Endpoint Protection

Hello,

We Have different versios of Windows like 1507, 1511, 1607, 1703 and 1709.

We want to upgrade all version to 1709 or 1803 using SCCM.

But;

1-If the client has no SEP installed we get success.

2-If the client has the latest version of SEP installed the task (1709 installation) fails with SCCM.

3-If we use the clean / wipe tool of Symantec, The installation succeed.

4-If the client has the latest version of SEP installed the task succeed with "Check For update" (Windows Creator/Windows Update)

We did all test on a new operating system so the client does not have the oldest version. We have 700 clients because of that any ideas on how to get updates with SCCM? 

Thanks & regards.

SEP 14.2 should be supported in Windows 10 April 2018 build per their support matrix:

https://www.symantec.com/docs/TECH235706

Is this the version you're installing?

If so, may need to engage support.

Thanks Brian.

Yes, we have this version. We can not get updates only with SCCM. If we run "check for updates" screen we can get all updates successful. Actually we created case but they did not help us.

Why did they not help? Did they close the case? Maybe wait until John from Symc checks in here and provde your case number so he can look into. 

It was quite superficial  we could not go into detail. 

okey, let i wait maybe i get a result.

Thank you very much.

Are you blocking autorun.inf using SEP? try disabling auntorun blocking if you have or adding SCCM to the exceptions. 

It has been seen when SCCM is trying to distribute something with autorun including and the blocking is on. 

Hi Alper,

The big question is how is it failing with SCCM?

Thanks,

John

@GeoGeo, I have tried with just AV component and core files but fails.

Hi @John,

The customer is starting the upgrade process on SCCM and after a long wait, SCCM gives a failed. 

What do the SCCM logs shows as to why it fails?

Hello @John,

I want to explain the problem. 

We tried 2 methods to upgrade OS in SCCM.

1. Windows Servicing

2. Task Sequence

The clients download the content to SCCM cache folder. When it start to install update, It fails. I checked the event viewer and CCM logs. I didnt find the specific error. I see just following errors in Event viewer and CCM logs

Installation Failure: Windows failed to install the following update with error 0x80070005: Feature update to Windows 10, version 1803.

Windows Setup failed with hexadecimal exit code 0x80070005 (decimal 2147942405). To identify the type of issue, lookup it against the table of known values of Windows Setup errors online.

Failed to run the last action: Upgrade Operating System. Execution of task sequence failed.
Unspecified error (Error: 80004005; Source: Windows)

Thanks.

I know that for our environment, we had to except several folders that SCCM uses to deploy different tasks.

0x80070005 - Access Denied.

Could you run Process Monitor on the client during the SCCM push of 1803 and provide here?

Thanks,

John Owens

Hi all,

We reviewed the application and device control policy after @GeoGeo mentioning the rule. And we saw that the %temp%\*\*.exe file was blocked. It does not seem to be a problem at the moment. operation successful.

Thank you all very much.