Endpoint Protection

Dear Team,

We are in process of upgradation from 11.x for our around 16000 clients and just started rollout and in between we reported rollback issues.

Logged case with support and provided requested logs and after that support has suggested to run cleanwipe to resolve the issue and it has been resolved.

But the issue reported on many systems and not possible to go each and every systems to run cleanwipe.

Request you all to please let me know if there is any possiblities to resolve reported issue centrally by any changes in registry or doing anything remotely.

Attaching SEP_Inst log and error reported./connect/sites/default/files/users/user-1304771/Rollback%20Error.jpg

Thanks in Adv.

S2S

Attachment(s)

SEP_INST.txt   1.59 MB 1 version

found this

Error 1404. Could not delete key \SYSTEM\CurrentControlSet\Services\WGX.  System error .  Verify that you have sufficient access to that key, or contact your support personnel.
MSI (s) (D8:AC) [11:24:03:350]: Product: Symantec Endpoint Protection -- Error 1404. Could not delete key \SYSTEM\CurrentControlSet\Services\WGX.  System error .  Verify that you have sufficient access to that key, or contact your support personnel.

See here

Symantec Endpoint Protection Client install fails with MSI errors 1402 and 1406 in eventlog

You appear to be performing an inplace upgrade to SEP12.1RU2 when encountering these permissions issues as identified by Brian ("Thumbs Up" BTW).

Therefore, can you give us a bit more info on how you're running this plz?

• Was this particular one a manual run, or pushed out via a software management tool (and what are you using)?
• Have you tested remove and install?
• Have you tested upgrades via the SEPM?

#EDIT#

Just in case you're using SCCM, have you followed the below article?
http://www.symantec.com/docs/HOWTO81176

Hello,

Have you try install manually effected machine ?

Check this discussion

https://www-secure.symantec.com/connect/forums/sep-clients-wont-upgrade-after-sepm-1212-upgrade

Hi,

We have installed fresh RU2 SEPM and replacing sylink of clients and once they reflected in to the new SEPM then we configure auto upgrade through SEPM.

After removed using cleanwipe we are able to install SEP successfully.

Thanks.

Hi Manish,

I have tried manually upgrade but it rollback again on same stage.

In that case do you have some sort of custom configuration?

The install log indicates the installer is being cached in a custom location as below:

C:\SEP\SEP32bit12.1.2Ru2\Sep.msi

Can you also advise if you're upgrading from a specific SEP11 version, or are we looking at various versions?

Like I say, more info the better!

I have identified rollback status client from SEPM and then done the following activities on afftected system:

-- Repaired SEP.

-- Copied new unmanged SEP client package into local system. (C:\SEP\SEP32bit12.1.2Ru2)

-- Execute setup.exe.

-- Setup interrupted with the same error code.

-- Run Cleanwipe which successfully done after reboot.

-- Run same setup and installed unmanaged client.

-- Replaced sylink from SEPM.

-- Traced the same client from SEPM and found the same rollback icon with same status.

-- Delete client entry from SEPM.

-- Traced client after few min and found the client is online and reporting successfully with no more error status.

Ok, that clears that up.

In that case, do you have a SEP_INST.log from when SEP attempted the upgrade on its own (just in case the errors are different)?

Also, I'd still suggest testing out removing the old SEP Client before installing the new one.  You can accomplish this with the SEPprep tool:

http://www.symantec.com/docs/TECH148513

If this does work, then you can use the below article to use the SEPprep'd package for upgrade via the SEPM instead of the native packages:

http://www.symantec.com/docs/TECH106181

Actually I have removed Old SEP Inst log before installing new one...

Hi,

Thank you for posting query in Symantec community.

Create a test group & replace a ADC policy which can be downloaded from the following KB.

http://www.symantec.com/business/support/index?page=content&id=TECH132337&locale=en_US