Endpoint Protection

I have SEP 11 which I recently upgraded to MR5. All workstations and servers running different OS (Windows XP, Windows Vista, Windows 2000 Advanced Server, Windows 2003 Server, Windows 2003 R2 Server) have been upgraded successfully. The only workstation I am having a problem with is Windows 7 Enterprise 32-bit. I know that older versions (MR4 and lower) do not work with Windows 7, but MR5 should.

When I install unmanaged client on that workstation using the CD - it works fine. When I uninstall unmanaged client and try to install a managed one - it does not work. I have tried two different options.

1. Installed remotely using "Find Unmanaged Computers" in the Management Console. I was able to find the workstation, select it, choose my preferred settings, group, installation package (made sure I choose MR5, knowing that older versions do not work with Windows 7). It run, then says that it installed successfully, but in reality it never installs in the workstation.

2. I exported a Client Install Package with needed settings (group, MR5 install package, componenets, etc) which created setup.exe file. I ran the file on that Windows 7 workstation. It runs the install first then in the end it says that some parts of the program might have not installed correctly and Windows 7 gives me two options - "re-install with correct settings" or "this program installed correctly". Neither one of these options works.

What can I do to get Windows 7 workstation to work correctly as a managed client (unmanged client can install fine). Additionally - SEP Client does not appear in Control Panel- Programs and this workstation does not appear in the Client management section on SEP Management Console.

Please advice.
znerses

 Disable User Access Control ( UAC ) on the Client and push the install again. UAC block remote installation.
or
If the package is successfully pushed to the client then it will be in
C:\Temp\Clt-Inst\
Run it manually.

Vikram, thanks for the answer, however thatd did not work for me.

I shut down UAC notification in Windows 7 (set it to lowest possible value- unlike Vista it does not have disable check box). I then tried to run the remote install. The install did not work, however it did push it to the directory you mentioned - C:\Temp\Clt-Inst\. In there it had one file called vpremote which I tried to run, but nothing happened.

I restarted and then tried to install from the setup.exe file that was created with Client Install Package. The install ran but then I received the same error - the program did not install correctly.

Any ideas what else I can try?

 I see that you have marked my comment as solution did that resolve your issue ?

Unfortunately, I still have this problem (I was not the one who marked it as solution).

 OK..It is definitely because of UAC that SEPM is not able to complete the full package to this system.
So what you can do is either follow this to Disable UAC
http://www.mydigitallife.info/2008/12/30/how-to-disable-and-turn-off-uac-in-windows-7/

Export a package from SEPM and copy it to the Windows 7 Machine and run it locally.

Vikram, If you look above I have indicated that I have already tried that too but that did not work. Please let me know if you have any other ideas. Thanks!

 Ohh ..Ya I missed that..Can you post the 10 lines above the return value 3 from the SEP_INST.log

from start - run - %temp%\SEP_INST.log

By the way, when I ran the setup.exe again (from exported client install package) I got Windows 7 Program Compatability error, saying my program might not be compatable. I double-checked my Windows 7, it is 32 bit, just like the package I created.


Below please see the SEP install log from that Windows 7 machine.
============================

MSI (s) (24:48) [15:34:15:720]: Note: 1: 1708
MSI (s) (24:48) [15:34:15:720]: Product: Symantec Endpoint Protection -- Installation operation failed.

MSI (s) (24:48) [15:34:15:722]: Windows Installer installed the product. Product Name: Symantec Endpoint Protection. Product Version: 11.0.5002.333. Product Language: 1033. Manufacturer: Symantec Corporation. Installation success or error status: 1603.

MSI (s) (24:48) [15:34:15:735]: Deferring clean up of packages/files, if any exist
MSI (s) (24:48) [15:34:15:736]: MainEngineThread is returning 1603
MSI (s) (24:68) [15:34:15:738]: User policy value 'DisableRollback' is 0
MSI (s) (24:68) [15:34:15:738]: Machine policy value 'DisableRollback' is 0
MSI (s) (24:68) [15:34:15:739]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (24:68) [15:34:15:739]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (24:68) [15:34:15:740]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (24:68) [15:34:15:741]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (s) (24:68) [15:34:15:742]: Restoring environment variables
MSI (s) (24:68) [15:34:15:745]: Destroying RemoteAPI object.
MSI (s) (24:D4) [15:34:15:745]: Custom Action Manager thread ending.
MSI (c) (E8:54) [15:34:15:752]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (E8:54) [15:34:15:755]: MainEngineThread is returning 1603
=== Verbose logging stopped: 11/17/2009  15:34:15 ===

 I think this 10 lines below return value 3.
however also try
go to properties of Setup.exe go to compatibility and check Win XP.

or export a non Single exe package.

Also delete this key from regedit

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager

highlight session manager and on the left value delete PendingFileRenameOperations

Run the SEPup.exe again.

- I tried to run setup.exe with Windows XP compatability but that did bot work. The install starts, green bar moves to the very end and then it starts moving back (like unloading whatever it loaded).

- I checked in regedit and did not find that key, it was not there.

- I created install package that is not just one file. I ran the Symantec Antivirus.msi from there. It ran fine, finished the install, I clicked Finish and then nothing happened. The program is still not installed.

- I restarted and ran setup.exe from that same package. Again, it ran with green bar going all the way to the right and then moving bac to the left.

- I changed setup.exe (noth the single install file, but the one in the package) to run with campatable with XP, but that did not work either. It says there are pending changes that require a reboot. But I got thsi before. After reboot nothing happens. If I run setup after a reboot it will just do the same - run the install, show the bar moving right and then going back to left.

- Here is the last 10 lines above 'return value 3"

MSI (s) (A8:78) [16:29:36:842]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI57D7.tmp, Entrypoint: IsRebootRequiredOSAutoUpdate
MSI (s) (A8!F4) [16:29:36:899]: PROPERTY CHANGE: Adding REBOOTREQUIREDOSAUTOUPDATE property. Its value is '1'.
Action start 16:29:36: IsRebootRequiredOSAutoUpdate.B754A361_3344_430B_92FF_8F9A227A6B90.
MSI (s) (A8:FC) [16:29:36:901]: Skipping action: iNoClientTypeDefined.9DDC0E81_9620_4441_B4F7_FD077F55D6D2 (condition is false)
MSI (s) (A8:FC) [16:29:36:901]: Doing action: LaunchConditions
Action ended 16:29:36: IsRebootRequiredOSAutoUpdate.B754A361_3344_430B_92FF_8F9A227A6B90. Return value 1.
Action start 16:29:36: LaunchConditions.
MSI (c) (1C:84) [16:29:36:908]: Font created.  Charset: Req=0, Ret=0, Font: Req=MS Shell Dlg, Ret=MS Shell Dlg

Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
MSI (s) (A8:FC) [16:30:10:446]: Product: Symantec Endpoint Protection -- Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.

Action ended 16:30:10: LaunchConditions. Return value 3.
Action ended 16:30:10: INSTALL. Return value 3.

 Product: Symantec Endpoint Protection -- Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation

REBOOTREQUIREDOSAUTOUPDATE property. Its value is '1'.

Reboot your computer
Go to registry editor.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager

Do not Expand Session Manager.
HIghlight Session Manager and on the Right hand Side you will find that key " PendingFileRenameOperations"
Delete that and re-run the install.

That key is not there in the registry. I also ran a search on PendingFileRenameOperations and it found them at 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\KeysNotToRestore

Should I delete this one, or is it a different key?

 Hmm...Well Try rebooting this machine and then running the MSI install.

Also make sure the regional Language settings are set to English

n the Control Panel, choose Regional and Language Options.

On the Advanced tab, under "Code page conversion tables", check 20127 (US-ASCII) ON.

Click Ok.

Hey, thanks for spending so much time with me.

I did restart before every install. I already tried restarting and running MSI several times.
all language setings are set to English.Windows 7 does not have advanced tab for code page conversions.

not sure what else to try....

 Install Unmanaged CLient and replace the sylink.xml on the client it will make it managed

http://service1.symantec.com/support/ent-security.nsf/docid/2007082009543848

 If you are still able to install Unmanaged then
Install Unmanaged client
start -> run ->smc -stop

copy sylink.xml of any working SEP client ( client with green dot) from \program files\symantec\symantec endpoint protection

paste it to the same location on thisWin7 client
c:\program files\symantec\symantec endpoint protection\

Start- >run -> smc -start

I am trying to install unmanaged now and will follow your directions. Will keep you posted. Thanks!

Copying sylink.xml file worked. Thank you!!! I appriciate you spending so much time helping me today.

I just finished installing SEP on 2 different window 7N machines. I had to install Live Update on both of them first before I could complete the installs. I was able to install 1 machine using the unmanaged client detector without a problem. However, on the second machine, I had to use the 64bit setup.exe file and right click and run as admin. This allowed for the install without any further issues. Hope it helps!

Installing unmanaged was working fine. The problem was when I tried to install a managed solution. I did try running setup.exe as an administrator, but that did not work. Finally, I installed unmanaged verson and then copied sylink.xml file from a working client and it worked like a charm.

 Aaahh..I was waiting for this issue to get resolved Now I can happily go to sleep as its 4:30 in the morn over here..

As far as I am concerned you deserve two days of sleep :). Thanks again.

Hay Vikram,

Nice job buddy!

Aniket

I was getting the same issue on Windows 7 64Bit. After a lot of fussing and fighting, here are the steps that worked for me...

1) Export 64Bit Unmanaged Client (not as single exe)
2) Install LiveUpdate (LUSetup.EXE in Export folder)
3) Restart PC
4) Run Install
5) Restart
6) Stop all Symantec Services
7) Copy in SyLink.xml from Managed Client (located in C:\Program Files (x86)...)
8) Restart

Hi.

These steps are fine for an interim workaround, but it appears that the export functionality with the console is broken for Windows 7, as exported managed clients will not install properly.

This should not be marked as a solution, rather a workaround.  Is a real fix for this issue coming from Symantec anytime soon? 

Just venting ... 

Bob

 Windows 7 is still new and so is MR5-the first officially supported SEP version.
WIndows 7 install is enviromental sometimes what would work for me might not work for you..
However in coming releases SEP will work on WIn7 as WinXP...

Vikram,

This is a default Windows 7 install on a new computer.

 I have a hard time believing that Symantec tested all of the functionality of the console before releasing MR5, based on this problem.  It occurs on both x86 and x64 versions.  Three reboots and pushing files is not a good long term solution.

This is a huge problem, if you support many systems that are offline and you rely on the functionality for exporting managed clients.

Just my two cents ...

Bob

Any timing from Symantec when this wil be hotfixed?
As mentioned by robsmith this is only a workaround for testmachines, not for mass deployment.

Its not that you'll face this problem on all WIn7 system a handful of systems will have this issue which can be manually checked.. 

 I have this issue on all my Seven test images... We are fully automated in deploying OS and applications, so checking it manually is only a temporary answer waiting to be fixed in a fashionly way.

 

?

Has there been any update in the last few weeks?

We're getting ready to deploy 200 + new systems running Windows 7 to multiple locations across the country.  We're also using Altiris for the post which in the past would install a silent SEP install.  Like the users above SEP doesn't work.

Deploying SEP to Windows 7 still broken.

Pls create a new thread for this since this post is very old and most of the people will ignore it...

Got this same issue as of today 2/3/2010 with a brand new Dell Latitude E4300 Windows 7 Pro 32bit. Just upgraded SEPM to MR5 to fix the issue with SEP filling up the server because it can't clean up after itself and was sure hoping it also fixed the inability to push it to Windows 7 clients. It's one bug after another with SEP.

I posted a thread last week with the same question, only to get some vague answers. Now I find out in this thread Symantec does not have remote install working?  I really don't think push install works on any install of Windows 7  becasue I have tried with a fresh install, UAC disabled, Firewall disabled, Defender disabled. I tried the "pending file reboot " registry settings. and a few others. I appreciate the help the people and symantec employees provide here on the forums, but if the software doesn't work from the begining just tell me. Now I've wasted many hours of time trying to get this to push install and I have to wait for MR6?  When I pay for software, I expect it to work, not to pay for beta testing privileges.

I used JeffWAsk idea but did it different.

1.  Deploy lusetup /s /a /q (switches for silent install)
2.  Reboot
3.  Deploy setup.exe managed package

I didn't have to remove UAC, stop defender, or move a syslink file.  It still has the stupid reboot after the first install but I can automate it using my application deployment tool (Kbox).

Better to use this thread instead of people spamming forum with the same problem.

Posting to let everyone know that Chad's method above is da bomb. I'm eval'ing Win7 on one system for possible deployment in my network.