Endpoint Protection

Hi All

I have a single machine that is failing on the SEP ru6 setup, after 99% install it is rolling back and then presenting with a message that the installation was interupted before it could finish, I also then get a reboot pending if I try to run the setup again..

I have tried to push from the SEPM using find unmanaged machines..
I have exported a package and tried to run the setup.exe both as a domain admin and local administrator.
The setup.exe is not corrupt as it runs on other machine
the client machine has been scanned with sert and returns clean.

I have attached the SEP_INST log file from the setup.exe install that was run under the local administrator..

Any ideas why the install is rolling back??

Thanks for your help...

remove liveupdate
delete all the liveupdate folders
install liveupdate ( u can get this when you uncheck create single exe when creating the package)
then install SEP

Can you please attach the log file again, it is encrypted the one that you have attached.

or

Please go to run and type %temp%
 
Look for a file called SEP_inst.log
 
In the log file look for return value 3  and paste 6-7 lines before that
 
We need all the instances for the Return value 3

from the logs, there are old entries as well , run cleanwipe or manual uninstall the product.


Run the SEP support tool
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008071709480648

and check for the errors and post it here.

MSI (s) (28:40) [09:16:46:965]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIC3.tmp, Entrypoint: restoreSPState
restoreSPState: called
restoreSPState: calling loadEventManagerDLLs
loadEventManagerDLLs: called
serviceIsRunning: OpenService FAILED with error 1060
LoadEvtMgrDll: ccEvtMgr is not running
serviceIsRunning: OpenService FAILED with error 1060
SendReload: ccEvtMgr is not running
loadEventManagerDLLs: FAILED to send reload event
loadEventManagerDLLs: exiting
restoreSPState: Changing service configuration to SERVICE_DEMAND START for SPBBCSvc
modifyServiceConfiguration: OpenService() FAILED with error 1060
restoreSPState: Unable to modify configuration for SPBBCSvc
restoreSPState: Value of szSPState "0"
restoreSPState: SPState is NOT set to 1. NOT Calling startSP
restoreSPState: exiting
WriteCcSettingsTables: checkMSXMLVersion.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1
MSI (s) (28:08) [09:16:46:980]: Executing op: ActionStart(Name=checkMSXMLVersion.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
WriteCcSettingsTables: RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1
MSI (s) (28:08) [09:16:46:980]: Executing op: ActionStart(Name=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,,)
MSI (s) (28:08) [09:16:46:980]: Executing op: CustomActionRollback(Action=RB_cleanupFolder.0723A1DC_DEB6_4A50_874F_3A2D2C99A1C1,ActionType=1345,Source=BinaryData,Target=cleanupFolder,)
MSI (s) (28:80) [09:16:46:996]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIC4.tmp, Entrypoint: cleanupFolder
InstSymProtect::cleanupFolder() -> called
DeleteFolderIfNoFileExists: Driver file is not present.
DeleteFolder: FAILED to delete directory C:\Program Files\Common Files\Symantec Shared\SPBBC
DeleteFolderIfNoFileExists: SHDeleteFolder FAILED
InstSymProtect::cleanupFolder() -> DeleteFolderIfNoFileExists FAILED
cleanupFolder:  exiting
MSI (s) (28:08) [09:16:47:074]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (28:08) [09:16:47:074]: Error in rollback skipped. Return: 5
MSI (s) (28:08) [09:16:47:074]: No System Restore sequence number for this installation.
MSI (s) (28:08) [09:16:47:074]: Unlocking Server
MSI (s) (28:08) [09:16:47:434]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 09:16:47: INSTALL. Return value 3.

Run support tool, returned OK
used cleanwipe, installed liveupdate then SEP and it still failed...

below is the paste from the SEP_inst.log

Many Thanks
Steve


 Dumping module information for the process
Module: ImagePath=C:\WINDOWS\system32\xpsp2res.dll
Module: ImagePath=C:\WINDOWS\system32\UxTheme.dll
Module: ImagePath=C:\WINDOWS\system32\ShimEng.dll
Module: ImagePath=C:\WINDOWS\system32\comctl32.dll
Module: ImagePath=C:\WINDOWS\system32\rsaenh.dll
Module: ImagePath=C:\WINDOWS\AppPatch\AcGenral.DLL
Module: ImagePath=C:\WINDOWS\system32\ADMWPROX.DLL
Module: ImagePath=C:\WINDOWS\system32\SAMLIB.dll
Module: ImagePath=C:\WINDOWS\system32\USERENV.dll
Module: ImagePath=C:\WINDOWS\system32\WINMM.dll
Module: ImagePath=C:\WINDOWS\system32\WLDAP32.dll
Module: ImagePath=C:\WINDOWS\system32\CLBCATQ.DLL
Module: ImagePath=C:\WINDOWS\system32\COMRes.dll
Module: ImagePath=C:\WINDOWS\system32\OLEAUT32.dll
Module: ImagePath=C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
Module: ImagePath=C:\WINDOWS\system32\ole32.dll
Module: ImagePath=C:\WINDOWS\system32\NTMARTA.DLL
Module: ImagePath=C:\WINDOWS\system32\MSACM32.dll
Module: ImagePath=C:\WINDOWS\system32\VERSION.dll
Module: ImagePath=C:\WINDOWS\system32\msvcrt.dll
Module: ImagePath=C:\WINDOWS\system32\ADVAPI32.dll
Module: ImagePath=C:\WINDOWS\system32\RPCRT4.dll
Module: ImagePath=C:\WINDOWS\system32\GDI32.dll
Module: ImagePath=C:\WINDOWS\system32\SHLWAPI.dll
Module: ImagePath=C:\WINDOWS\system32\Secur32.dll
Module: ImagePath=C:\WINDOWS\system32\kernel32.dll
Module: ImagePath=C:\WINDOWS\system32\ntdll.dll
Module: ImagePath=C:\WINDOWS\system32\SHELL32.dll
Module: ImagePath=C:\WINDOWS\system32\query.dll
Module: ImagePath=C:\WINDOWS\system32\USER32.dll
Action ended 09:06:51: InstallFinalize. Return value 3.


MSI (s) (30:74) [09:08:29:291]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (30:74) [09:08:29:291]: Error in rollback skipped. Return: 5
MSI (s) (30:74) [09:08:29:307]: No System Restore sequence number for this installation.
MSI (s) (30:74) [09:08:29:307]: Unlocking Server
MSI (s) (30:74) [09:08:29:682]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 09:08:29: INSTALL. Return value 3.


Property(S): MSIAddWFPAppException.17E5C180_F281_4425_9348_3E891E7F8D1F = SMC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe;SNAC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE;Symantec Email;C:\Program Files\Common Files\Symantec Shared\ccApp.exe;
Property(S): ProductToBeRegistered = 1
Property(S): MsiRebootActionScheduled = 1
Property(S): MsiFilterRebootMode_RebootAtEndModeBefore = 1
MSI (s) (30:74) [09:08:30:088]: MainEngineThread is returning 1603
MSI (s) (30:B0) [09:08:30:088]: No System Restore sequence number for this installation.
MSI (s) (30:B0) [09:08:30:088]: User policy value 'DisableRollback' is 0
MSI (s) (30:B0) [09:08:30:088]: Machine policy value 'DisableRollback' is 0
MSI (s) (30:B0) [09:08:30:088]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (30:B0) [09:08:30:088]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (30:B0) [09:08:30:088]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (30:B0) [09:08:30:088]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (s) (30:B0) [09:08:30:088]: Restoring environment variables
MSI (c) (78:64) [09:08:30:088]: Back from server. Return value: 1603
MSI (c) (78:64) [09:08:30:088]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (78:64) [09:08:30:088]: PROPERTY CHANGE: Deleting SECONDSEQUENCE property. Its current value is '1'.
Action ended 09:08:30: ExecuteAction. Return value 3.


Property(S): MSIAddWFPAppException.17E5C180_F281_4425_9348_3E891E7F8D1F = SMC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe;SNAC Service;C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE;Symantec Email;C:\Program Files\Common Files\Symantec Shared\ccApp.exe;
Property(S): ProductToBeRegistered = 1
Property(S): MsiRebootActionScheduled = 1
Property(S): MsiFilterRebootMode_RebootAtEndModeBefore = 1
MSI (s) (30:74) [09:08:30:088]: MainEngineThread is returning 1603
MSI (s) (30:B0) [09:08:30:088]: No System Restore sequence number for this installation.
MSI (s) (30:B0) [09:08:30:088]: User policy value 'DisableRollback' is 0
MSI (s) (30:B0) [09:08:30:088]: Machine policy value 'DisableRollback' is 0
MSI (s) (30:B0) [09:08:30:088]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (30:B0) [09:08:30:088]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (30:B0) [09:08:30:088]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (30:B0) [09:08:30:088]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (s) (30:B0) [09:08:30:088]: Restoring environment variables
MSI (c) (78:64) [09:08:30:088]: Back from server. Return value: 1603
MSI (c) (78:64) [09:08:30:088]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (78:64) [09:08:30:088]: PROPERTY CHANGE: Deleting SECONDSEQUENCE property. Its current value is '1'.
Action ended 09:08:30: ExecuteAction. Return value 3.
MSI (c) (78:64) [09:08:30:088]: Doing action: SetupCompleteError
Action 09:08:30: SetupCompleteError.
Action start 09:08:30: SetupCompleteError.
Action 09:08:30: SetupCompleteError. Dialog created
Action ended 09:09:40: SetupCompleteError. Return value 2.
Action ended 09:09:40: INSTALL. Return value 3.

Hi John,

We've had similar issues and this method has worked the best at getting beyond the rollback's.

1) Create a new local admin user
2) Login (at the console) as that new admin user. (RDP did not work for us) and Run CleanWipe v6000.550 or higher (if Win Vista or Win 7, run CleanWipe using an elevated cmd prompt) (This step is important)
4) After CleanWipe has finished, attempt to install SEP

Hope this works for you.

-Mike

P.S. Here is an article on pending file renames that may also help.

http://service1.symantec.com/support/ent-security.nsf/docid/2007121609023348?Open&seg=ent