Endpoint Protection

I have a w7 machine 32 bit that I installed SEP on. It immedialty quit updating and was giving me the BSOD and rebooting multiple times weekly, the event was symevent. I uninstalled the SEP, and tried to reinstall and always get the installation was interupted before it could complete and it rolls back the install. I edited the registry but cannot remember the key I had found in a knowledge base article to delete. That did not help. I have asked our AV expert to help me but for 6 weeks get no response other than to run clean wipe and reinstall. I have done that atleast 6 times. I called Dell as my coputer which is only 4 months old to help - they asked for a consult between myself and Symantec, but needed the customer number and contact info for our business which AV expert will not provide. Needless to say I have been without AV for 6 weeks and cannot resolve this issue. Any ideas would be greatly appreciated, I am uncomfortable running AV in a large corporation unprotected. Thanks in advance.

Hi

Can i know which version of SEP you are installing?

Did u get any error message when its rolling back?

Collect the sep_inst log from this location

start -run - type %temp%

look for SEP_INST.log

do a search for "return value 3"

paste 10 lines above and below of return value 3 , lets see why its rolling back..
 

Ver 11.0.5 - no error message per se, only the symantec error of the install wa sinterupted and then it rolls back.  I have also tried to install LU by itself before the SEP but get same results no matter what I try.

Action 14:38:55: InstallLiveUpdate_RB.FF07F38E_78C2_412E_B858_64488E808644.
MSI (s) (E8:C8) [14:38:55:433]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate_RB.FF07F38E_78C2_412E_B858_64488E808644,ActionType=3329,Source=BinaryData,Target=UnInstallLiveUpdate,CustomActionData=C:\Users\Kim\AppData\Local\Temp\ICDBFQCL\LiveUpdate\lucheck.exe)
MSI (s) (E8:C8) [14:38:55:433]: Executing op: ActionStart(Name=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,,)
Action 14:38:55: InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644.
MSI (s) (E8:C8) [14:38:55:433]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,ActionType=3073,Source=BinaryData,Target=InstallLiveUpdate,CustomActionData=C:\Users\Kim\AppData\Local\Temp\ICDBFQCL\LiveUpdate\lucheck.exe)
MSI (s) (E8:40) [14:38:55:433]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI13E2.tmp, Entrypoint: InstallLiveUpdate
LUCA: InstallLiveUpdate enter.
LUCA: C:\Users\Kim\AppData\Local\Temp\ICDBFQCL\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 206
CustomAction InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 14:38:56: InstallFinalize. Return value 3.
MSI (s) (E8:C8) [14:38:56:712]: User policy value 'DisableRollback' is 0
MSI (s) (E8:C8) [14:38:56:712]: Machine policy value 'DisableRollback' is 0
MSI (s) (E8:C8) [14:38:56:712]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1023374553,LangId=1033,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
MSI (s) (E8:C8) [14:38:56:712]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (E8:C8) [14:38:56:712]: Executing op: DialogInfo(Type=1,Argument=Symantec Endpoint Protection)
MSI (s) (E8:C8) [14:38:56:712]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
Action 14:38:56: Rollback. Rolling back action:
Rollback: InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644

1. C:\Program Files\Symantec  just delete all file or subfolder.
2. C:\Program Files\Common Files\Symantec Shared see any file or subfolder just delete .
3. C:\Documents and Settings\All Users\Application Data\Symantec and delete LiveUpdate (if present).
4.  Type in Search Symantec delete all files realted to Symantec (select the hidden option when search)
5. Delete that key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations ( Make sure that your user account has permissions to this key)

 

restart the machine
Start install of Symantec Endpoint Protection Unmange Client.

Hi

Delete following folders if present
C:\Program Files\Symantec
C:\Program Data\Symantec
C:\Program Files\Symantec AntiVirus
C:\Program Files\Common Files\Symantec Shared
 C:\ProgramData\All Users\Symantec 
 
Also delete following reg keys
HKLM\Software\symantec
HKCU\Software\symantec

and  follow the step in this article

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/5c45f3798fdd78e3492575d7001f71c3?OpenDocument
.
Let me know the status.

It still did not install, I still got same roll back message. 

Hi Kim

this is the error that you are getting

LUCA: C:\Users\Kim\AppData\Local\Temp\ICDBFQCL\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 206

Follow this

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/4ada575b3caa7a19882576b6005e3c9a?OpenDocument

Brilliant!  I am forwarding this off to our AV Specialist, I had heard that onle of our other techs has this issue on her server as well.

THANK YOU SO MUCH!

Hi Kim,

After deleting all the liveupdate folders as suggested first try to install install the liveupdate first & then try to install the client. you can also try to download the liveupdate version 3.5 from the Ftp.symantec.com.  >Public > english Us canada > Liveupdate > LU3.5

Install Liveupdate .
  Open Control Panel and try to open symantec liveupdate ( Start--Control Panel--Symantec Liveupdate) will get Error code starting with 0x.....
  Open control panel and open Administrative Tool double click on Component Services.  or Start--run- and type DCOMCNFG and hit Enter
  Double click on computers and my computers and then double click on DCOM cnfig and check for LuComServer.
 Right click on Lucomserver go to properties and then click on Identity Tab
 Change from system account to This User and mention the local admin account with the credentials click apply and then ok.
should be able to open symantec liveupdate from control panel
Open registry (Start--Run--regedit)
Go to this location HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager and clean the value from the PendingFileRenameOperations
Restart the Machine and Run the Set up file should be able to install the sep client

Hi Kim,

Let me know whether the solution worked for you..