Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEP Unmanaged Client Install (12.1.4) on XP - Clean Install Fails (Rollback)

Created: 19 Apr 2014 • Updated: 20 Apr 2014 | 18 comments

Trying to troubleshoot with what seems to be a fairly common issue with installing the client software throughout different versions.

I am trying to install SEP 12.1.4 unmanaged client on a workstation running Windows XP Professional. During installation, when it looks like it is about to complete installation, it pauses, and then rolls backs. It seems to be more a problem with users upgrading from a different version. However, this workstation is a fresh install, nothing pre-loaded except system drivers. Thus, installation of SEP 12.1.4 is the first on this machine.

I've created a package in SEPM for a 32-bit unmanaged client with "Add to Start Menu" unchecked as been mentioned in other threads. No dice.

Saw some other threads about registry edits like the AppData and PendingFileRenameOperations but the folder paths in those are related to Windows Vista/7/8

I'd appreciate any help in pointing me in the right direction to find a solution to this problem.

I've attached the Install Log as requested for review.

Thanks.

Edit 1: No luck with finding the SIS_INST.LOG file in the location as described. There was some leftover files from the failed installation but no log files.

The only other log file I could find from troubeshooting thread was the SETUPAPI.LOG in the C:\Windows folder (see attached)

Edit 2:

Looking at the SEP Log, I see there are a few entries that show a Value 3:

 

ScriptGen: ShowServiceProgress() MSIRUNMODE_SCHEDULED
ScriptGen: ShowServiceProgress() calling WaitForSingleObject(scriptStarted) ...
ScriptGen: ShowServiceProgress() WaitForSingleObject(scriptStarted) returned WAIT_TIMEOUT
ScriptGen: ShowServiceProgress() Look for timeout starting SepMasterService or other failure loading SIS.dll.
ScriptGen: CancelInstallation() instructed SIS to rollback
ScriptGen: ShowServiceProgress() returning early due to previous error.
MSI (s) (A8:F8) [23:08:00:305]: User policy value 'DisableRollback' is 0
MSI (s) (A8:F8) [23:08:00:305]: Machine policy value 'DisableRollback' is 0
Action ended 23:08:00: InstallFinalize. Return value 3.

 

Communicate RB:  calling communicate state with the following arguments:
Communicate RB: Prodversion = 12.1.4100.4126
Communicate RB: PathToSylink = C:\DOCUME~1\RAdmin\LOCALS~1\Temp\Symantec\
Communicate RB: Oldversion =
Communicate RB: ReasonStr =
Communicate RB: StatusCode = 302469120
MSI (s) (A8:F8) [23:09:17:868]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (A8:F8) [23:09:17:868]: Error in rollback skipped.    Return: 5
Communicate RB: Communicator failed to communicate.
MSI (s) (A8:F8) [23:09:17:868]: Calling SRSetRestorePoint API. dwRestorePtType: 13, dwEventType: 103, llSequenceNumber: 9, szDescription: "".
MSI (s) (A8:F8) [23:09:17:883]: The call to SRSetRestorePoint API succeeded. Returned status: 0.
MSI (s) (A8:F8) [23:09:17:883]: Unlocking Server
MSI (s) (A8:F8) [23:09:17:883]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 23:09:17: INSTALL. Return value 3.

 

MSI (s) (A8:F8) [23:09:18:071]: Note: 1: 1708
MSI (s) (A8:F8) [23:09:18:071]: Product: Symantec Endpoint Protection -- Installation operation failed.

MSI (s) (A8:F8) [23:09:18:149]: Cleaning up uninstalled install packages, if any exist
MSI (s) (A8:F8) [23:09:18:149]: MainEngineThread is returning 1603
MSI (s) (A8:C0) [23:09:18:258]: Destroying RemoteAPI object.
MSI (s) (A8:B4) [23:09:18:258]: Custom Action Manager thread ending.
=== Logging stopped: 4/19/2014  23:09:18 ===
MSI (c) (18:28) [23:09:18:274]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (18:28) [23:09:18:274]: MainEngineThread is returning 1603
=== Verbose logging stopped: 4/19/2014  23:09:18 ===

Operating Systems:

Comments 18 CommentsJump to latest comment

dakata24's picture

Where can i find that file. It wasnt in the %Temp% folder nor was I able to locate it when I did a search.

James007's picture

Have you try Clean wipe tool ?

First you can try clean wipe tool and again try to install.

Latest version of CleanWipe is available 12.1.4013.4013 in

Symantec_Endpoint_Protection_12.1.4_Part2_Tools_EN\CleanWipe on file connect

https://symantec.flexnetoperations.com/control/symc/registeranonymouslicensetoken

dakata24's picture

I downloaded the latest install packages and tried running CleanWipe (version 12.1.4100.4126) but get the following error message:

Failed to initialize SEPRemovalToolNative. WaitForSingleObject returned 258. Last error: 0.

The CleanWipe log says: FATAL  Parent is not trusted.

James007's picture

Does do you have try local admin account ?

You can find SIS_INST.LOG

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.XXXX\Data\Install\Logs

 

dakata24's picture

Yes, this was installed with the default admin account.

No luck with the SIS log file. The only other log file I could find on the system was the setupapi (attached)

AttachmentSize
setupapi_log.txt 279.76 KB
.Brian's picture

For ref:

What logs do I need to gather in order to troubleshoot a failed SEP 12.1 client installation?

Did you find the SIS_INST.log file?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

James007's picture

See this articles

  • Install of the Symantec Endpoint Protection Manager fails with a return code 3 in SEPM_INST.log

Symantec Endpoint Protection Manager installation rolls back.

Article:TECH104408  | Created: 2008-01-17  | Updated: 2014-04-11  | Article URL http://www.symantec.com/docs/TECH104408
Sumit G's picture

Check the article

SEP client installation rolls back at creating install cache.

Article:TECH167813  |  Created: 2011-08-23  |  Updated: 2012-06-05  |  Article URL http://www.symantec.com/docs/TECH167813

--Edit--

Symantec Endpoint Protection 12.1 client install rolls back, returning 1603

Article:TECH170259  |  Created: 2011-09-23  |  Updated: 2011-12-07  |  Article URL http://www.symantec.com/docs/TECH170259

Regards

Sumit G.

subodhskale's picture

Hi.

 

My symantec setup 12.1.4 getting roll back on windows server 2003 SP2. i tried many things but still not working.

AttachmentSize
SIS_INST.rar 188.28 KB
.Brian's picture

Primary Solution:

  1. In the registry, navigate to:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\

2. Back up the registry key.

3. Delete the PendingFileRenameOperations registry value from the right pane.

4. Install the software without restarting the computer first (Restarting the computer may result in the registry key being placed back in the registry before installation.)

5. Restore the registry key from the backup location.

Note: If you do not find the PendingFileRenameOperations registry value in the location above, this error message can be generated if the PendingFileRenameOperations registry value exists in the following location(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentSetXXX\Control\SessionManager\

Secondary Solution:

1. Look at the registry value to see what applications are pending.

2. In the registry, navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\PendingFileRenameOperations

3. Locate all entries with a status of "Pending."

4. Rename the value of that entry, placing a "2" on the end of PendingFileRenameOperations.

5. Restart the computer.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Sumit G's picture

Communicate LC: NOT VersionNT64=1

Communicate LC: NOT Version9X=1
Communicate LC: VersionNT > 500=1
Communicate LC: NOT WINDOWSFUNDAMENTALS=1
Communicate LC: (NOT MIGRATIONPENDINGREBOOT) OR SISFAILED=1
Communicate LC: (NOT UNINSTALLREBOOTREQUIRED) OR Installed=0
Communicate LC: Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
Communicate LC:  calling communicate state with the following arguments:
Communicate LC: Prodversion = 12.1.4112.4156

Below article applied for your attach error sep_inst logs

Symantec Endpoint Protection Client installation failed: error ""Pending system changes that require a reboot have been detected" "

Article:TECH208775  |  Created: 2013-07-19  |  Updated: 2013-08-02  |  Article URL http://www.symantec.com/docs/TECH208775

Regards

Sumit G.

peterjin's picture

I have been unable to install Symantec endpoint protection 12.1.4112.4156 on Windows Server 2008R2 x64 bit system as the installation rollbacks. I used to windows installer to remove live update and previous version of Symantec endpoint version 11. I have imported the certificates as stated on previous threads and it does NOT resolve my issues.  I am attaching the sep__inst log and any help would be greatly appreciated!

Thanks,

Peter

AttachmentSize
SEP_INST.txt 3.19 MB
.Brian's picture
ScriptGen: ShowServiceProgress() WaitForSingleObject(scriptStarted) returned WAIT_TIMEOUT
ScriptGen: ShowServiceProgress() Look for timeout starting SepMasterService or other failure loading SIS.dll.
ScriptGen: CancelInstallation() instructed SIS to rollback
ScriptGen: ShowServiceProgress() returning early due to previous error.
CustomAction ShowServiceProgress returned actual error code 1603 (note this may
 not be 100% accurate if translation happened inside sandbox)

 

This points to the cert issue:

http://www.symantec.com/docs/TECH218029
http://www.symantec.com/docs/TECH217284

You can always try cleanwipe as well

 

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

peterjin's picture

I have read both documents in your link, and AGAIN, I have confirmed both certificates have been installed to the correct folders as suggested and still receive this errror and also now error 1920, Service symantec migration service failed to start, even though I am logged in as a domain admin.

.Brian's picture

Best to open a support case then

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Rafeeq's picture

12.1.5 is out, did you try installing that as well?