Data Loss Prevention

I'm trying to migrate from 11.5 agents version to 12.0.1 and I'm often (70%) encountering errors shown below:

- AgentInstall64 -- action: failed to open watchdog service -- result: Unspecified error

-Product: AgentInstall64 -- 2013-12-19 16:09:57 | BackupExistingDatabaseFiles | SEVERE | MsiGetProductInfo( "{2AF3B399-42A5-42bd-A5E0-72B657110363}", INSTALLPROPERTY_VERSIONSTRING, buf, &sz ) returned 1608

I follow all the steps in this order:

1. Uninstall the agent;

2. reboot\no reboot (both do not affect the result);

3. Trying to install new agent.

The same errors occur when I use SMP, SCOM or manually with install_agent64.bat

You need to use administrator to uninstall and install the DLP agent. Just check the user's rights.

I have domain administrator rights, which I use during installation.

I think its better option that remove/uninstall 11.5 and try with 12.01 ver

I do remove/uninstall, then try with 12.0.1, as I wrote.

Please check if there are any Active Directory group policies applied on the machine. Some group policies resist any services to get started on the machines.

You may have to remove the applied group policies first , then restart and then install agent.

I hope this helps..

Try to remove all registry entries of DLP , You can take help of any Revo uninstaller and try to trace and clean all registry entries after that reboot and try to install . Also refer the below as I had faced such issue in past.

please refer below

https://www-secure.symantec.com/connect/forums/edpa-service-not-working-dlp-agent

https://www-secure.symantec.com/connect/forums/how-unistall-symantec-dlp-agent-individual-computer

https://www-secure.symantec.com/connect/forums/dlp-agent-cant-uninstall

hello ALEXMI,

Is your problem resolved ?? I am stuck at the same error .

can you explain what you did to resolve the issue ?

Rgds,

Asutariya

I still have this issue.

I tried to clean registry entries manually and with revo uninstaller, but nothing helps.

The only way is  - reinstall OS, and it's sad.

Well, That does not sound good !

have you opened the support ticket ?

we have many machines with this error and do not know what to do !

can someone pls. comment on this ??

open a support ticket.

Hello .. can someone pls confirm is the latest version of the DLP agent is 12.0.1 ?

is there any hotfix that resolves this problem ?

I am trying to do fresh install on some of  the machines and I get

-Product: AgentInstall64 -- 2014/03/17 16:09:57 | BackupExistingDatabaseFiles | SEVERE | MsiGetProductInfo( "{2AF3B399-42A5-42bd-A5E0-72B657110363}", INSTALLPROPERTY_VERSIONSTRING, buf, &sz ) returned 1608

This error is so random that we get in half of the machines while half of them installs fine.

when we delete certain registry keys and install via commandline it works fine, we then uninstall product using REVO uninstaller and delete all 36 leftover file. but problem still persists when we try to install over SCCM.

Rgds,

Ankit S.

HI All,

I am just attaching MSI LOGS . I think product during install is thinking that there is already existing product and it tries to read existing install rpoerties and throws an error.

=== Logging started: 19/03/2014  17:35:26 ===
Action start 17:35:26: INSTALL.
Action start 17:35:26: SystemFolder.30729.4148.Microsoft_VC90_CRT_x86.QFE.AA2EBBCC_4E3B_3442_865E_7BB3E9F45F0C.
Action ended 17:35:26: SystemFolder.30729.4148.Microsoft_VC90_CRT_x86.QFE.AA2EBBCC_4E3B_3442_865E_7BB3E9F45F0C. Return value 1.
Action start 17:35:26: SystemFolder.30729.4148.Microsoft_VC90_ATL_x86.QFE.0901F145_82C9_3BF6_A91B_31F6791950EA.
Action ended 17:35:26: SystemFolder.30729.4148.Microsoft_VC90_ATL_x86.QFE.0901F145_82C9_3BF6_A91B_31F6791950EA. Return value 1.
Action start 17:35:26: WindowsFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E.
Action ended 17:35:26: WindowsFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E. Return value 1.
Action start 17:35:26: SystemFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E.
Action ended 17:35:26: SystemFolder.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E. Return value 1.
Action start 17:35:26: WindowsFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E.
Action ended 17:35:26: WindowsFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E. Return value 1.
Action start 17:35:26: SystemFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E.
Action ended 17:35:26: SystemFolder.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E. Return value 1.
Action start 17:35:26: ISSetAllUsers.
InstallShield 17:35:26: Begin SetAllUsers()
InstallShield 17:35:26: Getting records from Upgrade table
InstallShield 17:35:26: UpgradeCode: {F8D8827A-4C61-4956-866C-E66A6B30E0A2} MinVersion: 12.0.0.27062 MaxVersion:  Language:  Attributes: 2
InstallShield 17:35:26: Checking related product {D39272A1-C04C-4295-8558-79E1991BA4FC}
InstallShield 17:35:26:  AgentInstall {D39272A1-C04C-4295-8558-79E1991BA4FC} 1033   ***Related***
InstallShield 17:35:26: ALLUSERS of related product {D39272A1-C04C-4295-8558-79E1991BA4FC} is = 1
InstallShield 17:35:26: End SetAllUsers()
Action ended 17:35:26: ISSetAllUsers. Return value 1.
Action start 17:35:26: AppSearch.
Action ended 17:35:26: AppSearch. Return value 0.
Action start 17:35:26: LaunchConditions.
Action ended 17:35:26: LaunchConditions. Return value 1.
Action start 17:35:26: FindRelatedProducts.
Action ended 17:35:26: FindRelatedProducts. Return value 1.
Action start 17:35:26: ReadExistingInstallProperties.
2014-03-19 17:35:26 | FindInstalledProduct | INFO | Product Code: '{D39272A1-C04C-4295-8558-79E1991BA4FC}'
2014-03-19 17:35:26 | ReadExistingInstallProperties | INFO | calling MsiGetProductInfo( "{D39272A1-C04C-4295-8558-79E1991BA4FC}", INSTALLPROPERTY_VERSIONSTRING, buf, &sz )
MSI (s) (F0!F0) [17:35:28:824]: Product: AgentInstall -- 2014-03-19 17:35:26 | ReadExistingInstallProperties | SEVERE | MsiGetProductInfo( "{D39272A1-C04C-4295-8558-79E1991BA4FC}", INSTALLPROPERTY_VERSIONSTRING, buf, &sz ) returned 1608: Unknown property.

2014-03-19 17:35:26 | ReadExistingInstallProperties | SEVERE | MsiGetProductInfo( "{D39272A1-C04C-4295-8558-79E1991BA4FC}", INSTALLPROPERTY_VERSIONSTRING, buf, &sz ) returned 1608: Unknown property.

2014-03-19 17:35:28 | ReadExistingInstallProperties | INFO | GetInstalledProduct(): no Vontu Agent product installed
ReadExistingInstallProperties(): Could not read currently installed product location, will not attempt to read existing config.
Action ended 17:35:28: ReadExistingInstallProperties. Return value 1.
Action start 17:35:28: ValidateProductID.
Action ended 17:35:28: ValidateProductID. Return value 1.
Action start 17:35:28: WindowsFolder.30729.4148.Microsoft_VC90_ATL_x86.QFE.0901F145_82C9_3BF6_A91B_31F6791950EA.
Action ended 17:35:28: WindowsFolder.30729.4148.Microsoft_VC90_ATL_x86.QFE.0901F145_82C9_3BF6_A91B_31F6791950EA. Return value 1.
Action start 17:35:28: WindowsFolder.30729.4148.Microsoft_VC90_CRT_x86.QFE.AA2EBBCC_4E3B_3442_865E_7BB3E9F45F0C.
Action ended 17:35:28: WindowsFolder.30729.4148.Microsoft_VC90_CRT_x86.QFE.AA2EBBCC_4E3B_3442_865E_7BB3E9F45F0C. Return value 1.
Action start 17:35:28: WindowsFolder.30729.4148.policy_9_0_Microsoft_VC90_ATL_x86.QFE.36F772C3_DEA7_32C0_AD18_338903366207.
Action ended 17:35:28: WindowsFolder.30729.4148.policy_9_0_Microsoft_VC90_ATL_x86.QFE.36F772C3_DEA7_32C0_AD18_338903366207. Return value 1.
Action start 17:35:28: WindowsFolder.30729.4148.policy_9_0_Microsoft_VC90_CRT_x86.QFE.EB5BA578_FF7F_3863_8E53_7A003222B7FC.
Action ended 17:35:28: WindowsFolder.30729.4148.policy_9_0_Microsoft_VC90_CRT_x86.QFE.EB5BA578_FF7F_3863_8E53_7A003222B7FC. Return value 1.
Action start 17:35:28: CostInitialize.
Action ended 17:35:28: CostInitialize. Return value 1.
Action start 17:35:28: ResolveSource.
Action ended 17:35:28: ResolveSource. Return value 1.
Action start 17:35:28: FileCost.
Action ended 17:35:28: FileCost. Return value 1.
Action start 17:35:28: IsolateComponents.
Action ended 17:35:28: IsolateComponents. Return value 0.
Action start 17:35:28: CostFinalize.
Action ended 17:35:28: CostFinalize. Return value 1.
Action start 17:35:28: CheckTDI.
No existing DLP TDI driver was found.
Action ended 17:35:28: CheckTDI. Return value 1.
Action start 17:35:28: ValidateInputParameters.
Action ended 17:35:29: ValidateInputParameters. Return value 1.
Action start 17:35:29: PreMajorUpgradeCleanup.
2014-03-19 17:35:29 | PreMajorUpgradeCleanup | FINE | ResetSharedDLLCountsToOne(): success
Action ended 17:35:29: PreMajorUpgradeCleanup. Return value 1.
Action start 17:35:29: SetServiceNames.
Action ended 17:35:29: SetServiceNames. Return value 1.
Action start 17:35:29: SetARPINSTALLLOCATION.
Action ended 17:35:29: SetARPINSTALLLOCATION. Return value 1.
Action start 17:35:29: SetODBCFolders.
Action ended 17:35:29: SetODBCFolders. Return value 0.
Action start 17:35:29: MigrateFeatureStates.
Action ended 17:35:29: MigrateFeatureStates. Return value 1.
Action start 17:35:29: SetServiceNamesFromRegistry.
Action ended 17:35:29: SetServiceNamesFromRegistry. Return value 1.
Action start 17:35:29: StopAltirisAgent.
2014-03-19 17:35:29 | StopAltirisAgent | INFO | MSI VersionNT property: 501, MSI WindowsBuild property: 2600, MSI MsiNTProductType property: 1
2014-03-19 17:35:29 | StopAltirisAgent | INFO | Is OS Windows 7 or Higher: 0
2014-03-19 17:35:29 | StopAltirisAgent | INFO | IsProcess64: Inside True32 process
2014-03-19 17:35:29 | StopAltirisAgent | INFO | Could not read the Altiris Agent reg key -- AA does not appear to be installed.
2014-03-19 17:35:29 | StopAltirisAgent | WARNING | Altiris Agent found, but version is 0.0, which is not compatible
2014-03-19 17:35:29 | StopAltirisAgent | INFO | stopAltirisAgent(): Couldn't find installed altiris agent info.
Action ended 17:35:29: StopAltirisAgent. Return value 1.
Action start 17:35:29: StopVontuServices.
MSI (s) (F0!C4) [17:35:30:199]: Product: AgentInstall -- action: failed to open watchdog service -- result: Unspecified error

I'm facing exactly the same issue here. Using SCCM software distribution module (which has full domain admin rights) does not work as well.

I've attached the msi install log for one of the failed machines.

Attachment(s)

dlp_log_install_0.txt   687 KB 1 version

Farid,

Are you running SEP ( Symantec anti virus ) also ?

have you done AV exclusion for kvoop.exe under endpoint install directory ?

Are you using 12.0.1 or 12.0  Agent ?

Rgds,

ANkit s.

Did you find out which exactly registry entry or files we need to delete for installation without any issues?

I have over 50 machines with this issue after deinstallation with SMP, or dirty deinstallation :(

I'm installing 11.6 and found that these are the registry keys that need to be deleted off. I've attached the batch file here. You will need to change the extension if you want to run it as a batch.

Also, i had to make sure that i rebooted the machine after running the batch file. Not doing so will fail the installation.

Attachment(s)

RegRemove.txt   297 B 1 version

Hi have you tried searching in the registry the EDPA and WDP? or in your configuration did you change the required services for DLP? is that so you need to find the right services.if you already deleted all the services of DLP try to reinstall it again. you can install it successfully...

thanks

hope this help you

Yes, I've deleted entries for both services. There are more registry entries than this two.

Occasionally, the Symantec DLP Agent uninstaller does not remove all of the files from the previous version of the Symantec DLP Agent from your system. This happens if a previous installation process failed and the reference count of the installed files is not reset to 1.

You must manually delete any files that have not been deleted.

If you are using clean_agent.exe for cleaning corrupt agent installations and have Norton Internet Security installed on same endpoint, there is a possibility that Norton will treat clean_agent.exe as a virus and will delete it.

Your just need to do the below

White-list clean_agent.exe in Norton Internet Security application.

You cannot upgrade Symantec DLP Agent running on Microsoft Vista Business SP2 computers. The Symantec DLP Agent services do not restart automatically after the upgrade.

Repair the installation after the upgrade is complete.

The Symantec DLP Agent installation does not support Windows Logo driver certification policy.

Disable Windows Logo certification policy before you install the Symantec DLP Agent.