Video Screencast Help

Symantec Endpoint Protection has detected that there are pending system changes that require a reboot. Please reboot the system and rerun the installation.

Created: 18 Jun 2010 • Updated: 03 Aug 2010 | 3 comments
This issue has been solved. See solution.

I have read all the posts and performed all the reg hacks and tricks to get this installed.  Nothing works!

I am stunned that Symantec has not permanently solved this issue in one of their releases.  I am shocked they can still sell their product with this issue still hanging out there.  How could you sell this product to a system admin with potentially hundreds of systems to install and expect him to make all these re hacks just to make the installations work.

I will not buy this product.  I can't imagine that this problem has gone on this long without a solution.

Comments 3 CommentsJump to latest comment

P_K_'s picture

Hey John.

This is not a Symantec issue.

In order to prevent such things from happening in the, it is mandatory to reboot the server after installing any application/driver when it requests for a reboot immediately. By the way what version of SEP are you using?

While installing SEP , there is a check for the Pending System changes , this check has been removed in RU6a.

So try to install that and see.

The fact that executable images and DLLs are memory-mapped when they are used makes it impossible to update core system files after Windows has finished booting. The MoveFileEx Windows API has an option to specify that a file move be delayed until the next boot. Service Packs and hotfixes that must update in-use memory mapped files install replacement files onto a system in temporary locations and use the MoveFileEx API to have them replace otherwise in-use files. When used with that option,
MoveFileEx simply records commands in the PendingFileRenameOperations and PendingFileRenameOperations2 values under HKLM\SYSTEM\CurrentControlSet\
Control\Session Manager. These registry values are of type MULTI_SZ, where each operation is specified in pairs of file names: the first file name is the source location, and the second is the target location. Delete operations use an empty string as their target path.
The PendingFileRenameOperations key stores the names of files to be renamed when the system restarts. It consists of pairs of file names. The file specified in the first item of the pair is renamed to match the second item of the pair. The system adds this entry to the registry when a user or program tries to rename a file that is in use. The file names are stored in the value of this entry until the system is restarted and they are renamed. This entry is not created by the Operating System.


MCT MCSE-2012 Symantec Technical Specialist (SCTS)

BoltzNBrew's picture

We are trying to upgrade our clients to RU6 and getting this error everywhere.  We are trying to do the install in the background and prompt for a reboot using DS6.9SP4  Distribute Software.  Could it be something in Distribute Software that is checking this still? Also, when after we reboot the computers and kick off the job, the msi runs and can see the shield disappear then come back but it still shows the old version of SEP.  Something is definately not working here. When we run it using scripts it installs fine but it's not translating using Distribute Software like we have done it in previous versions.