Endpoint Protection

Hi,

I've been trying to install endpoint protection client 12.1 on a Win 7 computer for the last few hours..

Remote install, success on pushing the installation, but nothing happens on the remote computer.

Manual installation, Setup running for few minutes, finishes and doesnt actually install the software.

After a restart, I receive on the SEPM, Install failed, rolled back.

I have no clue how to procced from this point.

I ran SysDiag and I have no errors on install the software..

I'm installing 32bit version on win 7 32 bit.

Check the %temp% directory for the SEP_INST.log file. Search for 'return value 3' and looks 10-15 above to see if it shows errors. 

See this article as well:

Required logs for troubleshooting failed Endpoint Protection 12.1 client installations

Run SymDiag on it as well:

Download SymDiag to detect Symantec product issues 

I found the log, Doesn't really seems to understand it so much..

SymRollbackCleanup Failed to delete empty registry key: 'Symantec' with error:0
MSI (s) (18:38) [16:05:30:094]: Executing op: ActionStart(Name=LeaveVolatileRollbackKey,,)
MSI (s) (18:38) [16:05:30:094]: Executing op: CustomActionRollback(Action=LeaveVolatileRollbackKey,ActionType=3329,Source=BinaryData,Target=LeaveVolatileUninstallKey,)
MSI (s) (18:AC) [16:05:30:094]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI8C0A.tmp, Entrypoint: LeaveVolatileUninstallKey
MSI (s) (18:38) [16:05:30:140]: Executing op: ActionStart(Name=installFailure,Description=Logging install failure,Template=[1])
MSI (s) (18:38) [16:05:30:156]: Executing op: CustomActionRollback(Action=installFailure,ActionType=1281,Source=BinaryData,Target=installFailure,)
MSI (s) (18:D0) [16:05:30:156]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI8C49.tmp, Entrypoint: installFailure
IDC::CancelEvent Signaling Global\SymIDCInstallComplete
IDCCA:  Failed to set property IdcXmlPath to C:\Windows\Temp\idc.xml (6)
IDC::CancelEvent Received WAIT_COMPLETE_EVENT event
IDCCA: Machine ID: 9eaadec805c59492ac968ad1cf522e4b578faa4
Action ended 16:05:30: waitForIDCEvent. Return value 0.
IDCCA: Collecting file c:\program files\symantec\symantec endpoint protection\12.1.6168.6000.105\scripts\installscript.sis
IDCCA: Collecting file c:\program files\symantec\symantec endpoint protection\12.1.6168.6000.105\scripts\rollback.rbs
IDCCA: Collecting file c:\programdata\symantec\symantec endpoint protection\12.1.6168.6000.105\data\install\logs\sis_inst.log
IDCCA: Collecting file c:\users\admini~1\appdata\local\temp\sep_inst.log
IDCCA: Collecting file c:\windows\temp\database.db
IDCCA: HttpQueryInfo: 200 OK Error: 0
IDCCA: SETI::CUploadFile::logout200 OK
MSI (s) (18:38) [16:05:39:926]: Executing op: ActionStart(Name=CommunicateRollback,,)
MSI (s) (18:38) [16:05:39:941]: Executing op: CustomActionRollback(Action=CommunicateRollback,ActionType=1345,Source=BinaryData,Target=CommunicateRollback,CustomActionData=12.1.6168.6000;C:\Users\Administrator\AppData\Local\Temp\Symantec\;;105)
MSI (s) (18:08) [16:05:39:941]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIB27F.tmp, Entrypoint: CommunicateRollback
Communicate RB:  calling communicate state with the following arguments: 
Communicate RB: Prodversion = 12.1.6168.6000
Communicate RB: PathToSylink = C:\Users\Administrator\AppData\Local\Temp\Symantec\
Communicate RB: Oldversion = 
Communicate RB: ReasonStr = 
MSI (s) (18:38) [16:05:41:486]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (18:38) [16:05:41:486]: Error in rollback skipped.    Return: 5
Communicate RB: StatusCode = 302469120
MSI (s) (18:38) [16:05:41:502]: Note: 1: 2318 2:  
MSI (s) (18:38) [16:05:41:502]: Calling SRSetRestorePoint API. dwRestorePtType: 13, dwEventType: 103, llSequenceNumber: 458, szDescription: "".
MSI (s) (18:38) [16:05:41:502]: The call to SRSetRestorePoint API succeeded. Returned status: 0.
MSI (s) (18:38) [16:05:41:502]: Unlocking Server
MSI (s) (18:38) [16:05:41:502]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 16:05:41: INSTALL. Return value 3.

That computer had version 11 installed.

I tried to upgrade, but it didn't worked. ( Just saying 'failed, rollback' )

So I uninstalled the version 11 client from the computer and then tried to install the new version.

this is where i am now.

I uplodaed the SEP_INST.log SIS_INST.log

Attachment(s)

SEP_INST_154.txt   3.08 MB 1 version

SIS_INST_15.txt   1.57 MB 1 version

I Tried,

This is the cleanwipe log:

17:05:47    INFO    [19/24]: Searching registry for product related data
17:05:51    INFO    [20/24]: Removing registry keys
17:05:51    WARN    Could not delete 03:\.DEFAULT\Software\Symantec\Symantec Endpoint Protection\. Exception: RegSetKeySecurity failed. Error code: 87 (0x57): The parameter is incorrect.
17:05:51    WARN    Could not delete 03:\S-1-5-18\Software\Symantec\Symantec Endpoint Protection\. Exception: RegSetKeySecurity failed. Error code: 87 (0x57): The parameter is incorrect.
17:05:51    INFO    [21/24]: Removing Windows Firewall exceptions
17:05:51    INFO    [22/24]: Removing Write Filter Exclusions
17:05:51    INFO    [23/24]: Removing Write Filter Exclusions
17:05:51    INFO    [24/24]: Unregistering products from Windows Security Center
17:05:52    INFO    Saving state...
17:05:52    INFO    Removal completed successfully.

I tried to reinstall after that, Same, failed.

Run Cleanwipe on the System, Reboot, CCleaner, Reboot and try it again

I just did, Still fails..

I just did.. still doesnt work.

I just uplodaed my last SIS_INST.txt, hopefully someone could help me with that..

thanks

Attachment(s)

SIS_INST_16.txt   1.57 MB 1 version

I Tried,

This is the cleanwipe log:

17:05:47    INFO    [19/24]: Searching registry for product related data
17:05:51    INFO    [20/24]: Removing registry keys
17:05:51    WARN    Could not delete 03:\.DEFAULT\Software\Symantec\Symantec Endpoint Protection\. Exception: RegSetKeySecurity failed. Error code: 87 (0x57): The parameter is incorrect.
17:05:51    WARN    Could not delete 03:\S-1-5-18\Software\Symantec\Symantec Endpoint Protection\. Exception: RegSetKeySecurity failed. Error code: 87 (0x57): The parameter is incorrect.
17:05:51    INFO    [21/24]: Removing Windows Firewall exceptions
17:05:51    INFO    [22/24]: Removing Write Filter Exclusions
17:05:51    INFO    [23/24]: Removing Write Filter Exclusions
17:05:51    INFO    [24/24]: Unregistering products from Windows Security Center
17:05:52    INFO    Saving state...
17:05:52    INFO    Removal completed successfully.

I tried to reinstall after that, Same, failed.

https://www.symantec.com/connect/forums/unable-install-client-computer#comment-11814451

What about Windows Defender?

https://support.symantec.com/en_US/article.TECH168501.html

=================

Did you try to install the client with 'Run as Administrator'?

=================

Error: "...pending system changes that require a reboot" when installing or upgrading Endpoint Protection

https://support.symantec.com/en_US/article.TECH98292.html

=================

Backup the registry key first:

In the registry,

Find

HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData value=%APPDATA%

and change it to

HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData value=%USERPROFILE%\AppData\Roaming

Install SEP client again.

================================