there is more than one "Value 3"
Action 0:20:27: InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644.
MSI (s) (C4:98) [00:20:27:753]: Executing op: CustomActionSchedule(Action=InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644,ActionType=3073,Source=BinaryData,Target=InstallLiveUpdate,CustomActionData=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HPRVKZTW\LiveUpdate\lucheck.exe)
MSI (s) (C4:70) [00:20:27:769]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI6D.tmp, Entrypoint: InstallLiveUpdate
LUCA: InstallLiveUpdate enter.
LUCA: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HPRVKZTW\LiveUpdate\lucheck.exe
LUCA: InstallLiveUpdate : CreateProcessAndWait( LUCHECK.EXE ) returned 206
Action ended 0:21:14: InstallFinalize. Return value 3.
MSI (s) (C4:98) [00:21:14:300]: User policy value 'DisableRollback' is 0
MSI (s) (C4:98) [00:21:14:300]: Machine policy value 'DisableRollback' is 0
MSI (s) (C4:98) [00:21:14:347]: Executing op: Header(Signature=1397708873,Version=301,Timestamp=992477803,LangId=1033,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
MSI (s) (C4:98) [00:21:14:347]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (C4:98) [00:21:14:347]: Executing op: DialogInfo(Type=1,Argument=Symantec Endpoint Protection)
MSI (s) (C4:98) [00:21:14:347]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
Action 0:21:14: Rollback. Rolling back action:
Rollback: InstallLiveUpdate.FF07F38E_78C2_412E_B858_64488E808644
------------------------
InstSymProtect::cleanupFolder() -> DeleteFolderIfNoFileExists FAILED
cleanupFolder: exiting
MSI (s) (C4:98) [00:21:31:925]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (C4:98) [00:21:31:925]: Error in rollback skipped. Return: 5
MSI (s) (C4:98) [00:21:31:941]: No System Restore sequence number for this installation.
MSI (s) (C4:98) [00:21:31:941]: Unlocking Server
MSI (s) (C4:98) [00:21:31:941]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 0:21:31: INSTALL. Return value 3.
Property(S): DiskPrompt = [1]
Property(S): UpgradeCode = {24BF7A02-B60A-494B-843A-793BBC77DED4}
Property(S): CostingComplete = 1
Property(S): VersionNT = 502
Property(S): TARGETDIR = Z:\
Property(S): ALLUSERSPROFILE = C:\Documents and Settings\All Users\
---------------------------
Property(S): ProductToBeRegistered = 1
Property(S): MsiFilterRebootMode_RebootAtEndModeBefore = 1
MSI (s) (C4:98) [00:21:32:660]: MainEngineThread is returning 1603
MSI (s) (C4:CC) [00:21:32:675]: Destroying RemoteAPI object.
MSI (s) (C4:30) [00:21:32:675]: Custom Action Manager thread ending.
MSI (c) (F4:28) [00:21:32:691]: Back from server. Return value: 1603
MSI (c) (F4:28) [00:21:32:691]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (F4:28) [00:21:32:691]: PROPERTY CHANGE: Deleting SECONDSEQUENCE property. Its current value is '1'.
Action ended 0:21:32: ExecuteAction. Return value 3.
MSI (c) (F4:28) [00:21:32:691]: Doing action: SetupCompleteError
Action 0:21:32: SetupCompleteError.
Action start 0:21:32: SetupCompleteError.
Action 0:21:32: SetupCompleteError. Dialog created
Action ended 0:22:33: SetupCompleteError. Return value 2.
Action ended 0:22:33: INSTALL. Return value 3.
MSI (c) (F4:28) [00:22:33:816]: Destroying RemoteAPI object.
MSI (c) (F4:1C) [00:22:33:816]: Custom Action Manager thread ending.
thanks! chrisv