Endpoint Protection

We are deploying SEP to new Windows 10 machines through GPO. For some reason, when it tries to install, it fails. We are using version 12.1.6608.6300.105.

The only way that I've found to get it to install correctly is to completely reimage the machine. Looking in event viewer, I see:

"The description for Event ID 35 from source Symantec Endpoint Protection cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

SepMasterService

the message resource is present but the message is not found in the string/message table"

I also see event id 34, 36, and 37 associated with it.

This was fixed in the latest version that just came out, 12.1.6 MP4:

SEP client does not install after applying Microsoft patch KB3140743

FIX ID: 3919824

Symptom: After applying the Microsoft patch Cumulative Update for Windows 10 Version 1511 (KB3140743), released March 1st, 2016, the Symantec Endpoint Protection client does not install, and then rolls back.

Solution: Fixed the interaction with Windows Defender to ensure that the installer succeeds.

http://www.symantec.com/docs/INFO3517

If you can't upgrade to 12.1.6 MP4 then try disabling Windows Defender and removing the above mentioned patch.

Unable to install Endpoint Protection client on Windows 10 after applying MS KB3140743

Well, the Windows 10 image we use only contains updates up to January 2016 and that looks like a March 2016 update. Do you know of any January updates that would create this issue?

None that I'm aware of. Check the %temp% directory for a SEP_INST.log file. This should show was caused the issue. Search for 'retun value 3' and 15-20 lines above should reveal more info.