Endpoint Protection

I have been unable to install the SEP 12.1.6 client install on one of my Windows Server 2008 R2 servers (domain controller). I have successfully run CleanWipe 12.1.6 multiple times, but still no change. The Windows App. log shows event ID 11708, which says installation operation failed. I looked through the SEP install log, but was not able to decipher anything useful from it. Any ideas or suggestions? Thank you!!

Please post the SEP_INST.log and SIS_INST.log files:

Required logs for troubleshooting failed Endpoint Protection 12.1 client installations

If you want to quickly test, try installing an unmanaged client with only the AV component. If successfull you can make it managed.

Please post the logs, did you reboot after cleanwipe?

Please share the Sis_inst.log so that we can help you. you can find the log in the following location.

 

C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.xxxx.xxxx.xxx\Data\Install\Logs

Sorry for the delay. I have attached the sis_inst.log file. Any ideas would be appreciated...

Ok here is the error.

2015-07-07T10:15:16.122Z ERROR I SIS          ContentId=[VirusDefs]
2015-07-07T10:15:16.122Z ERROR I SIS          DeferralGuid=[{FE653A5C-B5B8-4273-B2C6-B5DFB93C0BEC}]
2015-07-07T10:15:16.122Z ERROR I SIS          SrcPath=[C:\Windows\TEMP\ee09ea97-4712-47d2-93b3-3188d26757ba\VDefs.zip]
2015-07-07T10:15:16.122Z ERROR I SIS          DestPath=[C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.6168.6000.105\Data\Definitions\]
2015-07-07T10:15:16.122Z ERROR I SIS          OnFail=[rollbackExecution]
2015-07-07T10:15:16.122Z ERROR I SIS          CopyMode=[Move]

 

Now I would suggest you to first run clean wipe and then delete the following folder C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.6168.6000.105\Data\Definitions\

and try installing SEP 12.1.6

if it's still failing 

 would suggest you to first run clean wipe and then delete the following folder 

C:\Windows\TEMP\ee09ea97-4712-47d2-93b3-3188d26757ba\VDefs.zip

C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.6168.6000.105\Data\Definitions\

and try installing SEP 12.1.6 

 

Have you tried exporting the package with basic content?

Thanks for the tips. The unmanaged package with basic content did not help. The suggestions to delete the folders listed above did not help either. Very frustrating that no matter what I try, I can't install SEP on a normal Windows 2008 server. Any other ideas on how to proceed?

After removing and running cleanwipe start a manual search of directories and registry. There has to be a leftover remnant somewhere.

Hi Birdman,

 

Can you please share the new sis_inst.log and just out of curiosity, are you trying to install sep from an full admin account ? 

Could you try to install any legacy SEP version on the same box? If could install successfully can perform an upgrade to 12.1 ru6.

Attached logs are dated 7th July, if possible attach the latest logs & collect Symhelp logs as well.

 

I tried to install a legacy version of SEP (12.1.2). Instead of using an exported package from the SEPM, I used the install in the SEPx64 folder that is downloaded from the full SEP install from the Symantec site, so I had all the diaglogue screens during the install. The install stops when it fails to start the SEP service (ccSvcHst.exe), and the following Symantec message pops up:  "Error 1920: Symantec Endpoint Protection (SepMasterService) failed to start. Verify that you have sufficient privileges to start system services."  At that point, I tried to start te SEP service myself, and it won't start. I verified registry and directory permissions, based on Symantec article TECH141644, and did not see anything abnormal.

 

If the above information doesn't help much, and the most current log would help, I can provide. It's not easy because this server is on an internal network (non-internet facing), and it's not easy to transfer to this site. Thanks for your input! 

Please provide us the logs birdman that would be of great help