Endpoint Protection

Hello,

I have recently done an update of about 90 systems from 12.1.4x to 12.1.5.  All but a handful successfully updated via push from SEPM.  Of those that refused the push update I am currently working on one of several for which I can find no successful installation method.  I am at this point attempting to do a local install on the workstation (Win 7/64) - simply configuring it as an unmanaged workstaion for purposes of the install.  Very shortly after completing the preliminary install screens I am greeted by a popup with the message:  Error 997 Overlapped I/O operation is in progress.  There is some traffic on the web suggesting this is caused by Microsoft KB 2918614.  I tried uninstalling this KB and rerunning the install - same error.. I've run CleanWipe before virtually every install attempt - same error.  I've picked through the registry removing all references to Symantec Endpoint - same error. 

At this point I have attempted easily a dozen installs on this system with the same Error 997 each time.  I have since reinstalled KB2918614.  Subsequent installation attempts continue to yield the same error.

I am about convinced that it is not possible to install this product on certain systems.  Has anyone else successfully overcome the Error 997 issue?

Thank You,

Post the SEP_INST.log and SIS_INST.log files for troubleshooting:

What logs do I need to gather in order to troubleshoot a failed SEP 12.1 client installation?

Other thing you can try is to install an unmanaged, AV only version to see if that works.

Brian,

Thank you for your reply.  I've attached the SEP_INST.log.  The install did not, evidently, progress far enough to create a SIS_INST.log.  Toward the end of the log there is reference to the overlapped I/O issue.

Oddly enough when I went to attach the log file the web site indicated that .log file extensions were not allowed.  Among the list of allowed extensions was .doc - hence the attached file name extension.

Thank you,

Attachment(s)

SEP_INST_9.doc   83 KB 1 version

I'm sure you seen this but seems to be more related to MS:

http://blogs.msdn.com/b/vsnetsetup/archive/2014/10/27/error-997-overlapped-i-o-operation-is-in-progress-kb2918614-breaks-windows-installer-service.aspx

Have you fully patched the system?

Does it work if you opt out msi installer as per this KB

http://support.microsoft.com/kb/2918614

Brian / Rafeeq;

Yes the system is fully patched.  I also tried installing the recommended KB 3000988, with the same result.  I also tried installing the previously installed SEP version (12.1.4100.4126) which also yielded the same error - not surpisingly, I suppose, given what appears to a Microsoft installer break.  I then tried one more uninstall of KB2918614 followed by another SEP install attempt - still, same result.

So, I then tried the registry whitelist edit referenced by Rafeeq.  Finally, that allowed the installation to succeed!  So, at least in my experience, the only way to overcome the Error 997 - Overlapped I/O issue was to perform the registry edit. 

For what it's worth, the instructions at the link above seem to assume that the last key 'Installer' in the reference below already exists.  In my case, that had to be created as well.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer

Thank you for your assistance with this issue.  Hopefully someone else will find it useful.