Hi there,
I wonder if someone can assist with fixing this problem please.
I have a client who has got a Symantec Endpoint Protection (SEP) 11.0.5002.333 running on their SBS server and all their Windows XP client machines. We recently deployed 10 Windows 7 clients to their network and wanted to deploy the SEP client package to the Windows 7 machines from the network. The deployment failed on all Windows 7 machines.
I have tried using the deployment wizard and the "Find Unmanaged Computers" wizard, both failed even at the end of the process they all said completed.
On the client machine, I find the SEP_Inst.log file from the C:\windows\temp folder, and there are two places where I can see the "Return value 3". As I learnt from the forum here, people said the 10 - 15 lines above that "Return value 3" would tell us what the problem it was when doing the installation. However, I haven't been able to identify the cause, those logs just don't make too much sense to me. I am attaching one of them here and hopefully some talented person from you guys could tell me what the problem is and how to fix it.
SEP_Inst.log below...
AgentMainCA: MsiCopyNamedFiles: Enter.
AgentMainCA: CopyNamedFiles: Enter.
AgentMainCA: CopyNamedFiles: src: C:\Windows\TEMP\FEIHZAZB\CmcPolicies\, dest: C:\Program Files\Symantec\Symantec Endpoint Protection\, mode: 1
AgentMainCA: CopyFile - copied from C:\Windows\TEMP\FEIHZAZB\CmcPolicies\sylink.xml to C:\Program Files\Symantec\Symantec Endpoint Protection\sylink.xml success
AgentMainCA: CopyFile - copied from C:\Windows\TEMP\FEIHZAZB\CmcPolicies\stdstate.dat to C:\Program Files\Symantec\Symantec Endpoint Protection\stdstate.dat failure - Get Last Error reports 2
AgentMainCA: CopyFile - copied from C:\Windows\TEMP\FEIHZAZB\CmcPolicies\cltdef.dat to C:\Program Files\Symantec\Symantec Endpoint Protection\cltdef.dat failure - Get Last Error reports 2
AgentMainCA: CopyFile - copied from C:\Windows\TEMP\FEIHZAZB\CmcPolicies\serdef.dat to C:\Program Files\Symantec\Symantec Endpoint Protection\serdef.dat success
AgentMainCA: CopyFile - copied from C:\Windows\TEMP\FEIHZAZB\CmcPolicies\serstate.dat to C:\Program Files\Symantec\Symantec Endpoint Protection\serstate.dat failure - Get Last Error reports 2
AgentMainCA: CopyFile - copied from C:\Windows\TEMP\FEIHZAZB\CmcPolicies\tstate.dat to C:\Program Files\Symantec\Symantec Endpoint Protection\tstate.dat failure - Get Last Error reports 2
AgentMainCA: CopyFile - copied from C:\Windows\TEMP\FEIHZAZB\CmcPolicies\sdi.dat to C:\Program Files\Symantec\Symantec Endpoint Protection\sdi.dat success
AgentMainCA: CopyNamedFiles successful.
MSI (s) (D4:F0) [09:40:50:183]: Executing op: ActionStart(Name=MSIAddWFPAppException.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5,,)
AgentMainCA: MsiCopyNamedFiles successful.
MSI (s) (D4:F0) [09:40:50:183]: Executing op: CustomActionSchedule(Action=MSIAddWFPAppException.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5,ActionType=3073,Source=BinaryData,Target=MSIAddWFPAppException,CustomActionData=SMC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe;SNAC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE;Symantec Email;C:\Program Files\Common Files\Symantec Shared\ccApp.exe;)
MSI (s) (D4:54) [09:40:50:183]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI8437.tmp, Entrypoint: MSIAddWFPAppException
WinFWConfigCA: MSIChangeWFPAppException: CustomActionData dwlen 223, SMC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe;SNAC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE;Symantec Email;C:\Program Files\Common Files\Symantec Shared\ccApp.exe;.
WinFWConfigCA: MSIChangeWFPAppException: strName SMC Service, strPath C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe.
WinFWConfigCA: MSIModifyWFPAppException: strExceptionName = SMC Service.
WinFWConfigCA: MSIModifyWFPAppException: strFilePath = C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe.
WinFWConfigCA: WindowsFirewallModifyApp: fwProcessImageFileName=C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe fwName=SMC Service
WinFWConfigCA: WindowsFirewallAppIsEnabled: Authorized application C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe is was not in the collection.
WinFWConfigCA: WindowsFirewallModifyApp: Authorized application C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe is now enabled in the firewall.
WinFWConfigCA: MSIChangeWFPAppException: strName SNAC Service, strPath C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE.
WinFWConfigCA: MSIModifyWFPAppException: strExceptionName = SNAC Service.
WinFWConfigCA: MSIModifyWFPAppException: strFilePath = C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE.
WinFWConfigCA: WindowsFirewallModifyApp: fwProcessImageFileName=C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE fwName=SNAC Service
WinFWConfigCA: WindowsFirewallAppIsEnabled: Authorized application C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE is was not in the collection.
WinFWConfigCA: WindowsFirewallModifyApp: Authorized application C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE is now enabled in the firewall.
WinFWConfigCA: MSIChangeWFPAppException: strName Symantec Email, strPath C:\Program Files\Common Files\Symantec Shared\ccApp.exe.
WinFWConfigCA: MSIModifyWFPAppException: strExceptionName = Symantec Email.
WinFWConfigCA: MSIModifyWFPAppException: strFilePath = C:\Program Files\Common Files\Symantec Shared\ccApp.exe.
WinFWConfigCA: WindowsFirewallModifyApp: fwProcessImageFileName=C:\Program Files\Common Files\Symantec Shared\ccApp.exe fwName=Symantec Email
WinFWConfigCA: WindowsFirewallAppIsEnabled: Authorized application C:\Program Files\Common Files\Symantec Shared\ccApp.exe is was not in the collection.
MSI (s) (D4:F0) [09:40:50:729]: Executing op: ActionStart(Name=MSIAddWFPAppException_RB.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5,,)
WinFWConfigCA: WindowsFirewallModifyApp: Authorized application C:\Program Files\Common Files\Symantec Shared\ccApp.exe is now enabled in the firewall.
MSI (s) (D4:F0) [09:40:50:729]: Executing op: CustomActionSchedule(Action=MSIAddWFPAppException_RB.1CBEC0D3_E547_4E51_828B_44B9C47C0EA5,ActionType=3329,Source=BinaryData,Target=MSIRemoveWFPAppException,CustomActionData=SMC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe;SNAC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE;Symantec Email;C:\Program Files\Common Files\Symantec Shared\ccApp.exe;)
MSI (s) (D4:F0) [09:40:50:729]: Executing op: ActionStart(Name=LU_Register_Decomposer_ABI.Rol.611D9A69_39FC_4998_998E_1ECADF28A979,,)
MSI (s) (D4:F0) [09:40:50:729]: Executing op: CustomActionSchedule(Action=LU_Register_Decomposer_ABI.Rol.611D9A69_39FC_4998_998E_1ECADF28A979,ActionType=1281,Source=BinaryData,Target=_LURollbackDecomposerABI@4,)
MSI (s) (D4:F0) [09:40:50:729]: Executing op: ActionStart(Name=LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979,,)
MSI (s) (D4:F0) [09:40:50:729]: Executing op: CustomActionSchedule(Action=LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979,ActionType=1025,Source=BinaryData,Target=_LURegisterDecomposerABI@4,)
MSI (s) (D4:54) [09:40:50:745]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI865A.tmp, Entrypoint: _LURegisterDecomposerABI@4
-- DECABI_LOGGING -- Enter LURegisterDecomposerABI()
-- DECABI_LOGGING -- GetDecomposerABIProperties Registry created.
-- DECABI_LOGGING -- GetDecABIDirectory() -- failed to get Installed Apps key from registry.
-- DECABI_LOGGING -- Decomposer ABI DLL version is: not installed
-- DECABI_LOGGING -- Could not get Decomposer ABI version from LiveUpdate. (HRESULT=-2147221164)
-- DECABI_LOGGING -- Decomposer ABI version registered with LiveUpdate is: not installed
-- DECABI_LOGGING -- Decomposer ABI sequence number registered with LiveUpdate is: not installed
-- DECABI_LOGGING -- For rollback using Decomposer ABI custom action property: sizeof= 130 not installed:not installed
-- DECABI_LOGGING -- LiveUpdate registration failed. (HRESULT=-2147221164)
CustomAction LU_Register_Decomposer_ABI.611D9A69_39FC_4998_998E_1ECADF28A979 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (D4:F0) [09:40:51:696]: User policy value 'DisableRollback' is 0
MSI (s) (D4:F0) [09:40:51:696]: Machine policy value 'DisableRollback' is 0
Action ended 9:40:51: InstallFinalize. Return value 3.
.......
.......
MSI (s) (D4:F0) [09:41:04:785]: Executing op: ActionStart(Name=SetOneTimeUpdateCookie_RB.93C43188_D2F5_461E_B42B_C3A2A318345C,,)
MSI (s) (D4:F0) [09:41:04:785]: Executing op: CustomActionRollback(Action=SetOneTimeUpdateCookie_RB.93C43188_D2F5_461E_B42B_C3A2A318345C,ActionType=1281,Source=BinaryData,Target=SetOneTimeUpdateCookie_RB,)
MSI (s) (D4:A4) [09:41:04:785]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIBD53.tmp, Entrypoint: SetOneTimeUpdateCookie_RB
MSI (s) (D4:F0) [09:41:05:003]: Executing op: ActionStart(Name=DisableCancelButton.93C43188_D2F5_461E_B42B_C3A2A318345C,,)
MSI (s) (D4:F0) [09:41:05:003]: Executing op: ActionStart(Name=stopSP.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (D4:F0) [09:41:05:003]: Executing op: ActionStart(Name=restoreSPState.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (D4:F0) [09:41:05:003]: Executing op: CustomActionRollback(Action=restoreSPState.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,ActionType=3329,Source=BinaryData,Target=restoreSPState,CustomActionData=0)
MSI (s) (D4:2C) [09:41:05:003]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIBE2F.tmp, Entrypoint: restoreSPState
restoreSPState: called
restoreSPState: calling loadEventManagerDLLs
loadEventManagerDLLs: called
serviceIsRunning: OpenService FAILED with error 1060
LoadEvtMgrDll: ccEvtMgr is not running
serviceIsRunning: OpenService FAILED with error 1060
SendReload: ccEvtMgr is not running
loadEventManagerDLLs: FAILED to send reload event
loadEventManagerDLLs: exiting
restoreSPState: Changing service configuration to SERVICE_DEMAND START for SPBBCSvc
modifyServiceConfiguration: OpenService() FAILED with error 1060
restoreSPState: Unable to modify configuration for SPBBCSvc
restoreSPState: Value of szSPState "0"
restoreSPState: SPState is NOT set to 1. NOT Calling startSP
restoreSPState: exiting
MSI (s) (D4:F0) [09:41:05:019]: Executing op: ActionStart(Name=checkMSXMLVersion.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (D4:F0) [09:41:05:019]: Executing op: ActionStart(Name=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (D4:F0) [09:41:05:034]: Executing op: CustomActionRollback(Action=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,ActionType=1345,Source=BinaryData,Target=cleanupFolder,)
MSI (s) (D4:8C) [09:41:05:034]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIBE4F.tmp, Entrypoint: cleanupFolder
InstSymProtect::cleanupFolder() -> called
DeleteFolderIfNoFileExists: Driver file is not present.
DeleteFolder: FAILED to delete directory C:\Program Files\Common Files\Symantec Shared\SPBBC
DeleteFolderIfNoFileExists: SHDeleteFolder FAILED
InstSymProtect::cleanupFolder() -> DeleteFolderIfNoFileExists FAILED
MSI (s) (D4:F0) [09:41:05:050]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (D4:F0) [09:41:05:050]: Error in rollback skipped. Return: 5
cleanupFolder: exiting
MSI (s) (D4:F0) [09:41:05:050]: Note: 1: 2318 2:
MSI (s) (D4:F0) [09:41:05:050]: Calling SRSetRestorePoint API. dwRestorePtType: 13, dwEventType: 103, llSequenceNumber: 26, szDescription: "".
MSI (s) (D4:F0) [09:41:05:050]: The call to SRSetRestorePoint API succeeded. Returned status: 0.
MSI (s) (D4:F0) [09:41:05:050]: Unlocking Server
MSI (s) (D4:F0) [09:41:05:066]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 9:41:05: INSTALL. Return value 3.
Thanks!
Johnmen