Video Screencast Help

SEP Unmanaged Client Install (12.1.4) on XP - Clean Install Fails (Rollback)

Created: 20 Apr 2014 • Updated: 20 Apr 2014 | 10 comments

Trying to troubleshoot with what seems to be a fairly common issue with installing the client software throughout different versions.

I am trying to install SEP 12.1.4 unmanaged client on a workstation running Windows XP Professional. During installation, when it looks like it is about to complete installation, it pauses, and then rolls backs. It seems to be more a problem with users upgrading from a different version. However, this workstation is a fresh install, nothing pre-loaded except system drivers. Thus, installation of SEP 12.1.4 is the first on this machine.

I've created a package in SEPM for a 32-bit unmanaged client with "Add to Start Menu" unchecked as been mentioned in other threads. No dice.

Saw some other threads about registry edits like the AppData and PendingFileRenameOperations but the folder paths in those are related to Windows Vista/7/8

I'd appreciate any help in pointing me in the right direction to find a solution to this problem.

I've attached the Install Log as requested for review.


Edit 1: No luck with finding the SIS_INST.LOG file in the location as described. There was some leftover files from the failed installation but no log files.

The only other log file I could find from troubeshooting thread was the SETUPAPI.LOG in the C:\Windows folder (see attached)

Edit 2:

Looking at the SEP Log, I see there are a few entries that show a Value 3:


ScriptGen: ShowServiceProgress() MSIRUNMODE_SCHEDULED
ScriptGen: ShowServiceProgress() calling WaitForSingleObject(scriptStarted) ...
ScriptGen: ShowServiceProgress() WaitForSingleObject(scriptStarted) returned WAIT_TIMEOUT
ScriptGen: ShowServiceProgress() Look for timeout starting SepMasterService or other failure loading SIS.dll.
ScriptGen: CancelInstallation() instructed SIS to rollback
ScriptGen: ShowServiceProgress() returning early due to previous error.
MSI (s) (A8:F8) [23:08:00:305]: User policy value 'DisableRollback' is 0
MSI (s) (A8:F8) [23:08:00:305]: Machine policy value 'DisableRollback' is 0
Action ended 23:08:00: InstallFinalize. Return value 3.


Communicate RB:  calling communicate state with the following arguments:
Communicate RB: Prodversion = 12.1.4100.4126
Communicate RB: PathToSylink = C:\DOCUME~1\RAdmin\LOCALS~1\Temp\Symantec\
Communicate RB: Oldversion =
Communicate RB: ReasonStr =
Communicate RB: StatusCode = 302469120
MSI (s) (A8:F8) [23:09:17:868]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (A8:F8) [23:09:17:868]: Error in rollback skipped.    Return: 5
Communicate RB: Communicator failed to communicate.
MSI (s) (A8:F8) [23:09:17:868]: Calling SRSetRestorePoint API. dwRestorePtType: 13, dwEventType: 103, llSequenceNumber: 9, szDescription: "".
MSI (s) (A8:F8) [23:09:17:883]: The call to SRSetRestorePoint API succeeded. Returned status: 0.
MSI (s) (A8:F8) [23:09:17:883]: Unlocking Server
MSI (s) (A8:F8) [23:09:17:883]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 23:09:17: INSTALL. Return value 3.


MSI (s) (A8:F8) [23:09:18:071]: Note: 1: 1708
MSI (s) (A8:F8) [23:09:18:071]: Product: Symantec Endpoint Protection -- Installation operation failed.

MSI (s) (A8:F8) [23:09:18:149]: Cleaning up uninstalled install packages, if any exist
MSI (s) (A8:F8) [23:09:18:149]: MainEngineThread is returning 1603
MSI (s) (A8:C0) [23:09:18:258]: Destroying RemoteAPI object.
MSI (s) (A8:B4) [23:09:18:258]: Custom Action Manager thread ending.
=== Logging stopped: 4/19/2014  23:09:18 ===
MSI (c) (18:28) [23:09:18:274]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (18:28) [23:09:18:274]: MainEngineThread is returning 1603
=== Verbose logging stopped: 4/19/2014  23:09:18 ===

Operating Systems:

Comments 10 CommentsJump to latest comment

dakata24's picture

Where can i find that file. It wasnt in the %Temp% folder nor was I able to locate it when I did a search.

James007's picture

Have you try Clean wipe tool ?

First you can try clean wipe tool and again try to install.

Latest version of CleanWipe is available 12.1.4013.4013 in

Symantec_Endpoint_Protection_12.1.4_Part2_Tools_EN\CleanWipe on file connect

dakata24's picture

I downloaded the latest install packages and tried running CleanWipe (version 12.1.4100.4126) but get the following error message:

Failed to initialize SEPRemovalToolNative. WaitForSingleObject returned 258. Last error: 0.

The CleanWipe log says: FATAL  Parent is not trusted.

James007's picture

Does do you have try local admin account ?

You can find SIS_INST.LOG

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.XXXX\Data\Install\Logs


dakata24's picture

Yes, this was installed with the default admin account.

No luck with the SIS log file. The only other log file I could find on the system was the setupapi (attached)

setupapi_log.txt 279.76 KB
.Brian's picture

For ref:

What logs do I need to gather in order to troubleshoot a failed SEP 12.1 client installation?

Did you find the SIS_INST.log file?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

James007's picture

See this articles

  • Install of the Symantec Endpoint Protection Manager fails with a return code 3 in SEPM_INST.log

Symantec Endpoint Protection Manager installation rolls back.

Article:TECH104408  | Created: 2008-01-17  | Updated: 2014-04-11  | Article URL
Sumit G's picture

Check the article

SEP client installation rolls back at creating install cache.

Article:TECH167813  |  Created: 2011-08-23  |  Updated: 2012-06-05  |  Article URL


Symantec Endpoint Protection 12.1 client install rolls back, returning 1603

Article:TECH170259  |  Created: 2011-09-23  |  Updated: 2011-12-07  |  Article URL


Sumit G.