Endpoint Protection

How to troubleshoot a failed install of SEP or SEPM?

 While troubleshooting a failed install we need to follow a sequence of steps to resolve the issue. 

•   Check the Install log on the Machine 

  For SEPM  check the  SEPM_Inst.log  generated in %TEMP% or in %Windir%\temp locations.

 For SEP Check  the SEP_inst.log. %TEMP% or in %Windir%\temp locations.

 In the log search for  Return Value 3.Once we get the Return Value 3, Look at the lines above Value 3 it will help us to locate the reason for the failure.

 Refer to the article below for more details:

 https://www-secure.symantec.com/connect/articles/troubleshooting-installation-errors-using-msi-logs

•    Check the  Windows Application and System Event logs if there is nothing clear from the install logs

•    Try to install  it as Unmanaged from the Install DVD or CD  to rules out the issue with the package created in case of the SEP install.

•    Try to  the install logged in as the Local Administrator.  This will rules out any permission issue\

•    Click the TEMP folder and then verify that the SYSTEM account has full control.

•    Then Check the language  and region selected in the OS? For English OS make sure you have International English language selected.

•    Check the DCOM Permission on the machine using the below kb

 Troubleshooting Symantec AntiVirus Corporate Edition and Symantec Endpoint Protection installations: Checking rights and permissions

 http://www.symantec.com/business/support/index?page=content&id=TECH100048&locale=en_US

•     Unregister and re-register the Windows Installer

   Click   Start, click Run, type MSIEXEC /UNREGISTER, and then click OK. Even if  you do this correctly, it may look like nothing occurs.

  Click Start, click Run, type MSIEXEC /REGSERVER, and then click OK. Even if you do this correctly, it may look like nothing occurs, or you may   briefly see an hourglass. After you run this    command, the operation is complete.

 Try to install SEP.

•   Run the Testsec tool. The TestSec utility will  test permissions related to Symantec Antivirus and Symantec Endpoint Protection products that is needed for the program to get installed

 http://www.symantec.com/business/support/index?page=content&id=TECH105027&locale=en_US

•  Check the  Local Security Policy acting on the machine

SecEdit /export /cfg c:\cfg.txt  (The output file will be “C:\CFG.TXT”)

•    Also check the  currently applied GPO’s.

Gpresult /z > gporesult.txt  (The output file will be found in the directory you are running the command from.)

 If after following the above steps still you are not able to resolve the issue, then download Process Monitor from http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx and get the logs.

Once you have the following logs ready contact support:

 SEP_Inst.log

1. Test sec log
2. Local Security Policy
3. GPO acting on the machine
4. Process Monitor Log
5. SEP Support Tool Logs