Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Symantec Endpoint Protection 12.1.2 rolling back during install

Created: 19 Mar 2013 • Updated: 09 May 2013 | 19 comments
This issue has been solved. See solution.

Hello. I have a user that previously had 12.1.1 installed, performed a system restore, I believe corrupted the SEP installation, and I have had trouble re-installing 12.1.2 on the system. The installation gets to the very end and then rolls back the install. I've tried running cleanwipe several times, removing registry keys manually as well as the symantec folders on the C:\ drive. I can't seem to figure out why it keeps failing. I'm assuming I"m missing something somewhere.

Cleanwipe though usually solved the issues by removing everything. Does anyone have any thoughts on this???

Comments 19 CommentsJump to latest comment

.Brian's picture

Please post the SEP_INST.log file here for review

It will be located in the %temp% directory.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Velocity2089's picture
=== Verbose logging started: 3/15/2013  18:10:39  Build type: SHIP UNICODE 5.00.7601.00  Calling process: C:\Windows\system32\msiexec.exe ===
MSI (c) (D0:A0) [18:10:39:302]: Resetting cached policy values
MSI (c) (D0:A0) [18:10:39:302]: Machine policy value 'Debug' is 0
MSI (c) (D0:A0) [18:10:39:302]: ******* RunEngine:
           ******* Product: C:\Windows\Temp\Symantec\Sep64.msi
           ******* Action: 
           ******* CommandLine: **********
MSI (c) (D0:A0) [18:10:39:302]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (D0:A0) [18:10:39:302]: Grabbed execution mutex.
MSI (c) (D0:A0) [18:10:39:333]: Cloaking enabled.
MSI (c) (D0:A0) [18:10:39:333]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (D0:A0) [18:10:39:333]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (F0:CC) [18:10:39:348]: Running installation inside multi-package transaction C:\Windows\Temp\Symantec\Sep64.msi
MSI (s) (F0:CC) [18:10:39:348]: Grabbed execution mutex.
MSI (s) (F0:28) [18:10:39:348]: Resetting cached policy values
MSI (s) (F0:28) [18:10:39:348]: Machine policy value 'Debug' is 0
MSI (s) (F0:28) [18:10:39:348]: ******* RunEngine:
           ******* Product: C:\Windows\Temp\Symantec\Sep64.msi
           ******* Action: 
           ******* CommandLine: **********
MSI (s) (F0:28) [18:10:39:348]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (F0:28) [18:10:39:348]: SRSetRestorePoint skipped for this transaction.
MSI (s) (F0:28) [18:10:39:364]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 
MSI (s) (F0:28) [18:10:39:364]: File will have security applied from OpCode.
MSI (s) (F0:28) [18:10:39:364]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\Windows\Temp\Symantec\Sep64.msi' against software restriction policy
MSI (s) (F0:28) [18:10:39:364]: SOFTWARE RESTRICTION POLICY: C:\Windows\Temp\Symantec\Sep64.msi has a digital signature
MSI (s) (F0:28) [18:10:39:364]: SOFTWARE RESTRICTION POLICY: C:\Windows\Temp\Symantec\Sep64.msi is permitted to run because the user token authorizes execution (system or service token).
MSI (s) (F0:28) [18:10:39:364]: End dialog not enabled
MSI (s) (F0:28) [18:10:39:364]: Original package ==> C:\Windows\Temp\Symantec\Sep64.msi
MSI (s) (F0:28) [18:10:39:364]: Package we're running from ==> C:\Windows\Installer\903786.msi
MSI (s) (F0:28) [18:10:39:380]: APPCOMPAT: Compatibility mode property overrides found.
MSI (s) (F0:28) [18:10:39:380]: APPCOMPAT: looking for appcompat database entry with ProductCode '{C2103AF2-E66C-446B-9791-9207840EC821}'.
MSI (s) (F0:28) [18:10:39:380]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (F0:28) [18:10:39:380]: MSCOREE not loaded loading copy from system32
MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'TransformsSecure' is 0
MSI (s) (F0:28) [18:10:39:380]: User policy value 'TransformsAtSource' is 0
MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'DisablePatch' is 0
MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'AllowLockdownPatch' is 0
MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'DisableLUAPatching' is 0
MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (s) (F0:28) [18:10:39:380]: APPCOMPAT: looking for appcompat database entry with ProductCode '{C2103AF2-E66C-446B-9791-9207840EC821}'.
MSI (s) (F0:28) [18:10:39:380]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (F0:28) [18:10:39:380]: Transforms are not secure.
MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Windows\TEMP\SEP_INST.LOG'.
MSI (s) (F0:28) [18:10:39:380]: Command Line: REBOOT=ReallySuppress SRCLICFILE=EE CURRENTDIRECTORY=C:\Windows\TEMP\Symantec CLIENTUILEVEL=3 CLIENTPROCESSID=5584 
MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{FCBCA23E-67D3-469D-9B7C-03580B8BC8B5}'.
MSI (s) (F0:28) [18:10:39:380]: Product Code passed to Engine.Initialize:           ''
MSI (s) (F0:28) [18:10:39:380]: Product Code from property table before transforms: '{C2103AF2-E66C-446B-9791-9207840EC821}'
MSI (s) (F0:28) [18:10:39:380]: Product Code from property table after transforms:  '{C2103AF2-E66C-446B-9791-9207840EC821}'
MSI (s) (F0:28) [18:10:39:380]: Product not registered: beginning first-time install
MSI (s) (F0:28) [18:10:39:380]: Product {C2103AF2-E66C-446B-9791-9207840EC821} is not managed.
MSI (s) (F0:28) [18:10:39:380]: MSI_LUA: Credential prompt not required, user is an admin
MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
MSI (s) (F0:28) [18:10:39:380]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (F0:28) [18:10:39:380]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (F0:28) [18:10:39:380]: Adding new sources is allowed.
MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
MSI (s) (F0:28) [18:10:39:380]: Package name extracted from package path: 'Sep64.msi'
MSI (s) (F0:28) [18:10:39:380]: Package to be registered: 'Sep64.msi'
MSI (s) (F0:28) [18:10:39:380]: Note: 1: 2262 2: AdminProperties 3: -2147287038 
MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'DisableMsi' is 0
MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (F0:28) [18:10:39:380]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (F0:28) [18:10:39:380]: Product installation will be elevated because user is admin and product is being installed per-machine.
MSI (s) (F0:28) [18:10:39:380]: Running product '{C2103AF2-E66C-446B-9791-9207840EC821}' with elevated privileges: Product is assigned.
MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding SRCLICFILE property. Its value is 'EE'.
MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\Windows\TEMP\Symantec'.
MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '5584'.
MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
MSI (s) (F0:28) [18:10:39:380]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
MSI (s) (F0:28) [18:10:39:380]: TRANSFORMS property is now: 
MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
MSI (s) (F0:28) [18:10:39:380]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Favorites
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Documents
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Local
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Pictures
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Desktop
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts
MSI (s) (F0:28) [18:10:39:395]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 
MSI (s) (F0:28) [18:10:39:395]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (s) (F0:28) [18:10:39:395]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (s) (F0:28) [18:10:39:395]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (s) (F0:28) [18:10:39:395]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
MSI (s) (F0:28) [18:10:39:395]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'admin'.
MSI (s) (F0:28) [18:10:39:395]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
MSI (s) (F0:28) [18:10:39:395]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Windows\Installer\903786.msi'.
MSI (s) (F0:28) [18:10:39:395]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\Windows\Temp\Symantec\Sep64.msi'.
MSI (s) (F0:28) [18:10:39:395]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (s) (F0:28) [18:10:39:395]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
MSI (s) (F0:28) [18:10:39:411]: Note: 1: 2205 2:  3: PatchPackage 
MSI (s) (F0:28) [18:10:39:411]: Machine policy value 'DisableRollback' is 0
MSI (s) (F0:28) [18:10:39:411]: User policy value 'DisableRollback' is 0
MSI (s) (F0:28) [18:10:39:411]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
=== Logging started: 3/15/2013  18:10:39 ===
MSI (s) (F0:28) [18:10:39:411]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
MSI (s) (F0:28) [18:10:39:411]: Doing action: INSTALL
Action start 18:10:39: INSTALL.
MSI (s) (F0:28) [18:10:39:411]: Running ExecuteSequence
MSI (s) (F0:28) [18:10:39:411]: Doing action: Check32BitSupport
MSI (s) (F0:AC) [18:10:39:894]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI37B5.tmp, Entrypoint: Check32BitSupport
MSI (s) (F0:24) [18:10:39:894]: Generating random cookie.
MSI (s) (F0:24) [18:10:39:910]: Created Custom Action Server with PID 6864 (0x1AD0).
MSI (s) (F0:DC) [18:10:39:926]: Running as a service.
MSI (s) (F0:DC) [18:10:39:926]: Hello, I'm your 32bit Elevated custom action server.
MSI (s) (F0!BC) [18:10:40:113]: PROPERTY CHANGE: Adding Supports32BitDlls property. Its value is '1'.
Action start 18:10:39: Check32BitSupport.
MSI (s) (F0:28) [18:10:40:113]: Skipping action: No32BitSupportError (condition is false)
MSI (s) (F0:28) [18:10:40:113]: Doing action: FindRelatedProducts
Action ended 18:10:40: Check32BitSupport. Return value 1.
Action start 18:10:40: FindRelatedProducts.
MSI (s) (F0:28) [18:10:40:113]: Skipping action: DowngradeError (condition is false)
MSI (s) (F0:28) [18:10:40:113]: Skipping action: LegacyNortonError (condition is false)
MSI (s) (F0:28) [18:10:40:113]: Skipping action: LegacySymError (condition is false)
MSI (s) (F0:28) [18:10:40:113]: Doing action: DriverCheck
Action ended 18:10:40: FindRelatedProducts. Return value 1.
MSI (s) (F0:AC) [18:10:40:175]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3A74.tmp, Entrypoint: DriverCheck
Action start 18:10:40: DriverCheck.
DriverCheck SymEvent did not open. Trying accessing via CreateFile
DriverCheck SymEvent did not open (probably doesn't exist -- this is fine) with: 2
DriverCheck SymTDI did not open. Trying accessing via CreateFile
DriverCheck SymTDI did not open (probably doesn't exist -- this is fine) with: 2
DriverCheck WPS did not open. Trying accessing via CreateFile
DriverCheck WPS did not open (probably doesn't exist -- this is fine) with: 2
MSI (s) (F0:28) [18:10:40:206]: Doing action: SetMigrateProperty
Action ended 18:10:40: DriverCheck. Return value 1.
MSI (s) (F0:30) [18:10:40:238]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3AD2.tmp, Entrypoint: SetMigrateProperty
Action start 18:10:40: SetMigrateProperty.
MSI (s) (F0:28) [18:10:40:269]: Skipping action: SetIdcMultistageProperty (condition is false)
MSI (s) (F0:28) [18:10:40:269]: Skipping action: SetSNACMigratePropertyAmberPlus (condition is false)
MSI (s) (F0:28) [18:10:40:269]: Skipping action: SetSNACMigratePropertyOlder (condition is false)
MSI (s) (F0:28) [18:10:40:269]: Skipping action: SetSNACMigratePropertyPreAmber (condition is false)
MSI (s) (F0:28) [18:10:40:269]: Doing action: VerifyBFERunning
Action ended 18:10:40: SetMigrateProperty. Return value 1.
MSI (s) (F0:24) [18:10:40:300]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3B12.tmp, Entrypoint: VerifyBFERunning
Action start 18:10:40: VerifyBFERunning.
InstallUtils::CServiceUtil::isServiceRunningChecking status of service: BFE
MSI (s) (F0!70) [18:10:40:316]: PROPERTY CHANGE: Adding BFEServiceRunning property. Its value is '1'.
InstallUtils::CServiceUtil::isServiceRunningService BFE is currently running.
MSI (s) (F0:28) [18:10:40:316]: Doing action: LocateSourceDir
Action ended 18:10:40: VerifyBFERunning. Return value 1.
MSI (s) (F0:E0) [18:10:40:347]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3B42.tmp, Entrypoint: LocateSourceDir
Action start 18:10:40: LocateSourceDir.
preclientca: SourceDir=
MSI (s) (F0!54) [18:10:40:347]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'C:\Windows\Temp\Symantec\'.
preclientca: OriginalDatabase=C:\Windows\Temp\Symantec\Sep64.msi
MSI (s) (F0:28) [18:10:40:347]: Doing action: AppSearch
Action ended 18:10:40: LocateSourceDir. Return value 1.
Action start 18:10:40: AppSearch.
MSI (s) (F0:28) [18:10:40:347]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:347]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Sygate Technologies, Inc.\Sygate Personal Firewall 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\Symantec Endpoint Protection\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\Symantec Endpoint Protection 3: 2 
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding OS_SUPPORTS_UI property. Its value is 'C:\Windows\explorer.exe'.
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding IE6FOUND property. Its value is 'C:\Windows\SysWOW64\shdocvw.dll'.
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SPMXMLFOUND property. Its value is 'C:\Windows\Temp\Symantec\SyLink.xml'.
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\Common 3: 2 
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SERDEFDATFOUND property. Its value is 'C:\Windows\Temp\Symantec\serdef.dat'.
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\Symantec Endpoint Protection\VolatileInstallData 3: 2 
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding UNINSTALLREBOOTREQUIRED property. Its value is '1'.
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG13_PATH property. Its value is 'C:\Windows\system32\rastls.dll'.
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG13_INTERACTIVEUIPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG13_CONFIGUIPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG13_IDENTITYPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG25_PATH property. Its value is 'C:\Windows\system32\rastls.dll'.
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG25_INTERACTIVEUIPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG25_CONFIGUIPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG25_IDENTITYPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Sygate Technologies, Inc.\Sygate Personal Firewall 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\Symantec Endpoint Protection\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1324 2: Data\Config 3: 1 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1324 2: Data\Config 3: 1 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1324 2: Data\Config 3: 1 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1324 2: Data\Config 3: 1 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Microsoft\WinFLP\Optional Components 3: 2 
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding DEFENDERFOUND property. Its value is 'Microsoft Windows Defender'.
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\TSE 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1325 2: sysferThunk.dll 
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding OUTLOOKFOUND property. Its value is 'C:\Program Files\Microsoft Office\Office14\'.
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\EXCHNG32.EXE 3: 2 
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding NOTESFOUND property. Its value is 'C:\Program Files (x86)\lotus\notes\'.
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Norton AntiVirus Corporate Edition 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7} 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\SymBPL\{D270A25E-8BB6-4895-8517-89B898969BBF} 3: 2 
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2 
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SDIDATFOUND property. Its value is 'C:\Windows\Temp\Symantec\sdi.dat'.
MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1325 2: sysferThunk.dll 
MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding FOUNDSEPSLF property. Its value is 'C:\Windows\Temp\Symantec\sep.slf'.
MSI (s) (F0:28) [18:10:40:378]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\Symantec Endpoint Protection\{3771A34D-2132-48EA-A486-D62ECDF9D553}\Install 3: 2 
MSI (s) (F0:28) [18:10:40:378]: PROPERTY CHANGE: Adding VC8B762CHECK property. Its value is 'C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2\'.
MSI (s) (F0:28) [18:10:40:378]: PROPERTY CHANGE: Adding VC8B42CHECK property. Its value is 'C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_93b21c24844efba7\'.
MSI (s) (F0:28) [18:10:40:378]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\WholeSecurity Inc.\Confidence Online(tm) Server 3: 2 
MSI (s) (F0:28) [18:10:40:378]: Doing action: checkInstallBlocksIE
Action ended 18:10:40: AppSearch. Return value 1.
MSI (s) (F0:04) [18:10:40:456]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3B81.tmp, Entrypoint: checkInstallBlocksIE
MSI (s) (F0!14) [18:10:40:472]: PROPERTY CHANGE: Adding IdcXmlPath property. Its value is 'C:\Windows\Temp\idc.xml'.
Action start 18:10:40: checkInstallBlocksIE.
IDCCA:  CMsiUtil::isActionScheduled: Unable to fetch view (Result: 259)
MSI (s) (F0:28) [18:10:40:581]: Doing action: CommunicateLaunchConditions
Action ended 18:10:40: checkInstallBlocksIE. Return value 1.
MSI (s) (F0:70) [18:10:40:643]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3C4D.tmp, Entrypoint: CommunicateLaunchConditions
Action start 18:10:40: CommunicateLaunchConditions.
Communicate LC: NOT Version9X=1
Communicate LC: VersionNT > 500=1
Communicate LC: NOT WINDOWSFUNDAMENTALS=1
Communicate LC: (NOT MIGRATIONPENDINGREBOOT) OR SISFAILED=1
Communicate LC: (NOT UNINSTALLREBOOTREQUIRED) OR Installed=0
Communicate LC: Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
Communicate LC:  calling communicate state with the following arguments: 
Communicate LC: Prodversion = 12.1.2015.2015
Communicate LC: PathToSylink = C:\Windows\Temp\Symantec\
Communicate LC: Oldversion = 
Communicate LC: ReasonStr = Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
Communicate LC: StatusCode = 302469124
MSI (s) (F0:28) [18:10:44:980]: Skipping action: IsAdmin (condition is false)
MSI (s) (F0:28) [18:10:44:980]: Doing action: preLaunchCond
Action ended 18:10:44: CommunicateLaunchConditions. Return value 1.
MSI (s) (F0:14) [18:10:45:027]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4D7D.tmp, Entrypoint: preLaunchCond
Action start 18:10:44: preLaunchCond.
MSI (s) (F0!0C) [18:10:45:245]: Note: 1: 2731 2: 0 
IDCCA:  preLaunchCond - Launch condition `4Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.` with condition `(NOT UNINSTALLREBOOTREQUIRED) OR Installed` failed
MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2731 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2732 2: 0 
Unable to determine feature state: 1606 
MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2732 2: 0 
IDCCA: Unable to get target path (Result: 267)
IDCCA: Unable to get target path (Result: 267)
IDCCA: Machine ID: 11f4cf80b018069d291865ca26c93df33d6a79
IDCCA: HttpQueryInfo: 200 OK Error: 0
IDCCA: SETI::CUploadFile::logout200 OK
MSI (s) (F0:28) [18:10:52:843]: Doing action: LaunchConditions
Action ended 18:10:52: preLaunchCond. Return value 1.
Action start 18:10:52: LaunchConditions.
MSI (s) (F0:28) [18:10:52:843]: Product: Symantec Endpoint Protection -- 4Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
 
4Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
Action ended 18:10:52: LaunchConditions. Return value 3.
Action ended 18:10:52: INSTALL. Return value 3.
Property(S): UpgradeCode = {F7BE9C8A-C2E6-470D-B703-0A1845E6FF8C}
Property(S): OS_SUPPORTS_UI = C:\Windows\explorer.exe
Property(S): IE6FOUND = C:\Windows\SysWOW64\shdocvw.dll
Property(S): SPMXMLFOUND = C:\Windows\Temp\Symantec\SyLink.xml
Property(S): SERDEFDATFOUND = C:\Windows\Temp\Symantec\serdef.dat
Property(S): UNINSTALLREBOOTREQUIRED = 1
Property(S): SYMRASMAN_REG13_PATH = C:\Windows\system32\rastls.dll
Property(S): SYMRASMAN_REG13_INTERACTIVEUIPATH = C:\Windows\system32\rastls.dll
Property(S): SYMRASMAN_REG13_CONFIGUIPATH = C:\Windows\system32\rastls.dll
Property(S): SYMRASMAN_REG13_IDENTITYPATH = C:\Windows\system32\rastls.dll
Property(S): SYMRASMAN_REG25_PATH = C:\Windows\system32\rastls.dll
Property(S): SYMRASMAN_REG25_INTERACTIVEUIPATH = C:\Windows\system32\rastls.dll
Property(S): SYMRASMAN_REG25_CONFIGUIPATH = C:\Windows\system32\rastls.dll
Property(S): SYMRASMAN_REG25_IDENTITYPATH = C:\Windows\system32\rastls.dll
Property(S): DEFENDERFOUND = Microsoft Windows Defender
Property(S): OUTLOOKFOUND = C:\Program Files\Microsoft Office\Office14\
Property(S): NOTESFOUND = C:\Program Files (x86)\lotus\notes\
Property(S): SDIDATFOUND = C:\Windows\Temp\Symantec\sdi.dat
Property(S): FOUNDSEPSLF = C:\Windows\Temp\Symantec\sep.slf
Property(S): VC8B762CHECK = C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2\
Property(S): VC8B42CHECK = C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_93b21c24844efba7\
Property(S): ProductName = Symantec Endpoint Protection
Property(S): ProductDisplayName = Symantec Endpoint Protection
Property(S): ProductVersion = 12.1.2015.2015
Property(S): OPTOUTREPSUBMISSION = 0
Property(S): ENABLEAUTOPROTECT = 1
Property(S): DISABLEDEFENDER = 1
Property(S): RUNLIVEUPDATE = 1
Property(S): IDCENABLE = 1
Property(S): VersionNT64 = 601
Property(S): Managed_Client_Type = Unmanaged
Property(S): SetupType = Typical
Property(S): _IsSetupTypeMin = Typical
Property(S): SBE_Feature_Set = Typical
Property(S): AgreeToLicense = No
Property(S): _IsMaintenance = Change
Property(S): RestartManagerOption = CloseRestart
Property(S): SMSName = SepMasterService
Property(S): SMSDescription = Symantec Endpoint Protection
Property(S): InUISequence = 0
Property(S): REBOOT = ReallySuppress
Property(S): System64Folder = C:\Windows\system32\
Property(S): ProgramFilesFolder = C:\Program Files (x86)\
Property(S): WindowsFolder = C:\Windows\
Property(S): CommonFilesFolder = C:\Program Files (x86)\Common Files\
Property(S): SourceDir = C:\Windows\Temp\Symantec\
Property(S): CommonAppDataFolder = C:\ProgramData\
Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
Property(S): DesktopFolder = C:\Users\Public\Desktop\
Property(S): Manufacturer = Symantec Corporation
Property(S): ProductCode = {C2103AF2-E66C-446B-9791-9207840EC821}
Property(S): ProductLanguage = 1033
Property(S): ALLUSERS = 1
Property(S): APPTYPE = 105
Property(S): LUMoniker = {A8BA6A8E-8DB4-4575-8C7B-13CAF85B70AB}
Property(S): ARPSYSTEMCOMPONENT = 1
Property(S): INSTALLLEVEL = 100
Property(S): MSIENFORCEUPGRADECOMPONENTRULES = 1
Property(S): IDCDATASERVER = tses.symantec.com
Property(S): IDCDATALOC = /incoming
Property(S): IDCDEPLOYMENT = Local
Property(S): IDCEXTRAINFO = 0
Property(S): SISUSETRANSACTIONS = 1
Property(S): MAXMIGRATIONDELAY = 60
Property(S): MIGRATIONDELAY = 30
Property(S): MsiLogging = voicewarmupx
Property(S): MSIRESTARTMANAGERCONTROL = Disable
Property(S): SMSLongDescription = Provides malware and threat protection for Symantec Endpoint Protection
Property(S): SymMigrationRebootMessage = To provide complete protection, Symantec Endpoint Protection requires this computer to restart.
Property(S): SymRebootAtEndMessage = To provide complete protection, Symantec Endpoint Protection requires this computer to restart.
Property(S): InstallCompleteMessage = The installation has completed successfully
Property(S): ShowServiceProgressMessage = Executing install script via service
Property(S): ShowServiceProgress_RBMessage = Executing rollback script via service
Property(S): SiloGUID = {3771A34D-2132-48EA-A486-D62ECDF9D553}
Property(S): SILO_REGHIVE = SOFTWARE\Symantec\Symantec Endpoint Protection
Property(S): HIGHCONTRAST = 0
Property(S): SYM_MAJOR_UPGRADE = 0
Property(S): SEPLicprop = SB
Property(S): SEPLicpropReg = sepsb
Property(S): SYMLICENSETYPE = 0
Property(S): SYMLICENSETYPESTRING = sepe
Property(S): MIGLICENSETYPE = 0
Property(S): LOADEDDRIVERSFOUND = 0
Property(S): RESOLVEFEATURES = 0
Property(S): InstallingToReparse = 0
Property(S): SYMCOMPRESSFOLDERS = 1
Property(S): VMWAREDETECTED = 0
Property(S): ValidInstallDir = 0
Property(S): CACHEINSTALL = 1
Property(S): MIGRATESETTINGS = 1
Property(S): CMC_PRODUCT_BUILD = #2015
Property(S): CMC_PRODUCT_VERSION = 12.1
Property(S): CACHE_INSTALLER = 1
Property(S): ADDSTARTMENUICON = 1
Property(S): ErrorDialog = SetupError
Property(S): ApplicationUsers = AllUsers
Property(S): DefaultUIFont = Tahoma8
Property(S): ProgressType0 = install
Property(S): ProgressType1 = Installing
Property(S): ProgressType2 = installed
Property(S): ProgressType3 = installs
Property(S): INSTALLSYMELAM = 1
Property(S): LibSep64 = 1
Property(S): SysPlantStartType = disabled
Property(S): LibSepCommon = 1
Property(S): HITYPE = 0
Property(S): LOCATIONSENSOR = 0
Property(S): REVERSEDNS = 0
Property(S): WSCAVALERT = 1
Property(S): WSCAVUPTODATE = 7
Property(S): WSCCONTROL = 0
Property(S): LibSnac64 = 1
Property(S): ForeFrontSupportProp = http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008110415505248
Property(S): LaunchBrowserProp = Rundll32.Exe url.Dll,FileProtocolHandler
Property(S): Lang = 1033
Property(S): LiveUpdateVars = 1
Property(S): SecureCustomProperties = ADDLOCAL;ADDSTARTMENUICON;AMBERPLUSFOUND;AMBERSNACPLUSFOUND;APPDATAINSTALL;APPDATAINSTALLLOGS;APPDATAINSTALLSCRIPTS;APPLOGS;APTEMP;AVLOGS;BADPATTS;CACHE_INSTALLER;CACHED_INSTALLS;CACHEINSTALL;CMC_PRODUCT_BUILD;CMC_PRODUCT_VERSION;COMPANYNAME;CONFIGDIR;CONTENTCACHE;CONTENTMIGRATION;DB;DECTEMP;DEFENDERFOUND;DISABLEDEFENDER;ENABLEAUTOPROTECT;EXCHANGEFOUND;FEATURESTATEDIR;FOREFRONEXCFOUND;FOREFRONTTMGFOUND;FOUNDBROWSERPROTECTIONLITE;FOUNDLIVEUPDTHST;FOUNDSEPSLF;FOUNDSETTINGSHOSTSLIVEUPDATE;FOUNDSNACSLF;HELP;HITYPE;I2_LDVP.VDB;IDCDATALOC;IDCDATASERVER;IDCDEPLOYMENT;IDCENABLE;IDCEXTRAINFO;IE6FOUND;INSTALLEDPRODUCTTYPE;INSTALLSCRIPTS;INSTALLSYMELAM;JAGUARSNACPLUSFOUND;LANG1033;LEGACYSEA_NM;LEGACYSEA_NM1;LEGACYSEA_NM2;LOADEDDRIVERSFOUND;LOCATIONSENSOR;MAXMIGRATIONDELAY;MIGLICENSETYPE;MIGRATESETTINGS;MIGRATIONDELAY;MIGRATIONPENDINGREBOOT;MSIRESTARTMANAGERCONTROL;NEWERFOUND;NEWERSNACFOUND;NORTONAV;NORTONAVPRO;NORTONFOUND;NOTESFOUND;OLDAPPDATADIR;OLDERFOUND;OLDPRODUCTVERSION;OLDSILOFOUND;OPTOUTREPSUBMISSION;OS_SUPPORTS_UI;OUTLOOKFOUND;PENDINGMODULEREMOVAL;PERSISTEDDATA;PREAMBERFOUND;PREAMBERSNACFOUND;PREHAMLETFOUND;PRODUCTINSTALLDIR;PRODUCTINSTALLDIRINSETAID;QUARANTINE;REINSTALL;REMOVE;RES;RESOLVEFEATURES;REVERSEDNS;ROOTDRIVE;RUNLIVEUPDATE;SAVCORP7XFOUND;SAVFOUND;SAVMIGINSTDIR;SAVSMIGFOLDER;SCSMIGINSTDIR;SDIDATFOUND;SEAMIGINSTDIR;SEPMIGINSTDIR;SERDEFDATFOUND;SILO_REGHIVE;SISFAILED;SISUSETRANSACTIONS;SMCLU;SNACFOUND;SNACMIGINSTDIR;SNACNPFOUND32;SNACNPFOUND64;SOURCEDIR;SPA51BLOCK;SPAFOUND;SPMXMLFOUND;SRCLICFILE;STATEDIR;STATICDATA;SYLINKSRCDIR;SYM_MAJOR_UPGRADE;SYMCOMPRESSFOLDERS;SYMFORCEFAIL;SYMFORCEFAILPHASE;SYMLICENSETYPE;SYMLICENSETYPESTRING;SYMRASMAN_REG13_CONFIGUIPATH;SYMRASMAN_REG13_IDENTITYPATH;SYMRASMAN_REG13_INTERACTIVEUIPATH;SYMRASMAN_REG13_PATH;SYMRASMAN_REG25_CONFIGUIPATH;SYMRASMAN_REG25_IDENTITYPATH;SYMRASMAN_REG25_INTERACTIVEUIPATH;SYMRASMAN_REG25_PATH;SYMREBOOT;SYMSRCDIR;SYMSTARTMENUDIR;SYSFERFOUND32;SYSFERFOUND64;SYSFERTHUNKFOUND32;SYSFERTHUNKFOUND64;TARGETDIR;TEEFERVISTA;TEEFERWIN8;TEEFERXP;TPAR;UNINSTALLREBOOTREQUIRED;USEDCUSTOMINSTALL;USERNAME;VC8B1416CHECK;VC8B42CHECK;VC8B762CHECK;VMWAREDETECTED;WINDOWSFIREWALLSTATE;WSCAVALERT;WSCAVUPTODATE;WSCCONTROL;WSCONFONLINE;XFER;XFER_TMP
Property(S): MsiLogFileLocation = C:\Windows\TEMP\SEP_INST.LOG
Property(S): PackageCode = {FCBCA23E-67D3-469D-9B7C-03580B8BC8B5}
Property(S): ProductState = -1
Property(S): PackagecodeChanging = 1
Property(S): SRCLICFILE = EE
Property(S): CURRENTDIRECTORY = C:\Windows\TEMP\Symantec
Property(S): CLIENTUILEVEL = 3
Property(S): CLIENTPROCESSID = 5584
Property(S): VersionDatabase = 200
Property(S): MsiSystemRebootPending = 1
Property(S): VersionMsi = 5.00
Property(S): VersionNT = 601
Property(S): WindowsBuild = 7601
Property(S): ServicePackLevel = 1
Property(S): ServicePackLevelMinor = 0
Property(S): MsiNTProductType = 1
Property(S): WindowsVolume = C:\
Property(S): SystemFolder = C:\Windows\SysWOW64\
Property(S): RemoteAdminTS = 1
Property(S): TempFolder = C:\Windows\TEMP\
Property(S): ProgramFiles64Folder = C:\Program Files\
Property(S): CommonFiles64Folder = C:\Program Files\Common Files\
Property(S): AppDataFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\
Property(S): FavoritesFolder = C:\Windows\system32\config\systemprofile\Favorites\
Property(S): NetHoodFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
Property(S): PersonalFolder = C:\Windows\system32\config\systemprofile\Documents\
Property(S): PrintHoodFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
Property(S): RecentFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\
Property(S): SendToFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\
Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
Property(S): LocalAppDataFolder = C:\Windows\system32\config\systemprofile\AppData\Local\
Property(S): MyPicturesFolder = C:\Windows\system32\config\systemprofile\Pictures\
Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
Property(S): FontsFolder = C:\Windows\Fonts\
Property(S): GPTSupport = 1
Property(S): OLEAdvtSupport = 1
Property(S): ShellAdvtSupport = 1
Property(S): MsiAMD64 = 6
Property(S): Msix64 = 6
Property(S): Intel = 6
Property(S): PhysicalMemory = 3958
Property(S): VirtualMemory = 5638
Property(S): AdminUser = 1
Property(S): MsiTrueAdminUser = 1
Property(S): LogonUser = SYSTEM
Property(S): UserSID = S-1-5-18
Property(S): UserLanguageID = 1033
Property(S): ComputerName = MGUKASYAN-E6410
Property(S): SystemLanguageID = 1033
Property(S): ScreenX = 1024
Property(S): ScreenY = 768
Property(S): CaptionHeight = 22
Property(S): BorderTop = 1
Property(S): BorderSide = 1
Property(S): TextHeight = 16
Property(S): TextInternalLeading = 3
Property(S): ColorBits = 32
Property(S): TTCSupport = 1
Property(S): Time = 18:10:52
Property(S): Date = 3/15/2013
Property(S): MsiNetAssemblySupport = 4.0.30319.1
Property(S): MsiWin32AssemblySupport = 6.1.7601.17514
Property(S): RedirectedDllSupport = 2
Property(S): MsiRunningElevated = 1
Property(S): Privileged = 1
Property(S): USERNAME = admin
Property(S): DATABASE = C:\Windows\Installer\903786.msi
Property(S): OriginalDatabase = C:\Windows\Temp\Symantec\Sep64.msi
Property(S): UILevel = 2
Property(S): ACTION = INSTALL
Property(S): Supports32BitDlls = 1
Property(S): BFEServiceRunning = 1
Property(S): IdcXmlPath = C:\Windows\Temp\idc.xml
MSI (s) (F0:28) [18:10:52:905]: Note: 1: 1708 
MSI (s) (F0:28) [18:10:52:905]: Product: Symantec Endpoint Protection -- Installation operation failed.
 
MSI (s) (F0:28) [18:10:52:905]: Windows Installer installed the product. Product Name: Symantec Endpoint Protection. Product Version: 12.1.2015.2015. Product Language: 1033. Manufacturer: Symantec Corporation. Installation success or error status: 1603.
 
MSI (s) (F0:28) [18:10:52:905]: Deferring clean up of packages/files, if any exist
MSI (s) (F0:28) [18:10:52:905]: MainEngineThread is returning 1603
MSI (s) (F0:CC) [18:10:52:905]: No System Restore sequence number for this installation.
=== Logging stopped: 3/15/2013  18:10:52 ===
MSI (s) (F0:CC) [18:10:52:905]: User policy value 'DisableRollback' is 0
MSI (s) (F0:CC) [18:10:52:905]: Machine policy value 'DisableRollback' is 0
MSI (s) (F0:CC) [18:10:52:905]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (F0:CC) [18:10:52:905]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 
MSI (s) (F0:CC) [18:10:52:905]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 
MSI (s) (F0:CC) [18:10:52:905]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2 
MSI (s) (F0:CC) [18:10:52:905]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2 
MSI (s) (F0:CC) [18:10:52:905]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (s) (F0:CC) [18:10:52:905]: Restoring environment variables
MSI (s) (F0:CC) [18:10:52:905]: Destroying RemoteAPI object.
MSI (s) (F0:24) [18:10:52:905]: Custom Action Manager thread ending.
MSI (c) (D0:A0) [18:10:52:905]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (D0:A0) [18:10:52:905]: MainEngineThread is returning 1603
=== Verbose logging stopped: 3/15/2013  18:10:52 ===
 
.Brian's picture
MSI (s) (F0:28) [18:10:52:843]: Product: Symantec Endpoint Protection -- 4Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
 
Open the registry and navigate to:
 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager
 
Locate the PendingFileRenameOperations key and rename it to PendingFileRenameOperations2 or delete it and then try the install again.
 
Do not reboot after deleting the key. Re-run the install immmediately after deleting as it usually comes back after a reboot.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Rafeeq's picture

While installing Symantec Products , we get an error “Symantec Endpoint Protection has detected that there are pending system changes that require a reboot. Please reboot the system and rerun the installation.”
 
To resolve this issue, typically, you would navigate in the registry to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager and locate the PendingFileRenameOperations key and rename it to  PendingFileRenameOperations2 and then try to install the product.
  
But why do we get the error?
   
The fact that executable images and DLLs are memory-mapped when they are used makes it impossible to update core system files after Windows has finished booting. The MoveFileEx Windows API has an option to specify that a file move be delayed until the next boot. Service Packs and hotfixes that must update in-use memory mapped files install replacement files onto a system in temporary locations and use the MoveFileEx API to have them replace otherwise in-use files. When used with that option,
MoveFileEx simply records commands in the PendingFileRenameOperations and PendingFileRenameOperations2 values under HKLM\SYSTEM\CurrentControlSet\
Control\Session Manager. These registry values are of type MULTI_SZ, where each operation is specified in pairs of file names: the first file name is the source location, and the second is the target location. Delete operations use an empty string as their target path.
  
The PendingFileRenameOperations key stores the names of files to be renamed when the system restarts. It consists of pairs of file names. The file specified in the first item of the pair is renamed to match the second item of the pair. The system adds this entry to the registry when a user or program tries to rename a file that is in use. The file names are stored in the value of this entry until the system is restarted and they are renamed. This entry is not created by the Operating System.
 
In order to prevent such things from happening in the, it is mandatory to reboot the server after installing any application/driver when it requests for a reboot immediately.

Velocity2089's picture

I tried this but i keep getting the error "Symantec Endpoint Protection has detected that there are pending system changed that require a reboot. Please reboot the system and rerun the installation."

After rebooting the key also dissappears.

Velocity2089's picture

Another update on this. Started to do a custom install, first did just live update and left off everything else, then did network threat protection, then tried the other 2 options and now it has failed again and rolled back. 

Mithun Sanghavi's picture

Hello,

What OS are you running on your machine?

Make sure you uninstall the Liveupdate from the Add/Remove Programs. Secondly, disable the UAC (incase of windows 7 and above)

Suggestions:

First, Check this Article:

Installer Information - "Symantec Endpoint Protection has detected that there are pending system changes that require a reboot." when trying to install SEP 11.0 on Windows 7

http://www.symantec.com/docs/TECH95608

Steps -

1. Open registry and go to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\

hightlight Session Manager on the right hand side delete the value PendingFileRenameOperations

2. Also delete the same value from

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Control\Session Manager\PendingFileRenameOperations

then run the install...without rebooting the PC

http://service1.symantec.com/SUPPORT/ent-security.nsf/ppfdocs/2007121609023348?Open&dtype=corp&src=&seg=&om=1&om_out=prod

Then

3.Disable UAC (Incase of Windows 7 and above)

4.If it's an upgrade uninstall SEP using cleanwipe utility and restart the system.

How to get the CleanWipe tool (Endpoint Removal)

https://www-secure.symantec.com/connect/forums/how-get-cleanwipe-tool-endpoint-removal

OR

4. Manually uninstall SEP.

Delete the contents of the SEP from the computer and registry after backing up the registry, then try reinstalling SEP.

http://www.symantec.com/docs/TECH184988

NOTE: For receiving CleanWipe utility requires you to create a case with Symantec.

In your case, I would recommend you to check this Article below:

Methods for uninstalling Symantec Endpoint Protection

https://www-secure.symantec.com/connect/forums/methods-uninstalling-symantec-endpoint-protection

Manual uninstall documents for Symantec Endpoint Protection

http://www.symantec.com/docs/TECH164769

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Terabyte Computers's picture

http://www.symantec.com/business/support/index?pag... appears to be the solution.  It's also documented at http://social.technet.microsoft.com/Forums/en-US/winserverManagement/thread/8f4f4c74-f250-42b4-afdd-a76598dd863f.  

Unfortuantly based on past experience with Symantec and bugs, it may be 6 months before we see this fixed unless Microsoft fixes it on their end so every new Win8 box is doomed to have this problem if you choose to patch first and install SEP second.  I won't debate the logic of patching first before installing security software or installing security first before patching, but history tells me it will be many months before this is fixed.  It's a shame Symantec doesn't have a hot-fix cycle like every other software vendor does.  This really needs fixed.

Velocity2089's picture

Hello. I have tried all of the suggested steps in this thread and nothing works. Removing the registry keys does not help as it won't let me re-run the installation and requires a reboot. The Windows 8 thread doesn't help either as it's a Windows 7 pc and windows defender is already disabled. 

D@ry1's picture

Hey try this:

if you're using package to install SEP recreate the package with the option to create SEP shortcut on the Start Menu disabled, just uncheck it and try to reinstall the SEP.

if you're using the SEPM's default packages, just change the install settings to create SEP shortcut on the Start Menu as disabled.

Velocity2089's picture

Hi. I will have to give this a try. Out of curiousity though, what impact would that shortcut have on the installation failing? 

D@ry1's picture

Im not sure but I found it on a knowledge base before, I just cant remember where, but we used that procedure before when we had the rolling back issue. if you want deeper analysis of that you should call support for them to check why the shortcut on start has something to do with the rollback,.

zafar1907's picture

Hi,

When I faced the  Roll back Issue I followed these step....

First check you are login with admin rights
then 
try to remove live and symanec from add & remove
then stop and all symantec services ...services.msc
stop all extra startup ,,,,msconfig
and stop symantec ccap..ccset ccevt process via taskkill /IM ccap* /F

then 
cut these folders to other path 
C:\Documents and Settings\currentloginuser\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\Symantec
C:\Program Files\Symantec AntiVirus

remove symantec from these registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer

then try to install

Thanks and Regards,

Mohammad zafar

Please Mark as solution if this comment solved your Issue....

Chetan Savade's picture

Hi,

You have tried almost all the steps which are required to troubleshoot.

If possible involve the support to troubleshoot it further.

I would suggest that try to install any legacy version if possible & then go with an upgrade.

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

Velocity2089's picture

Legacy version is the only thing that seemed to work. Pretty dissapointed with the support on this one when I contacted Symantec as they couldn't explain why this was occurring. Since then I've seen it happen in about 4-5 other instances. 12.1.1 seems to work fine though. Haven't had a chance to test if it will upgrade automatically on it's own yet. 

D@ry1's picture

did you try to recreate a new package with the option unchecked on the create start menu shortcut?

Velocity2089's picture

Yes we're way past the start menu option. I did FINALLY resolve this though and wanted to share my findings. Basically this was a combination of a number of different methods suggested above. 

The following steps were necessary to get the 12.1.2 installation to work properly. If the installation currently has been corrupted (12.1.2), run the clean wipe utility from Symantec to start fresh with the 12.1.1 installation.

1. Install a legacy version, in my case I used 12.1.1
2. Disable windows firewall
3. Disable windows defender
4. Disable UAC
5. Uninstall Microsoft Security Essentials completely (this will remove windows defender completely)

6. Open registry and go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\
hightlight Session Manager on the right hand side delete the value in PendingFileRenameOperations

7. Allow the SEPM server to push the latest package update to the laptop (12.1.2), it should then prompt that a new update is available and to download now. (This is under the assumption that laptop is sitting in the same container the 12.1.2 version is set to as the default installation package in the SEPM console)

8. Once the installation is complete, reboot the laptop. The version should now show as up to date and on 12.1.2 

SOLUTION