4C) [12:52:20:953]: Cleaning up uninstalled install packages, if any exist
MSI (s) (CC:4C) [12:52:20:953]: MainEngineThread is returning 1603
MSI (s) (CC:08) [12:52:20:953]: Destroying RemoteAPI object.
MSI (s) (CC:20) [12:52:20:953]: Custom Action Manager thread ending.
MSI (c) (D4:2C) [12:52:20:953]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (D4:2C) [12:52:20:968]: MainEngineThread is returning 1603
MSI (s) (CC:4C) [12:52:20:953]: MainEngineThread is returning 1603
MSI (s) (CC:08) [12:52:20:953]: Destroying RemoteAPI object.
MSI (s) (CC:20) [12:52:20:953]: Custom Action Manager thread ending.
MSI (c) (D4:2C) [12:52:20:953]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (D4:2C) [12:52:20:968]: MainEngineThread is returning 1603
The log is 4MB. Can someone help me figure out how to force a reinstall?
-Dade
Filed under: Endpoint Protection (AntiVirus) - 11.x, Security
search the file for "return value 3"
the lines just above that will tell you why it failed... they may be cryptic, so feel free to post them here
Paul Murgatroyd
Principal Regional Product Manager, Enterprise Security Group, Symantec
Endpoint twitter feed: http://twitter.com/symc_endpoint
MSI (s) (CC:70) [12:52:18:140]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI101.tmp, Entrypoint: MSIAddWFPAppException
WinFWConfigCA: MSIChangeWFPAppException: CustomActionData dwlen 223, SMC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe;SNAC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE;Symantec Email;C:\Program Files\Common Files\Symantec Shared\ccApp.exe;.
WinFWConfigCA: MSIChangeWFPAppException: strName SMC Service, strPath C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe.
WinFWConfigCA: MSIModifyWFPAppException: strExceptionName = SMC Service.
WinFWConfigCA: MSIModifyWFPAppException: strFilePath = C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe.
WinFWConfigCA: WindowsFirewallInitialize: get_CurrentProfile failed: 0x800706d9
WinFWConfigCA: ModifyWindowsFirewallPolicy: WindowsFirewallInitialize failed: 0x800706d9
WinFWConfigCA: MSIChangeWFPAppException: strName SNAC Service, strPath C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE.
WinFWConfigCA: MSIModifyWFPAppException: strExceptionName = SNAC Service.
WinFWConfigCA: MSIModifyWFPAppException: strFilePath = C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE.
WinFWConfigCA: WindowsFirewallInitialize: get_CurrentProfile failed: 0x800706d9
WinFWConfigCA: ModifyWindowsFirewallPolicy: WindowsFirewallInitialize failed: 0x800706d9
WinFWConfigCA: MSIChangeWFPAppException: strName Symantec Email, strPath C:\Program Files\Common Files\Symantec Shared\ccApp.exe.
WinFWConfigCA: MSIModifyWFPAppException: strExceptionName = Symantec Email.
WinFWConfigCA: MSIModifyWFPAppException: strFilePath = C:\Program Files\Common Files\Symantec Shared\ccApp.exe.
WinFWConfigCA: WindowsFirewallInitialize: get_CurrentProfile failed: 0x800706d9
MSI (s) (CC:4C) [12:52:18:171]: Executing op: ActionStart(Name=MSIAddWFPAppException_RB.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5,,)
WinFWConfigCA: ModifyWindowsFirewallPolicy: WindowsFirewallInitialize failed: 0x800706d9
MSI (s) (CC:4C) [12:52:18:171]: Executing op: CustomActionSchedule(Action=MSIAddWFPAppException_RB.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5,ActionType=3329,Source=BinaryData,Target=MSIRemoveWFPAppException,CustomActionData=SMC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe;SNAC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE;Symantec Email;C:\Program Files\Common Files\Symantec Shared\ccApp.exe;)
MSI (s) (CC:4C) [12:52:18:171]: Executing op: ActionStart(Name=LU_Register_Decomposer_ABI.Rol.611D9A69_39FC_4998_998E_1ECADF28A979,,)
MSI (s) (CC:4C) [12:52:18:171]: Executing op: CustomActionSchedule(Action=LU_Register_Decomposer_ABI.Rol.611D9A69_39FC_4998_998E_1ECADF28A979,ActionType=1281,Source=BinaryData,Target=_LURollbackDecomposerABI@4,CustomActionData=not installed:not installed)
MSI (s) (CC:4C) [12:52:18:171]: Executing op: ActionStart(Name=LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979,,)
MSI (s) (CC:4C) [12:52:18:171]: Executing op: CustomActionSchedule(Action=LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979,ActionType=1025,Source=BinaryData,Target=_LURegisterDecomposerABI@4,)
MSI (s) (CC:18) [12:52:18:171]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI102.tmp, Entrypoint: _LURegisterDecomposerABI@4
-- DECABI_LOGGING -- Enter LURegisterDecomposerABI()
-- DECABI_LOGGING -- LiveUpdate registration failed. (HRESULT=-2147024770)
MSI (s) (CC:4C) [12:52:18:203]: User policy value 'DisableRollback' is 0
MSI (s) (CC:4C) [12:52:18:203]: Machine policy value 'DisableRollback' is 0
Action ended 12:52:18: InstallFinalize. Return value 3.
MSI (s) (CC:4C) [12:52:20:687]: Executing op: CustomActionRollback(Action=restoreSPState.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,ActionType=3329,Source=BinaryData,Target=restoreSPState,CustomActionData=0)
MSI (s) (CC:30) [12:52:20:687]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI10F.tmp, Entrypoint: restoreSPState
restoreSPState: called
restoreSPState: calling loadEventManagerDLLs
loadEventManagerDLLs: called
serviceIsRunning: OpenService FAILED with error 1060
LoadEvtMgrDll: ccEvtMgr is not running
serviceIsRunning: OpenService FAILED with error 1060
SendReload: ccEvtMgr is not running
loadEventManagerDLLs: FAILED to send reload event
loadEventManagerDLLs: exiting
restoreSPState: Changing service configuration to SERVICE_DEMAND START for SPBBCSvc
modifyServiceConfiguration: OpenService() FAILED with error 1060
restoreSPState: Unable to modify configuration for SPBBCSvc
restoreSPState: Value of szSPState "0"
restoreSPState: SPState is NOT set to 1. NOT Calling startSP
restoreSPState: exiting
MSI (s) (CC:4C) [12:52:20:703]: Executing op: ActionStart(Name=checkMSXMLVersion.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (CC:4C) [12:52:20:703]: Executing op: ActionStart(Name=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (CC:4C) [12:52:20:703]: Executing op: CustomActionRollback(Action=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,ActionType=1345,Source=BinaryData,Target=cleanupFolder,)
MSI (s) (CC:B4) [12:52:20:718]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI110.tmp, Entrypoint: cleanupFolder
InstSymProtect::cleanupFolder() -> called
DeleteFolderIfNoFileExists: Driver file is not present.
DeleteFolder: FAILED to delete directory C:\Program Files\Common Files\Symantec Shared\SPBBC
DeleteFolderIfNoFileExists: SHDeleteFolder FAILED
InstSymProtect::cleanupFolder() -> DeleteFolderIfNoFileExists FAILED
MSI (s) (CC:4C) [12:52:20:718]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (CC:4C) [12:52:20:718]: Error in rollback skipped. Return: 5
cleanupFolder: exiting
MSI (s) (CC:4C) [12:52:20:734]: No System Restore sequence number for this installation.
MSI (s) (CC:4C) [12:52:20:734]: Unlocking Server
MSI (s) (CC:4C) [12:52:20:734]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 12:52:20: INSTALL. Return value 3.
Paul Murgatroyd
Principal Regional Product Manager, Enterprise Security Group, Symantec
Endpoint twitter feed: http://twitter.com/symc_endpoint
Would you like to reply?
Login or Register to post your comment.