Hi All,

I am facing an issue that when we try to install the latest version of the SEP client which was released after the latest vulnerability was discovered in the first week of August. When we try to upgrade the client, it works fine on all those who do not have the application and device control policy enabled.

On any clients that have the Application and Device Control Policy the client fails to install with the below error message: Error 1404. Could not delete key \SYSTEM\CurrentControlSet\Services\WGX. Verify that you have sufficient access to that key, or contact your support personnel.

Also, on the SEPM, this is how the client status looks like:

What are the permissions on that key? Are you installing as admin?

Can you post the SEP_INST.log or SIS_INST.log files from %temp% directory?

What logs do I need to gather in order to troubleshoot a failed SEP 12.1 client installation?

http://www.symantec.com/docs/TECH164067

Please see the attached logs from 3 different computers.

Thank You so much.

Attachment(s)

SEP_INST3.zip   394 KB 1 version

Below Error in SEP_Inst Log.

ScriptGen: ShowServiceProgress() Look for timeout starting SepMasterService or other failure loading SIS.dll.

See below thread and update Certificate

Certificate error occurs when attempting to install or upgrade Symantec Endpoint Protection

Certificate error occurs when attempting to install or upgrade Symantec Endpoint Protection

Have you tried with admin id?

Check these according to your error

Symantec Endpoint Protection Client install fails with MSI errors 1402 and 1406 in eventlog

SEP client installation rolls back at creating install cache.

https://www-secure.symantec.com/connect/forums/clients-upgrade-error 

SEP installation rolls back

We have about 1000+ clients facing the same issue, do you think there could be a better way to do this?

I will try the steps in the articles you suggested, but doing this individually for all those clients seems a bit troubling.

Appreciate your help in this matter.

What product do you have use for patch managemant ?

You can try above steps one ot two sep client if you will sucess you can deploy patch.

What the version you have tried for upgrade?

SEP 12.1 ru4 mp1b is latest version.

May be this issue fixed in this version. This version is only for client.

About the SYM14-013 Symantec Endpoint Protection zero-day vulnerability

https://www-secure.symantec.com/connect/forums/permanent-fix-symantec-endpoint-protection-zero-day-vulnerability 

This is the version that we are trying to install and is causing us issues.

Can you post the install logs i referenced in my first post?

Sure. They are attached.

Attachment(s)

SEP_INST3_0.zip   394 KB 1 version

What happens if you delete the key manually and try the install again? Does the key have the correct permissions?

Your application and device control policy might be set to block access to registry which are required by symantec for modification

uncheck any registry block you have set in your policy and then run the installation, once installation is complete you can enable those

This could just be it. Let me check and I will let you know how it goes.

You can try to install the latest client package on the affected system

Symantec Endpoint Protection 12.1.5 client-only patches