Endpoint Protection

 View Only
Expand all | Collapse all

SEPM Won't Remotely Install Client

Migration User

Migration UserMay 19, 2010 04:07 PM

  • 1.  SEPM Won't Remotely Install Client

    Posted May 19, 2010 10:51 AM

    Hi all,

    A couple weeks (2?) Our SEPM stopped updating clients with new AV signatures. We have to do this manually due to the fact that we operate on a classified network and don't connect to the internet. Well when it stopped working, I attempted to "repair" the SEPM and I wasn't able to access it at all, so I re-installed Windows Server 2003 Standard x32 and IIS 6.0 in order to have a fresh, clean OS load for SEPM. I installed it with an embedded database and most default settings. When I log in and go to Clients>Fine Unmanged Computers I type in a specifific computer name (my test client) and it recognizes it. Type in my username and password info, double checking my password, select the Win64BIT install since the client is running XP x64, and click start installation. After about 3 minutes of thinking it fails. There is no real help in any of the Symantec or Windows logs on the server but on the client it is interesting...I get EVENT ID 540 for a Kerebos login, specifiying the server IP in the details, and then it immediately logs me out. The clients are on one vlan and the servers are on another, but the test client I am using can ping the SEPM server with IP and Hostname and vice versa, so basic connectivity is there. I'm running SEP11.0.4000.2295 and SEPM 11.0.4000.2295 Any help would be appreciated, and if I was too vauge or more details are needed, please let me know.


  • 2.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 10:54 AM
    Running the support tool on the machine maybe beneficial in finding an issue. http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008071709480648


  • 3.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 11:05 AM

    pLease go to run and type %temp%

    Look for a file called SEP_inst.log

    In the log file look for return value 3  and paste 6-7 lines before that

    We need all the instances for the Return value 3


  • 4.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 11:37 AM

    That's almost a 6MB text file, could you be a little more specific with what you need? I guess what I'm trying to say is I'm not terribly familiar with what you're looking for.


  • 5.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 11:42 AM

    Search the SEP_inst.log file for "Value 3"
    When you find it, copy and paste 6-7 lines that are listed before the line that says "Value 3"

    The log may have a few different lines that say "Value 3", so make sure to copy all of them.

    You can paste the lines into a new .TXT doc and attach it to a post here, or if they're not terribly long, just post them straight into the post.


  • 6.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 11:50 AM

    As I said before, it's on a classified network so I'm going to have to hand jam them...


  • 7.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 12:03 PM
    MSI (S) (C8:74) [15:42:57:677]: PROPERTY CHANGE: ADDING PRIVILEGED PROPERTY. IT'S VALUE IS '1'.
    MSI (S) (C8:74) [15:42:57:677]: NOTE: 1: 1402 2: HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\MS SETUP\  (ACME)\USER INFO 3: 2
    MSI (S) (C8:74) [15:42:57:677]: PROPERTY CHANGE: ADDING USERNAME PROPERTY. IT'S VALUE IS 'NGA'.
    MSI (S) (C8:74) [15:42:57:677]: NOTE: 1: 1402 2: HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\MS SETUP\  (ACME)\USER INFO 3: 2
    MSI (S) (C8:74) [15:42:57:677]: PROPERTY CHANGE: ADDING COMPANY PROPERTY. IT'S VALUE IS 'II'.
    MSI (S) (C8:74) [15:42:57:677]: PROPERTY CHANGE: ADDING DATABASE PROPERTY. IT'S VALUE IS 'C:\WINDOWS\INSTALLER\63F49FMSI'.
    MSI (S) (C8:74) [15:42:57:677]: PROPERTY CHANGE: ADDING ORIGINALDATABASE PROPERTY. IT'S VALUE IS 'C:\DOCUME~1\USERNAME\LOCALS~1\TEMP\1\SYMANTEC\SYMANTEC ANTIVIRUS.MSI'.
    MSI (S) (C8:74) [15:42:57:677]: NOTE: 1: 2205 2: 3: PATCHPACKAGE
    MSI (S) (C8:74) [15:42:57:677]: MACHINE POLICY VALUE 'DISABLEROLLBACK' IS 0
    MSI (S) (C8:74) [15:42:57:677]: USER POLICY VALUE 'DISABLEROLLBACK' IS 0

    That's the first one...



  • 8.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 12:13 PM
    This doesn't look like the first Return value 3..if possible can you attach the full log.


  • 9.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 12:44 PM

    but I can't move a text file from a classified system to an unclassified system, but I assure you that's the first 7 lines before the first return value 3.


  • 10.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 01:19 PM

    Let me add this...the Group Policy wasn't applied to either machine (server or test client) and it was working, when GPO was applied is when it stopped. I suspected it to be an NTLM issue considering the weird log in/out logs on the client, but have tried every possible combo to get it to work. Is there a group policy setting that anyone knows of that directly affects SEPM communications with clients?


  • 11.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 02:10 PM
    Well..Have you tried installing manually.
    Export the client package , copy it to the XP64 bit machine and launch Setup.exe then check what message you get.


  • 12.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 03:10 PM

    It installed fine manually, I'm just unable to manage it from the server. I have to do all of my virus updates manually.


  • 13.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 03:39 PM
    Well that's good, then... You're over the hump, at least. Getting the client hooked up to the server is easy...

    Just follow the steps in this doc...
    http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008110714513748


  • 14.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 03:48 PM
    If you install it using the exported package from SEPM then it will automatically become managed.




  • 15.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 04:01 PM
    Thanks Ryan, I'm starting to see a light at the end of the tunnel....one question is, does it matter if the communications settings are x32 or x64? All of my clients are x64 and I have that install package assigned to that "group" in SEPM, but when I go to export them, the default filename is "Server_32-bit".


  • 16.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 04:05 PM
    sylink file only contains communication info it does not matter what OS it is or whether its 32 or 64 bit OS.


  • 17.  RE: SEPM Won't Remotely Install Client

    Posted May 19, 2010 04:07 PM
    Thanks Vikram. I'll try it out.


  • 18.  RE: SEPM Won't Remotely Install Client

    Posted May 20, 2010 09:56 AM
    Thanks everybody, I got it working. Cross my fingers so it stays working.


  • 19.  RE: SEPM Won't Remotely Install Client

    Posted May 20, 2010 12:07 PM

    It's still a problem that I can't remotely install the client. I'm not able to use the product to it's full capability.


  • 20.  RE: SEPM Won't Remotely Install Client

    Posted May 20, 2010 01:35 PM
    If you are able to install locally but not remotely..then it might be some network problem..
    However if it is problem with the client then we can check the install log of few clients..to determine why is it failing.

    However Make sure UAC is off on the OS like Vista, Win2k8 and WIn7


  • 21.  RE: SEPM Won't Remotely Install Client

    Posted May 20, 2010 01:38 PM
    That's the thing, I am able to ping both ways with hostname and ip, so physical network isn't the issue...that's why I asked earlier if anyone was aware of any GPO settings that could affect communication?


  • 22.  RE: SEPM Won't Remotely Install Client
    Best Answer

    Posted May 20, 2010 01:47 PM
    Well..You should try Migration and Deployment Wizard aswell..As I am not sure but there was some problem with Find Unmanaged and 64 bit machines in older versions.

    So Using a RU5 or RU6a should give you better results.