Endpoint Protection

Howdy SEP gurus,
I have a couple of server (all W2K3 R2 SP2) under support showing exactly the problem as described.
At a certain point, looks always like almost done, it simply states performing roll back - ( just missing the smiley)
I also found this is related to LU but I did not find a solution for now.
What I found as well is that LU service is running and cannot be stopped or killed. I had to disable it and reboot but during the SEP install it was started again (even I installed LU prior to SEP) and here we are again.
Suggestions as shown on http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010012509092648did not solve the problem.
I’ve seen this mainly on WTS servers with Citrix installed.
SEP version is MU4 and MU5.
Not sure if that surprises you but SAV10 is still doing fine and can be installed without any issues.
To be honest, what I’m missing is a real clear error log of what is missing or what cannot be done – or is there an install flag for an advanced logging?
thx Hz.

Delete following folders if present
C:\Program Files\Symantec
C:\Program Files\Symantec AntiVirus
C:\Program Files\Common Files\Symantec Shared
C:\Documents and Settings\All Users\Application Data\Symantec
 
Also delete following reg keys
HKLM\Software\symantec
HKCU\Software\symantec
Install RU 6 and try..

If not helps pls provide us the SEP_inst.log which is present in %temp%

 
Please go to run and type %temp%
 
Look for a file called SEP_inst.log
 
In the log file look for return value 3  and paste 6-7 lines before that
 
We need all the instances for the Return value 3

that needs to wait until tomorrow (GMT+1) - they need the box now.
Btw. I run the SEP Support tool but it was unable to communicate with "Symantec Reputation Database" - on that server and on my client.
Any restrictions there?
thx
Hz

It is related to Internet connectivity.

"Symantec Reputation Database Integration for Load Point Analysis
The Reputation Database is a repository of file hashes compiled and maintained by Symantec Security Response. This database contains information about a large number of commonly seen files and applications, both legitimate and malicious. As of Build 1.0.2020, the Support Tool is able to verify the authenticity of files using the Reputation Database as a resource. This vastly increases the accuracy of the Support Tool's Load Point Analysis feature, and reduces the number of files that need to be manually investigated.

The Reputation Database check occurs any time a Load Point Analysis is run on a computer with an Internet connection. If there is no Internet connection, the Support Tool uses the standard Load Point Analysis."

Ref:About the Symantec Endpoint Protection Support Tool

hi,
here I am....
after some attempts I finally succeeded to have log file and here are the lines before the rollong back actions:

from log

LUCA: C:\DOCUME~1\hbtemp\LOCALS~1\Temp\RLLMFUMP\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 206
Action ended 3:49:13: InstallFinalize. Return value 3.

use this document

http://service1.symantec.com/support/ent-security.nsf/docid/2010012509092648

:-( sorry, the same result.
most of the recommendation were already done.
in order to configure permissions for LuComServer I installed LU only, rebooted adapted the permissions as suggested -rebooted again and run the setup as admin.
This is from the latest SEP_inst.log:
AgentMainCA: Copying C:\Source\library\Global Packages\Symantec Endpoint Protection 11.0.6005.440_32-bit\Windows\winsxs\vxgs54we.kj4\8.0.50727.762.cat to C:\DOCUME~1\hbtemp\LOCALS~1\Temp\ARESYCQY\Cache\Windows\winsxs\vxgs54we.kj4\8.0.50727.762.cat
AgentMainCA: Copying C:\Source\library\Global Packages\Symantec Endpoint Protection 11.0.6005.440_32-bit\Windows\winsxs\vxgs54we.kj4\8.0.50727.762.policy to C:\DOCUME~1\hbtemp\LOCALS~1\Temp\ARESYCQY\Cache\Windows\winsxs\vxgs54we.kj4\8.0.50727.762.policy
MSI (s) (60:E8) [05:44:00:170]: Executing op: ActionStart(Name=StopCcSetMgrOnOverOrBrokenInstall_R.D3A883B9_8F94_4E7D_96B6_852388CE5647,,)
Action 5:44:00: StopCcSetMgrOnOverOrBrokenInstall_R.D3A883B9_8F94_4E7D_96B6_852388CE5647.
MSI (s) (60:E8) [05:44:00:170]: Executing op: CustomActionSchedule(Action=StopCcSetMgrOnOverOrBrokenInstall_R.D3A883B9_8F94_4E7D_96B6_852388CE5647,ActionType=3329,Source=BinaryData,Target=_StopCcSetMgrOnOverOrBrokenInstall_Rol@4,)
MSI (s) (60:E8) [05:44:00:184]: Executing op: ActionStart(Name=StopCcSetMgrOnOverOrBrokenInstall.D3A883B9_8F94_4E7D_96B6_852388CE5647,,)
Action 5:44:00: StopCcSetMgrOnOverOrBrokenInstall.D3A883B9_8F94_4E7D_96B6_852388CE5647.
MSI (s) (60:E8) [05:44:00:184]: Executing op: CustomActionSchedule(Action=StopCcSetMgrOnOverOrBrokenInstall.D3A883B9_8F94_4E7D_96B6_852388CE5647,ActionType=3073,Source=BinaryData,Target=_StopCcSetMgrOnOverOrBrokenInstall@4,)
MSI (s) (60:A0) [05:44:00:198]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI80.tmp, Entrypoint: _StopCcSetMgrOnOverOrBrokenInstall@4
2010-07-21-05-44-00-323 : ccLib::CRegistry::Open(101) : RegOpenKeyEx() != ERROR_SUCCESS, Software\Symantec\InstalledApps, 0x00000002

if you have drives mapped, remove them and then run the install
are you able to install liveudpate sccessfully from cD1?

yes, installing LU from CD1 as well as from the package completed always successfully.
But... what I noticed, all of these servers having that issue ( at least the 4 I checked ) have issues with LU.
1. the LU service cannot be stopped ( only by killing or reboot )
2. opening "Symantec LiveUpdate" from "Start->Settings->Control Panel" comes up with an error message :
    "LiveUpdate could not access its settings. Error code: 0x80004002"
As SEP installation always failed after LU was installed this seems to be related to me.

any suggestions?

thx
Hz.

Troubleshooting Symantec AntiVirus Corporate Edition and Symantec Endpoint Protection installations: Checking rights and permissions

Not sure if this is your problem or not, but we had similar rollback issues.  The problem turned out to be we renamed our default application pool in IIS to something else.  Renaming these back to default did the trick.

Yes Mail Liw , that happens in case of SEPM , this is SEP client SEP install that is rolling back

Hi out there...
Believe  me or not, I found another reason for this crazy behavior..
The hint: Troubleshooting Symantec AntiVirus Corporate Edition and Symantec Endpoint Protection installations: Checking rights and permissions
Was close – but actually not the problem.

Anyway, it lead me to another DCOM issue and I found a solution here: http://www.eggheadcafe.com/forumarchives/windowsservergeneral/Oct2005/post24590405.asp

Registering ole32.dll and oleout32.dll did the trick.
From then on I could open the config screen for LU and install SEP (MU5) without any further issues.
This solution was verified on 3 servers meanwhile ( 10 of 3500 had that problem) and I do not expect any further issues ( crossing my fingers  )
I consider this problem solved.
Thanks everybody