Endpoint Protection

Wondering if anyone else had this issue, or possibly a bad download of the files from fileconnect?  On existing 12.1.3001.165 clients or brand new servers with no antivirus installed the client install package I created keeps rolling back on servers and clients.  The rollback happens after "Executing install script via service".  As per the tech doc TECH170259 I have tried creating a package with no start menu but have the same problem doing either an upgrade or a clean install. I also tried just creating a new package which was also unsuccessful.  Curiously win7 clients that I deploy from the SEPm console work fine with the 12.1.4100.4126 package (upgrade from 12.mr3) but installing from an exported client package produces the error.  Installing directly from a 12.1.3001.165 or 12.1.4013.4013 package works fine but those products have bugs that were fixed in the latest version. Logs attached please advise...otherwise I will just open a ticket.

Thanks,

Larry

Attachment(s)

SEP_INST.zip   226 KB 1 version

SIS_INST.zip   137 KB 1 version

Try this if applicable

Certificate error occurs when attempting to install or upgrade Symantec Endpoint Protection

See these

Certificate error occurs when attempting to install or upgrade Symantec Endpoint Protection

http://www.symantec.com/docs/TECH218029

Symantec Endpoint Protection 12.1 RU4 installation or migration on Windows fails due to outdated root certificate

http://www.symantec.com/docs/TECH217284

So the 12.1.4100.4126 installation has new certs that aren't in the 12.1.4013.4013 or 12.1.3001.165 client installs?  Or rather my server needs a newer CTL to verify the 12MR41 package?  Just want to make sense of this before trying multiple solutions. I will advise thanks guys.

Its an updated cert needed for the server

Cause

The computer has not updated the appropriate root certificates and therefore cannot validate the Symantec Endpoint Protection binaries. For example, this issue can occur if certificates are removed by the system administrator or with Windows Server 2003 because the base image does not include currently valid root certificates.

Brian,

I get that but these are 2008 r2 servers that are setup to get root cert updates from microsoft, and on top of that only the latest SEP version client install has this issue.  I can see based on the doc you sent that the server is missing a verisign root cert. So that means this something had to be updated between 12.mr4 and 12mr41 requiring that cert, or the rtm 12 mr4 (12.1.4013.4013 ) doesn't require the cert check right? Because that installs right now with no issues.  I'm going to get microsoft to verify the cert update process on the servers first because the last patch cycle definitely caused an issue....then I will cycle back to this and try the update again.

Thanks,

12.mr4 and 12mr41 requiring that cert, or the rtm 12 mr4 (12.1.4013.4013 ) doesn't require the cert check right?

That issue are occured on 12.1 RU4/12.1.4.1 both version.

Thanks for the help guys after I got the automatic root certs working again in our infrastructure (It was disabled at the top of the domain policy in Active Directory) the 12.1.4100.4126 installation both installs, or upgrades, smoothly....points awarded.

James007, now maybe the servers that I spot checked the install/upgrade on already had root certs for the 12.1.4013.4013 install.... but I'm pretty sure the only SEP version that need "new" certs  was 12.1.4100.4126. It's reproducible on any server that I prevent from getting new certs.

I had no problems taking a newly provisioned server and installing or upgrading 12.1.3001.165 or 12.1.4013.4013 without needing new certs...I refer to the full versions because the MR/RU/MP stuff is getting confusing....not sure if what I referenced is RTM or not ....I think so though.