Endpoint Protection

I've got some users that I have upgraded to RU12 and I have now applied the autoupgrade package to upgrade them to RU12 MP1. There are machines on various operating systems. The machines seem to accept the upgrade to RU12 MP1 but it never rolls out they just stay on RU12.

I've even tried removing the download package and replacing it with no effect. I can create a RU12 MP1 package and install it from fresh on the machines. An all users have admin access.

HI,

How many client not upgrade ?

do you have restart system ?

Post the contents of the SEP_INST.log file

Hello,

Could you post the SEP_Inst.log to understand the root cause of the issue?

Secondly, try restarting the client machines and check if that helps!!

Hi,

I gone through the SEP12.1 RU1 MP1 fix id's & I don't see any such known issue.

Could you check by removing older packages from the SEPM console if any available, under Admin --> Install Packages

Yes all machines have been restarted multiple times.

I'll need to try and get hold of one of the users to get the log to post here will put it up as soon as I can.

Unfortunatly I can't remove the older packages from the SEPM as we are still in the testing phase for SEP12 and fixing of this issue will determine if it gets rolled out across the entire estate or not.

Also it's not just our estate I've seen this issue on I've also seen it on another estate that also has RU12 MP1 on it.

HI,

Did you try Manually Upgrade one or two client ?

Tried a whole team. Uninstall of exisiting client and taking them directly to RU12 MP1 no issues at all. Only an issue when trying to auto upgrade directly from RU12 can see the machine has accepted the upgrade but never upgrades.

Here's the SEP_INST.log

Attachment(s)

SEP_INST_58.zip   143 KB 1 version

Hi GeoGeo,

Here we go. This is the error that occurs during the installation and a roll back of RU1 MP1 install occurs and then your SEP 12.1 RU1 is back.

MSI (s) (7C:DC) [09:48:03:303]: Product: Symantec Endpoint Protection -- Error 1406. Could not write value SEPINSTALLSCRIPTSDIR to key \SOFTWARE\Symantec\Symantec Endpoint Protection\{8E19EC70-F82A-411B-9AC2-0C96EDBFF802}\Common Client\PathExpansionMap.  System error .  Verify that you have sufficient access to that key, or contact your support personnel.

Error 1406. Could not write value SEPINSTALLSCRIPTSDIR to key \SOFTWARE\Symantec\Symantec Endpoint Protection\{8E19EC70-F82A-411B-9AC2-0C96EDBFF802}\Common Client\PathExpansionMap.  System error .  Verify that you have sufficient access to that key, or contact your support personnel.

1: CreateInstallCacheFin 2: 0
LinkAllExecutables  copying c:\Program Files\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\BHClient.dll to D:\PROFILES\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Cached Installs\Program Files\Symantec\Name\Version\Bin\BHClient.dll
LinkAllExecutables  Error: ActOnFile failed with: 0x6
1: LinkAllExecutables 2: 0
MSI (s) (7C:DC) [09:48:06:694]: User policy value 'DisableRollback' is 0
MSI (s) (7C:DC) [09:48:06:694]: Machine policy value 'DisableRollback' is 0
Action ended 09:48:06: InstallFinalize. Return value 3.

It might simply come from a missing registry key one the machines when this unexpected behavior occur.

Could you try to follow the instructions of this KB article on one of the machine where it fails GeoGeo ?

Then put back a package of SEP 12.1 RU1 MP1 on the Group test of one of this client machine to see if it works after the changes performed on his registries.

=> http://www.symantec.com/business/support/index?page=content&id=TECH173140

Keep us updated

Kind Regards,

A. Wesker

Hmmm ok that's interesting would there be any reason why the initial upgrade to RU12 would remove that registry key?

Just currently getting hold of a user to try and test the manual fix. If it works are there any plans for symantec to roll out a fix for this as don't fancy rolling this out manually to 10,000+ users

Ok managed to look at this on two users machines unfortunatly the link solution they have the registry key so that fix doesn't work

I think I've discovered the cause of the issue. Application & Device control policy > Protect client files and registry keys. In SEP 11 the ability to prevent the adjustment of registry keys was in the genneral settings in SEP 12 it has been moved to the policy.

To upgrade users once on SEP 12 you have to turn this off in your policy to allow them to upgrade.