I'm upgrading version 12.1.4013 to 12.1.4100 to about 30 WinXP computers. 10 of them fail to upgrade. I have tried exporting client package and manually installing the managed client. Installation goes as far as starting services, then executing scripts. After that it starts rolling back and undoing everything. The end result is failed installation.

I manually run CleanWipe.exe. Reboot twice. Download version 12.1.4100 client setup (Symantec_Endpoint_Protection_12.1.4_MP1_Win32-bit_Client_EN). Install as unmanaged client. Same thing happens. Installation goes as far as "Executing install script via service". That's the last status. It's followed by "rolling back action". The result is also failed installation.

What should I do now? I have 3 computers without AV right now. SEP setup keeps rolling back and failing to install.

On an affected client, navigate to %temp% directory and look for the SEP_INST.log and SIS_INST.lof files and post here for review.

What logs do I need to gather in order to troubleshoot a failed SEP 12.1 client installation?

Attached is SEP_INST.LOG in ZIP format. SEP_INST.LOG file is taken from a \Windows\Temp folder on a computer that fails to upgrade. I don't know how many iterations of attempts is in the log. The file size is about 3.2MB.

I can't find the other file you mentioned. It does not exist.

Attachment(s)

SEP_INST_86.zip   198 KB 1 version

Look in %AllUsersProfile%\Application Data\Symantec\Symantec Endpoint Protection\%currentversion%.105\Data\Install\logs

for SIS_INST.log file

Or just do a system search

CleanWipe must have deleted SIS_INST log file.

Attached is SIS_INST log taken from another computer (THINKCENTER) that fails to auto upgrade. I have not attempted to manually upgrade SEP on this computer. It still runs the older version 12.1.4013.4013.

I see 2 folders under \Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection folder. They are 12.1.4013.4013.105 and 12.1.4100.4126.105. The former has SIS_INST.LOG file and the latter (newer version) does not.

The attached SIS_INST.LOG file is from the following folder:

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\Data\Install\Logs

I also attached a new SEP_INST.LOG taken from C:\Windows\Temp on that same computer. Ignore the SEP_INST.LOG file I posted earlier. It was taken from a different computer (NETVISTA07).

Let me know what you think the cause is. Thanks much.

Attachment(s)

SEP_INST_87.zip   9 KB 1 version

SIS_INST_4.zip   244 KB 1 version

MSI (s) (C8:5C) [09:23:27:697]: Product: Symantec Endpoint Protection -- 4Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.

4Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
Action ended 9:23:27: LaunchConditions. Return value 3.

Delete below reg key and re-try install. DO NOT reboot after deleting the key. Immediately run the setup after deleting.

Open regedit and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\

delete PendingFileRenameOperations key

Communicate LC: NOT VersionNT64=1
Communicate LC: NOT Version9X=1
Communicate LC: VersionNT > 500=1
Communicate LC: NOT WINDOWSFUNDAMENTALS=1
Communicate LC: (NOT MIGRATIONPENDINGREBOOT) OR SISFAILED=1
Communicate LC: (NOT UNINSTALLREBOOTREQUIRED) OR Installed=0
Communicate LC: Symantec Endpoint Protection has detected that there are pending system changes that require a reboot

Symantec Endpoint Protection Client installation failed: error ""Pending system changes that require a reboot have been detected" "

Do you try to install previous sep client version ? We have seen some couple of thread of upgrade failed in win xp OS.If  installation has Successes you need to contact symantec support for more troubleshooting

Some other thread

https://www-secure.symantec.com/connect/forums/failure-upgrade-sep-11-12

https://www-secure.symantec.com/connect/forums/endpoint-deployment-roll-back-while-installing

As long as you did not reboot after deleting the key and it still failed, post a new SEP_INST.log as it should be a different error message.

PendingFileRenameOperations deleted. Retry installing and I get this message:

Symantec Endpoint Protection has detected that there are pending system changes that require a reboot. Please reboot the system and rerun the installation.

That does not work. I'm going to read the rest of the replies now.

Here's a bit of history. There are more than 10 WinXP computers. Those computers used to run (managed) SEP 11.0.5. I successfully deployed version 12.1.4013 through managed deployment a couple of months ago. I did not touch any of the computers (including 32bit/64bit Windows 7 PCs) and they were all upgraded to 12.1.4013 without a problem.

I see there is a newer version now so I'm upgrading them to 12.1.4100. About 10 WinXP fails to install. The rest of WinXP and Windows 7 machines are upgraded to 12.1.4100 without any problem. I'm going to try installing 11.0.5 on the problem PCs now.

Out of curiosity can you try installing an unmanaged 12.1.4 version with only AV installed?

I did. I got the same "rolling back..." crap.

I just installed unmanaged 11.0.5 successfully. How do I turn this into managed SEP? The SEPM version I'm using is 12.1.4104.

Just replace the sylink file with one from the SEPM. You can use the SEPm to do it:

Restoring client-server communications with Communication Update Package Deployment

Do you still have the sylink from the failed unmanaged install of 12.1.4?

There has to be something going, some check that just doesn't like it. Or who knows, could even be a bug.

I followed the article: "Restoring client-server communications with Communication Update Package Deployment". SEP 11.0.5 is now a managed client. Next, I will do manual installation of SEP 12.1.4100 using an exported installation package. Fingers crossed. I'm tired of seeing the "rolling back" message.

Grab the sylink if it fails...11.x installs but 12.1 does not...would love to know what changed in the install process.

You can use Auto upgrade feature for Upgrading SEP 11.x to SEP 12.x

Upgrade clients to SEP 12.1 by Auto upgrade feature

https://www-secure.symantec.com/connect/articles/upgrade-clients-sep-121-auto-upgrade-feature

How to upgrade Symantec Endpoint Protection clients using the Auto-Upgrade feature

It FAILED!

SEP 12.1.4 rolls back. It does not remove SEP 11 but screws it up. After restarting the PC, SEP 11 is still there but does not run properly.

I am doing SEP 11 repair now.

Have you follow the article?

http://www.symantec.com/docs/TECH208775

UPDATE

I restored SEP client installation package version 12.1.4013.4013 from the backup. I install this on a computer that is left without any AV due to constant failure to install the latest version. That version installs flawlessly.

I also use the package to upgrade 11.0.5 installation on another PC. No problem there either. SEP gets upgraded to 12.1.4013.

I'm going to quit messing around with the 10 computers that fail to upgrade to 12.1.4100. I'll leave them running 12.1.4013. I can't say this with absolute certainty but the latest version may be buggy. Other users are having the same problem I'm having.

I don't have the 64-bit client install package. Does anyone know how I can get 12.1.4013 for 64-bit Windows? It's no longer available for download in flexnetoperations.com

Call support, they'll give you the download link

This package you can find in console under admin. Export from there

Exporting client installation packages