I'm trying to install a 12.1.4 client package on XP sent via an email from SEPM. When I run Setup.exe I get a message saying:

"Symantec Endpoint Protection has detected that there are pending system changes that require a reboot. Please reboot the system and rerun the installation."

A reboot doesn't help. I have spent the last 6 hours scouring Google and I can see this is a pretty common problem. I have cleared the registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\PendingFileRenameOperations

...but it makes no difference. If I do reboot and try it again, the first time I try and install it hangs for a long time as "Please wait while Windows configures Symantec Endpoint Protection" and then it just disappears without any warning errors. At THIS point, the previsouly cleared "PendingFileRenameOperations" registry key gets filled with hundreds of lines of these:

\??\C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\Bin\TBDEB.tmp

\??\C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\Data\Cached Installs\Program Files\Symantec\Name\Version\Bin\ccIPC.dll

\??\C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\Data\Cached Installs\Program Files\Symantec\Name\Version\Bin\ccL120U.dll

\??\C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\Data\CmnClnt\ccGEvt\Global\LM2.dat

\??\C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\Data\CmnClnt

Please note this is just an extract, I can post more if it's needed.

The only other info I have is that someone tried to install a vesion of SEP 12.1 (unmanaged) before me and it failed with a different error. See the 5th image attached for this error, no idea if this is related.

See this articles

Symantec Endpoint Protection Client installation failed: error ""Pending system changes that require a reboot have been detected" "

After deleting the reg key, do not reboot. Run the install immediately.

Thank you for the quick responses.

Brian - I have tried installing after deleting the reg key without rebooting about 5 times now and it's not helping me.

Mr Bond - I have also already gone throug that article and I can confirm I've tried deleting the 32 bit
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec_Installer.

One other point, not sure if it's important, but SEPM is showing the system in the Client Group (as offline) since I tried to install.

If it showing in the SEPM, it was installed at some point. Does anything show in add/remove programs?

Haveyou tried cleanwipe?

That info will be in DB for 30 days ( default) , it will be delete automatically after that period or you can delete it manually after install it would showup with green dot.
 

Go through this article there are 3 reg keys in total.

https://www-secure.symantec.com/connect/articles/pending-file-rename-operations

if it fails , run any previous version of SEP and then upgrade to 12.1.4

Brian - Nothing shows in add/remove progs. Where can I get cleanwipe from? I think I read that I need to open a support ticket with Symantec..

Rafeeq - Sorry, what info will be in which DB - the SEPM's client info? Doesn't that green dot just signify if the system is online with SEP?

I have checked for the PendingFileRenameOperations key in all Control set trees and can confirm CurrentControlSet is the only one which gets populated.

I'm starting to think the issue I need to get resolved is not the "detected pending system changes" error, but the fact that the first time I install it, it just disappears half way through the Windows installation process, because I only the detected pending system changes error the Second time I try and install (after having cleared that registry and rebooted). Should I start a new thread for this?

Latest version of CleanWipe is available 12.1.4013.4013 in

Symantec_Endpoint_Protection_12.1.4_Part2_Tools_EN\CleanWipe on file connect

https://symantec.flexnetoperations.com/control/symc/registeranonymouslicensetoken

Also try this articles

http://www.symantec.com/business/support/index?page=content&id=TECH103109

Many thanks James - I have now tried the Cleanwipe tool but sadly it's not made any difference.

I think I've probably focused too much on the "pending system changes" error here... that only happens after the initial failed install (which makes sense when you understand the error). What I need to get to the bottom of is why the initial install doesn't work.

All I have to go on at the moment is that after I clear our the registry and/or run the cleanwipe tool and then reboot, when I try and install 12.1.4 the Windows installer comes on, I see the the image below (03 - install delay.png) then it hangs for about 20 seconds, then I see the image 06 - 0 seconds waiting.png

After that everything disappears, no error popups. Is there an install log anywhere?

Can you provide sep.inst log available in %temp%

I couldn't find a sep.inst but found a SYMEVENT.LOG in C:\Windows\Temp

[03/26/14 14:39:15][PID:3092] --------------------------------------------------
[03/26/14 14:39:15][PID:3092] Installed Version (if any) is not newer.
[03/26/14 14:39:15][PID:3092] Acquiring Global\Symevent_running mutex...
[03/26/14 14:39:15][PID:3092]   Successfully acquired mutex.
[03/26/14 14:39:15][PID:3092]   Installed version isn't newer after waiting on the mutex.
[03/26/14 14:39:15][PID:3092] Symevent Installer (c)1998-2013 Symantec Corporation
[03/26/14 14:39:15][PID:3092] Launched from: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\bin\Sevinst.exe
[03/26/14 14:39:15][PID:3092] Compiled Version 12.9.5.3
[03/26/14 14:39:15][PID:3092] Logging Events Beginning 03/26/2014 at 14:39
[03/26/14 14:39:15][PID:3092] Operating System Detected -> Windows XP
[03/26/14 14:39:15][PID:3092]   Additional Info: dwOSVersionInfoSize is 0x00000114
[03/26/14 14:39:15][PID:3092]   Additional Info: dwMajorVersion      is 0x00000005
[03/26/14 14:39:15][PID:3092]   Additional Info: dwMinorVersion      is 0x00000001
[03/26/14 14:39:15][PID:3092]   Additional Info: dwBuildNumber       is 0x00000A28
[03/26/14 14:39:15][PID:3092]   Additional Info: dwPlatformId        is 0x00000002
[03/26/14 14:39:15][PID:3092]   Additional Info: szCSDVersion        is Service Pack 3
[03/26/14 14:39:15][PID:3092] ----------------------------------------------------
[03/26/14 14:39:15][PID:3092] CommandLine=/Q /NoRegLU /NoVDD /HRESULT /NOSPMANIFEST SAVCE
[03/26/14 14:39:15][PID:3092] Symantec dir found using ProgramFilesDir: C:\Program Files
[03/26/14 14:39:15][PID:3092] Using temp path: C:\WINDOWS\TEMP\TEMP.^^^
[03/26/14 14:39:15][PID:3092] Common Files dir location found using CommonFilesDir: C:\Program Files\Common Files
[03/26/14 14:39:15][PID:3092] Symantec CommonFilesDir created using C:\Program Files\Common Files\Symantec Shared
[03/26/14 14:39:15][PID:3092]   Checking for existing SymEvent...
[03/26/14 14:39:15][PID:3092]   SymEvent wasn't found on the system.
[03/26/14 14:39:15][PID:3092]   GetFileVersionInfoSize(C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\bin\Sevinst.exe) start
[03/26/14 14:39:15][PID:3092]   GetFileVersionInfoSize(C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\bin\Sevinst.exe) end
[03/26/14 14:39:15][PID:3092] BEGIN - WM_CREATE
[03/26/14 14:39:15][PID:3092] FS8IB: Entering...
[03/26/14 14:39:15][PID:3092] FS8IB_GSDFL: Symantec dir not found using SharedUsage key. Done.
[03/26/14 14:39:15][PID:3092] FS8IB: Done w/o fix.
[03/26/14 14:39:15][PID:3092]   GetUsageCounts found an existing usage count of: 0
[03/26/14 14:39:15][PID:3092] END - WM_CREATE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_CREATESYMDIR
[03/26/14 14:39:15][PID:3092] END - IDM_CREATESYMDIR
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_CHECKUSAGEUPDATE
[03/26/14 14:39:15][PID:3092] In RemoveVxDOnNT
[03/26/14 14:39:15][PID:3092] Leaving RemoveVxDOnNT
[03/26/14 14:39:15][PID:3092]   Installing with unknown AppID and not yet registered with Sevinst.  Updating RefCounts.
[03/26/14 14:39:15][PID:3092] END - IDM_CHECKUSAGECOUNTUPDATE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_PREPARECOPY
[03/26/14 14:39:15][PID:3092] END - IDM_PREPARECOPY
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_STARTCOPY
[03/26/14 14:39:15][PID:3092] END - IDM_STARTCOPY
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092]   Copying file C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\bin\Sevinst.exe
[03/26/14 14:39:15][PID:3092]   File installed successfully: C:\Program Files\Common Files\Symantec Shared\SEVINST.EXE
[03/26/14 14:39:15][PID:3092] Inside UnMarkFilesForDeletion()
[03/26/14 14:39:15][PID:3092]   No files are marked for deletion, nothing to unmark.
[03/26/14 14:39:15][PID:3092] END - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092]   Copying file C:\WINDOWS\TEMP\TEMP.^^^\SYMEVENT.SYS
[03/26/14 14:39:15][PID:3092]   File installed successfully: C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
[03/26/14 14:39:15][PID:3092] Inside UnMarkFilesForDeletion()
[03/26/14 14:39:15][PID:3092]   No files are marked for deletion, nothing to unmark.
[03/26/14 14:39:15][PID:3092] END - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092]   Copying file C:\WINDOWS\TEMP\TEMP.^^^\SYMEVENT.SYS
[03/26/14 14:39:15][PID:3092]   File installed successfully: C:\Program Files\Symantec\SYMEVENT.SYS
[03/26/14 14:39:15][PID:3092] Inside UnMarkFilesForDeletion()
[03/26/14 14:39:15][PID:3092]   No files are marked for deletion, nothing to unmark.
[03/26/14 14:39:15][PID:3092] END - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092]   Copying file C:\WINDOWS\TEMP\TEMP.^^^\SYMEVENT.INF
[03/26/14 14:39:15][PID:3092]   File installed successfully: C:\WINDOWS\system32\Drivers\SYMEVENT.INF
[03/26/14 14:39:15][PID:3092] Inside UnMarkFilesForDeletion()
[03/26/14 14:39:15][PID:3092]   No files are marked for deletion, nothing to unmark.
[03/26/14 14:39:15][PID:3092] END - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092]   Copying file C:\WINDOWS\TEMP\TEMP.^^^\SYMEVENT.INF
[03/26/14 14:39:15][PID:3092]   File installed successfully: C:\Program Files\Symantec\SYMEVENT.INF
[03/26/14 14:39:15][PID:3092] Inside UnMarkFilesForDeletion()
[03/26/14 14:39:15][PID:3092]   No files are marked for deletion, nothing to unmark.
[03/26/14 14:39:15][PID:3092] END - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092]   Copying file C:\WINDOWS\TEMP\TEMP.^^^\SYMEVENT.CAT
[03/26/14 14:39:15][PID:3092]   File installed successfully: C:\WINDOWS\system32\Drivers\SYMEVENT.CAT
[03/26/14 14:39:15][PID:3092] Inside UnMarkFilesForDeletion()
[03/26/14 14:39:15][PID:3092]   No files are marked for deletion, nothing to unmark.
[03/26/14 14:39:15][PID:3092] END - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092]   Copying file C:\WINDOWS\TEMP\TEMP.^^^\SYMEVENT.CAT
[03/26/14 14:39:15][PID:3092]   File installed successfully: C:\Program Files\Symantec\SYMEVENT.CAT
[03/26/14 14:39:15][PID:3092] Inside UnMarkFilesForDeletion()
[03/26/14 14:39:15][PID:3092]   No files are marked for deletion, nothing to unmark.
[03/26/14 14:39:15][PID:3092] END - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092] END - IDM_COPYFILE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_UPDATEUSAGE
[03/26/14 14:39:15][PID:3092]   Symantec\S32EVNT1.DLL refcount is zero. Not incrementing.
[03/26/14 14:39:15][PID:3092]   Old RefCount: System32\S32EVNT1.DLL: 0
[03/26/14 14:39:15][PID:3092]   New RefCount: System32\S32EVNT1.DLL: 1
[03/26/14 14:39:15][PID:3092]   Old RefCount: System32\Drivers\SYMEVENT.SYS: 0
[03/26/14 14:39:15][PID:3092]   New RefCount: System32\Drivers\SYMEVENT.SYS: 1
[03/26/14 14:39:15][PID:3092]   Old RefCount: Symantec\SYMEVENT.SYS: 0
[03/26/14 14:39:15][PID:3092]   New RefCount: Symantec\SYMEVENT.SYS: 1
[03/26/14 14:39:15][PID:3092]   Symevent Service Does Not Exist
[03/26/14 14:39:15][PID:3092]     InstallService, opening SCM
[03/26/14 14:39:15][PID:3092]     InstallService, creating service
[03/26/14 14:39:15][PID:3092]     InstallService, closing service
[03/26/14 14:39:15][PID:3092]     InstallService, closing SCM
[03/26/14 14:39:15][PID:3092]   InstallService returned 00000000
[03/26/14 14:39:15][PID:3092] BEGIN - AddRemoveVDDEntry( C:\WINDOWS\system32\SYMEVENT.SYS, 0 )
[03/26/14 14:39:15][PID:3092] AddRemoveVDDEntry - NoVDD is set - bailing out.
[03/26/14 14:39:15][PID:3092] Constructed uninstall string: "C:\Program Files\Common Files\Symantec Shared\SEVINST.EXE" /U /Q
[03/26/14 14:39:15][PID:3092] Constructed reg key string: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sevinst
[03/26/14 14:39:15][PID:3092] AddUninstallKey: Reg value written
[03/26/14 14:39:15][PID:3092] END - IDM_UPDATEUSAGE
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_LUREGISTER
[03/26/14 14:39:15][PID:3092]   /NoRegLU switch used.  Not registering with LiveUpdate.
[03/26/14 14:39:15][PID:3092] END - IDM_LUREGISTER
[03/26/14 14:39:15][PID:3092] BEGIN - IDM_ALLDONE
[03/26/14 14:39:15][PID:3092] END - IDM_ALLDONE
[03/26/14 14:39:15][PID:3092]   Deleting C:\WINDOWS\TEMP\TEMP.^^^\SYMEVENT.SYS...Deleted.
[03/26/14 14:39:15][PID:3092]   Deleting C:\WINDOWS\TEMP\TEMP.^^^\SYMEVENT.INF...Deleted.
[03/26/14 14:39:15][PID:3092]   Deleting C:\WINDOWS\TEMP\TEMP.^^^\SYMEVENT.CAT...Deleted.
[03/26/14 14:39:15][PID:3092] Returning: 0 - Success, no reboot required.
[03/26/14 14:39:35][PID:3308] --------------------------------------------------
[03/26/14 14:39:35][PID:3308]   GetFileVersionInfoSize(C:\Program Files\Common Files\Symantec Shared\SEVINST.EXE) start
[03/26/14 14:39:35][PID:3308]   GetFileVersionInfoSize(C:\Program Files\Common Files\Symantec Shared\SEVINST.EXE) end
[03/26/14 14:39:35][PID:3308] Installed:12.9.5.3  This: 12.9.5.3
[03/26/14 14:39:35][PID:3308] Installed Version (if any) is not newer.
[03/26/14 14:39:35][PID:3308] Acquiring Global\Symevent_running mutex...
[03/26/14 14:39:35][PID:3308]   Successfully acquired mutex.
[03/26/14 14:39:35][PID:3308]   GetFileVersionInfoSize(C:\Program Files\Common Files\Symantec Shared\SEVINST.EXE) start
[03/26/14 14:39:35][PID:3308]   GetFileVersionInfoSize(C:\Program Files\Common Files\Symantec Shared\SEVINST.EXE) end
[03/26/14 14:39:35][PID:3308] Installed:12.9.5.3  This: 12.9.5.3
[03/26/14 14:39:35][PID:3308]   Installed version isn't newer after waiting on the mutex.
[03/26/14 14:39:35][PID:3308] Symevent Installer (c)1998-2013 Symantec Corporation
[03/26/14 14:39:35][PID:3308] Launched from: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\bin\Sevinst.exe
[03/26/14 14:39:35][PID:3308] Compiled Version 12.9.5.3
[03/26/14 14:39:35][PID:3308] Logging Events Beginning 03/26/2014 at 14:39
[03/26/14 14:39:35][PID:3308] Operating System Detected -> Windows XP
[03/26/14 14:39:35][PID:3308]   Additional Info: dwOSVersionInfoSize is 0x00000114
[03/26/14 14:39:35][PID:3308]   Additional Info: dwMajorVersion      is 0x00000005
[03/26/14 14:39:35][PID:3308]   Additional Info: dwMinorVersion      is 0x00000001
[03/26/14 14:39:35][PID:3308]   Additional Info: dwBuildNumber       is 0x00000A28
[03/26/14 14:39:35][PID:3308]   Additional Info: dwPlatformId        is 0x00000002
[03/26/14 14:39:35][PID:3308]   Additional Info: szCSDVersion        is Service Pack 3
[03/26/14 14:39:35][PID:3308] ----------------------------------------------------
[03/26/14 14:39:35][PID:3308] CommandLine=/Q /U /NOREGAPPID /NoRegLU /NoVDD /HRESULT /DelOnReboot SAVCE
[03/26/14 14:39:35][PID:3308] Symantec dir found using ProgramFilesDir: C:\Program Files
[03/26/14 14:39:35][PID:3308] Using temp path: C:\WINDOWS\TEMP\TEMP.^^^
[03/26/14 14:39:35][PID:3308] Common Files dir location found using CommonFilesDir: C:\Program Files\Common Files
[03/26/14 14:39:35][PID:3308] BEGIN - WM_CREATE
[03/26/14 14:39:35][PID:3308] FS8IB: Entering...
[03/26/14 14:39:35][PID:3308] FS8IB_GSDFL: Symantec dir not found using SharedUsage key. Done.
[03/26/14 14:39:35][PID:3308] FS8IB: Done w/o fix.
[03/26/14 14:39:35][PID:3308] END - WM_CREATE
[03/26/14 14:39:35][PID:3308] BEGIN - IDM_CHECKUSAGEUPDATE
[03/26/14 14:39:35][PID:3308]   Uninstalling with known AppID (or /NOREGAPPID).  Updating Refcounts.
[03/26/14 14:39:35][PID:3308] END - IDM_CHECKUSAGECOUNTUPDATE
[03/26/14 14:39:35][PID:3308] BEGIN - IDM_UNINSTALL_UI
[03/26/14 14:39:35][PID:3308] END - IDM_UNINSTALL_UI
[03/26/14 14:39:35][PID:3308] BEGIN - IDM_UNINSTALL
[03/26/14 14:39:35][PID:3308]   RefCount C:\WINDOWS\system32\Drivers\SYMEVENT.SYS reached 0.
[03/26/14 14:39:35][PID:3308]   Deleting C:\WINDOWS\system32\Drivers\SYMEVENT.SYS...Deleted.
[03/26/14 14:39:35][PID:3308]   RefCount C:\Program Files\Symantec\SYMEVENT.SYS reached 0.
[03/26/14 14:39:35][PID:3308]   Deleting C:\Program Files\Symantec\SYMEVENT.SYS...Deleted.
[03/26/14 14:39:35][PID:3308]   RefCount C:\WINDOWS\system32\S32EVNT1.DLL reached 0.
[03/26/14 14:39:35][PID:3308]   RemoveService returned: 0x00000000
[03/26/14 14:39:35][PID:3308]   Removed SymProtect Manifests.
[03/26/14 14:39:35][PID:3308]   Deleting C:\Program Files\Symantec\SYMEVENT.INF...Deleted.
[03/26/14 14:39:35][PID:3308]   Deleting C:\Program Files\Symantec\SYMEVENT.CAT...Deleted.
[03/26/14 14:39:35][PID:3308]   Deleting C:\WINDOWS\system32\Drivers\SYMEVENT.INF...Deleted.
[03/26/14 14:39:35][PID:3308]   Deleting C:\WINDOWS\system32\Drivers\SYMEVENT.CAT...Deleted.
[03/26/14 14:39:35][PID:3308]   Removed CAT and INF files
[03/26/14 14:39:35][PID:3308]   /NoRegLU switch used.  Not unregistering from LiveUpdate.
[03/26/14 14:39:35][PID:3308] BEGIN - AddRemoveVDDEntry( C:\PROGRA~1\Symantec\S32EVNT1.DLL, 1 )
[03/26/14 14:39:35][PID:3308] AddRemoveVDDEntry - NoVDD is set - bailing out.
[03/26/14 14:39:35][PID:3308]   Successfully deleted SymEvent regkey and subkeys using standard methods.
[03/26/14 14:39:35][PID:3308]   Setting Sevinst delete to TRUE
[03/26/14 14:39:35][PID:3308]   Sevinst attributes okay.  Attempting to delete the copy in the Symantec Shared folder.
[03/26/14 14:39:35][PID:3308]   Deleting C:\Program Files\Common Files\Symantec Shared\SEVINST.EXE...Deleted.
[03/26/14 14:39:35][PID:3308] RemoveUninstallKey: Constructed reg key string: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sevinst
[03/26/14 14:39:35][PID:3308] Sevinst Shared Usage value delete returned 0
[03/26/14 14:39:35][PID:3308] END - IDM_UNINSTALL
[03/26/14 14:39:35][PID:3308] BEGIN - IDM_ALLDONE
[03/26/14 14:39:35][PID:3308] END - IDM_ALLDONE
[03/26/14 14:39:35][PID:3308] Cannot delete Symantec directory (145).
[03/26/14 14:39:35][PID:3308] Returning: 0 - Success, no reboot required

I couldn't find a sep.inst file anywhere but found a SYMEVENT.LOG file in C:\WINDOWS\Temp

It's not letting me post the full contents in this thread, probably too big, so I've attached it as a text file.

Attachment(s)

SYMEVENT_4.txt   13 KB 1 version

Try to create manually sep.inst log

msiexec /i "SEP.msi" /L*V SEP_Inst.log

Troubleshooting client installation failures

There is one more pesky area - Windows Update - sometimes the preinstall check finds the following keys:

1. Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
2. Delete HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\FileRenameOperations
3. Do a Registry search on HKLM\SYSTEM and delete every PendingFileRenameOperations value found.
4. Restarted the Automatic Updates service.

Remember - when tinkering with the registry - this can result into some undesired effect to take place - it is important to back up the registry (or the specific changes that are made) in the case of needing to undo what has been changed.

After that is done - restart the machine and try the install again - however, may I also suggest installing the client locally as well (maybe an unmanaged client, then after install, link it up with the Sylink.XML file)

SEP_INST.LOG is the exact file name - located in %temp% (typically C:\Windows\Temp)

Does it work if you install any previous version of SEP?

Rafeeq - when I started I was trying to install 12.1.2 and got exactly the same error, so no different with 12.1.4

There is definitely no SEP_INST.LOG in C:\Windows\Temp either. I've got a Symantec call open, the support lady was also surprised by this.

Tony - there was no HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired (possibly I deleted this yesterday.. tried so many things now I can't remember)

I deleted all other PendingFileRename values found in HKLM\SYSTEM

I could't find an Automatic Updates services.

The first install attempt (before I got involved) was an unmanaged client.

RegMon is replaced now with ProcessMonitor, 

Run this and check where exactly its looking for that value in reg

http://technet.microsoft.com/en-us/sysinternals/bb896645

In the end I downloaded a stand alone copy of SEP and although it didn't install, it did create a SEP_INST.log file. I'm getting an installation error of 1603. Here's the last part of the log:

MSI (c) (B8:E8) [12:32:51:515]: Note: 1: 1708
MSI (c) (B8:E8) [12:32:51:515]: Product: Symantec Endpoint Protection Client -- Installation operation failed.

MSI (c) (B8:E8) [12:32:51:515]: Windows Installer installed the product. Product Name: Symantec Endpoint Protection Client. Product Version: 12.1.1101.401. Product Language: 1033. Installation success or error status: 1603.

MSI (c) (B8:E8) [12:32:51:531]: Grabbed execution mutex.
MSI (c) (B8:E8) [12:32:51:531]: Cleaning up uninstalled install packages, if any exist
MSI (c) (B8:E8) [12:32:51:531]: MainEngineThread is returning 1603
=== Verbose logging stopped: 28/03/2014  12:32:51 ===

I might start a new thread on this since it's not so related to the original discussion any more, but maybe this bit of information will help someone else in the future.

This Error occured on same system or other

See below articles

Error 1603 MainEngineThread is returning 1603

Symantec Endpoint Protection 12.1 client install rolls back, returning 1603

MainEngineThread is returning 1603 when uninstalling SEP 12.1 RU1 on Windows 7 and Windows XP machines 32 bit.

1603 is generic one.. full log will help..

please attach full log of sep_inst and sis_inst log files

Ok here are the files as requested

Attachment(s)

SIS_INST_10.txt   1.72 MB 1 version

SEP_INST_127.txt   3.60 MB 1 version

SEP client install rollback. SEP_inst.log show "InstallFinalize. Return Value 3"

Thanks, going through these steps now...

This might sound stupid but where can I get Liveupdate from?  I've tried downloading Symantec_Endpoint_Protection_12.1.4_Part2_Tools_EN.exe  but it's not in there.

Starting to fear that Re-installing the O/S is my only option here!

The correct version of LiveUpdate for SEP:

12.1.671.4971 (RTM) and SEP 12.1.1000.157 (RU1) should be 3.3.1.23.

12.1.1101.401 (RU1 MP1) it should be 3.3.2.2.

12.1.2015.2015 (RU2) it should be 3.3.100.15

Sorry to say I had to send this system back to the customer to format as we had a virus and couldn't get Symantec installed quickly enough.

I also had a support call open with Symantec and they couldn't resolve it either. I saw 1 other thread similar to this one and the guy also ended up formatting.

Seems to be a rare, but unresolved issue.

Yes,It's best option if you are not received any solution

Thanks for all your help everyone, much appreciated even without a resolution.

Thanks Tony K. I ran through these steps:

1. Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
2. Delete HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\FileRenameOperations
3. Do a Registry search on HKLM\SYSTEM and delete every PendingFileRenameOperations value found.
4. Restarted the Automatic Updates service.

But, I didn't restart and it worked for me