Endpoint Protection

Seems like a popular topic. :-(

Can anyone decipher this log file and suggest why the client may be rolling back the install?

restoreSPState: called
restoreSPState: calling loadEventManagerDLLs
loadEventManagerDLLs: called
serviceIsRunning: OpenService FAILED with error 1060
LoadEvtMgrDll: ccEvtMgr is not running
serviceIsRunning: OpenService FAILED with error 1060
SendReload: ccEvtMgr is not running
loadEventManagerDLLs: FAILED to send reload event
loadEventManagerDLLs: exiting
restoreSPState: Changing service configuration to SERVICE_DEMAND START for SPBBCSvc
modifyServiceConfiguration: OpenService() FAILED with error 1060
restoreSPState: Unable to modify configuration for SPBBCSvc
restoreSPState: Value of szSPState "0"
restoreSPState: SPState is NOT set to 1. NOT Calling startSP
restoreSPState: exiting
MSI (s) (D0:F4) [16:54:28:182]: Executing op: ActionStart(Name=checkMSXMLVersion.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (D0:F4) [16:54:28:198]: Executing op: ActionStart(Name=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (D0:F4) [16:54:28:198]: Executing op: CustomActionRollback(Action=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,ActionType=1345,Source=BinaryData,Target=cleanupFolder,)
MSI (s) (D0:F0) [16:54:28:198]: Invoking remote custom action. DLL: C:\Windows\Installer\MSICAE4.tmp, Entrypoint: cleanupFolder
InstSymProtect::cleanupFolder() -> called
DeleteFolderIfNoFileExists: Driver file is not present.
DeleteFolder: FAILED to delete directory C:\Program Files\Common Files\Symantec Shared\SPBBC
DeleteFolderIfNoFileExists: SHDeleteFolder FAILED
InstSymProtect::cleanupFolder() -> DeleteFolderIfNoFileExists FAILED
MSI (s) (D0:F4) [16:54:28:213]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (D0:F4) [16:54:28:213]: Error in rollback skipped.    Return: 5
cleanupFolder:  exiting
MSI (s) (D0:F4) [16:54:28:260]: No System Restore sequence number for this installation.
MSI (s) (D0:F4) [16:54:28:260]: Unlocking Server
MSI (s) (D0:F4) [16:54:29:446]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 16:54:29: INSTALL. Return value 3.

Also in same log file:

MSIASSERT - 2010-07-08-16-53-52-037 : cc::StopServiceAndDepAtAnyCost(366) : Unable to openService ccSetMgr. Error=1060:
MSI (s) (D0:F4) [16:53:52:037]: Executing op: ActionStart(Name=InstallLiveUpdate_RB.FF07F38E_78C2_412E_B858_64488E808644,,)
MSIASSERT - StopCcSetMgrOnOverOrBrokenInstall: Unable to stop ccSetMgr:
MSI (s) (D0:F4) [16:53:52:037]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate_RB.FF07F38E_78C2_412E_B858_64488E808644,ActionType=3329,Source=BinaryData,Target=UnInstallLiveUpdate,CustomActionData=C:\Users\Bill\AppData\Local\Temp\OQDTVONO\LiveUpdate\lucheck.exe)
MSI (s) (D0:F4) [16:53:52:037]: Executing op: ActionStart(Name=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,,)
MSI (s) (D0:F4) [16:53:52:037]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,ActionType=3073,Source=BinaryData,Target=InstallLiveUpdate,CustomActionData=C:\Users\Bill\AppData\Local\Temp\OQDTVONO\LiveUpdate\lucheck.exe)
MSI (s) (D0:8C) [16:53:52:052]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3D94.tmp, Entrypoint: InstallLiveUpdate
LUCA: InstallLiveUpdate enter.
LUCA: C:\Users\Bill\AppData\Local\Temp\OQDTVONO\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 206
MSI (s) (D0:F4) [16:54:07:216]: User policy value 'DisableRollback' is 0
MSI (s) (D0:F4) [16:54:07:216]: Machine policy value 'DisableRollback' is 0
Action ended 16:54:07: InstallFinalize. Return value 3.

Thanks,

-Mike

Below articles are for the same error that is there is the above log.

Title: 'Symantec Endpoint Protection installation rolls back while upgrading'
Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009110712450848?Open&seg=ent
 
Title: 'Windows 7 / 2008 R2 - SEP Client installation rolls back.'
Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009110411364348?Open&seg=ent
 
Title: 'Symantec Endpoint Protection Client installation fails on LUCHECK 206'
Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2010012509092648?Open&seg=ent

'Symantec Endpoint Protection Client installation fails on LUCHECK 206'
  http://service1.symantec.com/support/ent-security.nsf/docid/2010012509092648?Open&seg=ent

Try this KB also
The installation of Symantec Endpoint Protection (SEP) client fails and rolls back around the point of registering with LiveUpdate

If  non of these docs helps pls provide us the full log and provide us more info like os....

This is on a an offsite machine running Vista. I will give these all a try and report back.

-Mike

Hello,

Please try this steps for Vista system.

Please take a backup of the registry before proceeding further.

Open Regisrty Editor

Browse to HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Select the Expandable String Value 'AppData' and change the value to : %USERPROFILE%\AppData\Roaming

Close the registry editor

Reboot the computer

Install SEP client

Let me know if this works???