Hi folks. I am new to the forums. Hope all is well with you.

My office is pushing to have all of our virtual and physical machines antivirus manager by Symantec Endpoint protection manager 12.1.4. I did the install and pushed to the clients of my choosing. But it seems the virtual machines are stated as "Offline" and they don't have SEP installed on them. but the physical machines do show up. In status, the VMs show as needing a reboot in order to start the installs. Which I have done and it didn't help my issue.

Our network is not connected to the internet, so doing live updates is not an option. I did export a package to be installed directly onto the machines manually, which also failed. Does anyone have any suggestions?

Post the SEP_INST.log file in the %temp% directory for review

I wish i could, but there are no .log file of any sort in the temp directory. The weird thing is in the program files there is a SEP folder. No program files at the lowest level of the directory though. just an installscript.sis file. And this is the constant for all the virtual machines.

Have you try to installed manually SEP client ?

Using Symantec Endpoint Protection in virtual infrastructures

http://www.symantec.com/docs/HOWTO81060

Best practices for virtualization with Symantec Endpoint Protection 12.1.2

http://www.symantec.com/docs/TECH197344

Symantec Endpoint Protection 12.1 & Virtualization

http://www.symantec.com/docs/TECH194383

Yes I did. What I did is from SEPM, I created an install package based on the policies already in place on the other machines. Which, when I think about it, is probably not the best idea because the other machines are physical machines and probably have some differences of course.

One thing of note too is we have one physical server. It too didn't get the install. Could there be an issue with putting SEP on servers? The successful machine are windows 7 machines (physical machines)

I'd second _Brian's post, the install log is definitely the place to start if this is failing both remotely (via the Client Deployment Wizard) and locally (while logged in).

Regarding the log location however, for machines that were pushed to remotely, the SEP_INST.log file should be in C:\windows\temp, while running the installer manually should pop the log file in the %temp% directory of the user that ran it (i.e. C:\users\<UserName>\appdata\local\temp)

What you said is right, there should be a common thing on these servers, just make sure you are not pushing / installing 32 bit of SEP install on 64 bit machine.

try to install a client on VM from CD1\SEP folder interactive.. if there is any error it should pop up

What logs do I need to gather in order to troubleshoot a failed SEP 12.1 client installation?

http://www.symantec.com/business/support/index?page=content&id=TECH164067

Remove any remnants you're finding and export an unmanaged package and try installing that, preferably with AV only. Once installed you can replace the sylink and add additional components

I tried to do an install by having SEPM create .exe files for me to install myself. Just the basic install with SEP and thats it. During the install, it started to ROLLBACK and then it said that it was interrupted and was not able to finish.

So due to the nature of our environment, it is harder for me to post the findings from the SEP_INST.log file. Concerning this interruption, what should I be looking for in the log file? It is mighty lenghty, so if there is a particular search string I can input, that might be helpful.

 

Thanks in advance

This link gives a better idea of what to look for in the SEP_INST and SIS_INST logs

http://www.symantec.com/docs/TECH164067

• For failures in SEP_INST.log search for Value 3
• For failures in SIS_INST.log search for "failed to execute" "returning non-success" and "ACTION_FAILED."

Look for the first occurance of  "return value 3 " post around 100 lines above and below of that error

Is it Windows server ?

It is a windows 2008 servers. These seem to be the common culprit, because it works on my windows 7 machines just fine. I'll look into these solutions and report back. Thanks!

 

So yes, it seems like I am getting that VALUE 3 error. So my folks are working on a way to update our root certificates in our OFFLINE environment. We were due to put a bunch of updates on the WSUS and distribute it that way. If not, then we may take the more direct approach and distribute via group policy to each VM. Thanks guys.