Endpoint Protection Small Business Edition

 View Only
Expand all | Collapse all

Symantec Endpoint Protection 12.1.2 rolling back during install

  • 1.  Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Mar 19, 2013 04:31 PM

    Hello. I have a user that previously had 12.1.1 installed, performed a system restore, I believe corrupted the SEP installation, and I have had trouble re-installing 12.1.2 on the system. The installation gets to the very end and then rolls back the install. I've tried running cleanwipe several times, removing registry keys manually as well as the symantec folders on the C:\ drive. I can't seem to figure out why it keeps failing. I'm assuming I"m missing something somewhere.

    Cleanwipe though usually solved the issues by removing everything. Does anyone have any thoughts on this???



  • 2.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Mar 19, 2013 05:07 PM

    Please post the SEP_INST.log file here for review

    It will be located in the %temp% directory.



  • 3.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Mar 19, 2013 05:12 PM

     

    === Verbose logging started: 3/15/2013  18:10:39  Build type: SHIP UNICODE 5.00.7601.00  Calling process: C:\Windows\system32\msiexec.exe ===
    MSI (c) (D0:A0) [18:10:39:302]: Resetting cached policy values
    MSI (c) (D0:A0) [18:10:39:302]: Machine policy value 'Debug' is 0
    MSI (c) (D0:A0) [18:10:39:302]: ******* RunEngine:
               ******* Product: C:\Windows\Temp\Symantec\Sep64.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (c) (D0:A0) [18:10:39:302]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (D0:A0) [18:10:39:302]: Grabbed execution mutex.
    MSI (c) (D0:A0) [18:10:39:333]: Cloaking enabled.
    MSI (c) (D0:A0) [18:10:39:333]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (D0:A0) [18:10:39:333]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (F0:CC) [18:10:39:348]: Running installation inside multi-package transaction C:\Windows\Temp\Symantec\Sep64.msi
    MSI (s) (F0:CC) [18:10:39:348]: Grabbed execution mutex.
    MSI (s) (F0:28) [18:10:39:348]: Resetting cached policy values
    MSI (s) (F0:28) [18:10:39:348]: Machine policy value 'Debug' is 0
    MSI (s) (F0:28) [18:10:39:348]: ******* RunEngine:
               ******* Product: C:\Windows\Temp\Symantec\Sep64.msi
               ******* Action: 
               ******* CommandLine: **********
    MSI (s) (F0:28) [18:10:39:348]: Machine policy value 'DisableUserInstalls' is 0
    MSI (s) (F0:28) [18:10:39:348]: SRSetRestorePoint skipped for this transaction.
    MSI (s) (F0:28) [18:10:39:364]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 
    MSI (s) (F0:28) [18:10:39:364]: File will have security applied from OpCode.
    MSI (s) (F0:28) [18:10:39:364]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\Windows\Temp\Symantec\Sep64.msi' against software restriction policy
    MSI (s) (F0:28) [18:10:39:364]: SOFTWARE RESTRICTION POLICY: C:\Windows\Temp\Symantec\Sep64.msi has a digital signature
    MSI (s) (F0:28) [18:10:39:364]: SOFTWARE RESTRICTION POLICY: C:\Windows\Temp\Symantec\Sep64.msi is permitted to run because the user token authorizes execution (system or service token).
    MSI (s) (F0:28) [18:10:39:364]: End dialog not enabled
    MSI (s) (F0:28) [18:10:39:364]: Original package ==> C:\Windows\Temp\Symantec\Sep64.msi
    MSI (s) (F0:28) [18:10:39:364]: Package we're running from ==> C:\Windows\Installer\903786.msi
    MSI (s) (F0:28) [18:10:39:380]: APPCOMPAT: Compatibility mode property overrides found.
    MSI (s) (F0:28) [18:10:39:380]: APPCOMPAT: looking for appcompat database entry with ProductCode '{C2103AF2-E66C-446B-9791-9207840EC821}'.
    MSI (s) (F0:28) [18:10:39:380]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (F0:28) [18:10:39:380]: MSCOREE not loaded loading copy from system32
    MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'TransformsSecure' is 0
    MSI (s) (F0:28) [18:10:39:380]: User policy value 'TransformsAtSource' is 0
    MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'DisablePatch' is 0
    MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'AllowLockdownPatch' is 0
    MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'DisableLUAPatching' is 0
    MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'DisableFlyWeightPatching' is 0
    MSI (s) (F0:28) [18:10:39:380]: APPCOMPAT: looking for appcompat database entry with ProductCode '{C2103AF2-E66C-446B-9791-9207840EC821}'.
    MSI (s) (F0:28) [18:10:39:380]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (F0:28) [18:10:39:380]: Transforms are not secure.
    MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Windows\TEMP\SEP_INST.LOG'.
    MSI (s) (F0:28) [18:10:39:380]: Command Line: REBOOT=ReallySuppress SRCLICFILE=EE CURRENTDIRECTORY=C:\Windows\TEMP\Symantec CLIENTUILEVEL=3 CLIENTPROCESSID=5584 
    MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{FCBCA23E-67D3-469D-9B7C-03580B8BC8B5}'.
    MSI (s) (F0:28) [18:10:39:380]: Product Code passed to Engine.Initialize:           ''
    MSI (s) (F0:28) [18:10:39:380]: Product Code from property table before transforms: '{C2103AF2-E66C-446B-9791-9207840EC821}'
    MSI (s) (F0:28) [18:10:39:380]: Product Code from property table after transforms:  '{C2103AF2-E66C-446B-9791-9207840EC821}'
    MSI (s) (F0:28) [18:10:39:380]: Product not registered: beginning first-time install
    MSI (s) (F0:28) [18:10:39:380]: Product {C2103AF2-E66C-446B-9791-9207840EC821} is not managed.
    MSI (s) (F0:28) [18:10:39:380]: MSI_LUA: Credential prompt not required, user is an admin
    MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (s) (F0:28) [18:10:39:380]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (s) (F0:28) [18:10:39:380]: User policy value 'SearchOrder' is 'nmu'
    MSI (s) (F0:28) [18:10:39:380]: Adding new sources is allowed.
    MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (s) (F0:28) [18:10:39:380]: Package name extracted from package path: 'Sep64.msi'
    MSI (s) (F0:28) [18:10:39:380]: Package to be registered: 'Sep64.msi'
    MSI (s) (F0:28) [18:10:39:380]: Note: 1: 2262 2: AdminProperties 3: -2147287038 
    MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'DisableMsi' is 0
    MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'AlwaysInstallElevated' is 0
    MSI (s) (F0:28) [18:10:39:380]: User policy value 'AlwaysInstallElevated' is 0
    MSI (s) (F0:28) [18:10:39:380]: Product installation will be elevated because user is admin and product is being installed per-machine.
    MSI (s) (F0:28) [18:10:39:380]: Running product '{C2103AF2-E66C-446B-9791-9207840EC821}' with elevated privileges: Product is assigned.
    MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding SRCLICFILE property. Its value is 'EE'.
    MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\Windows\TEMP\Symantec'.
    MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
    MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '5584'.
    MSI (s) (F0:28) [18:10:39:380]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
    MSI (s) (F0:28) [18:10:39:380]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
    MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (s) (F0:28) [18:10:39:380]: TRANSFORMS property is now: 
    MSI (s) (F0:28) [18:10:39:380]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
    MSI (s) (F0:28) [18:10:39:380]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Favorites
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Documents
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Local
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Pictures
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\Desktop
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (s) (F0:28) [18:10:39:395]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts
    MSI (s) (F0:28) [18:10:39:395]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 
    MSI (s) (F0:28) [18:10:39:395]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (s) (F0:28) [18:10:39:395]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (s) (F0:28) [18:10:39:395]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (s) (F0:28) [18:10:39:395]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
    MSI (s) (F0:28) [18:10:39:395]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'admin'.
    MSI (s) (F0:28) [18:10:39:395]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 
    MSI (s) (F0:28) [18:10:39:395]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Windows\Installer\903786.msi'.
    MSI (s) (F0:28) [18:10:39:395]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\Windows\Temp\Symantec\Sep64.msi'.
    MSI (s) (F0:28) [18:10:39:395]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (s) (F0:28) [18:10:39:395]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
    MSI (s) (F0:28) [18:10:39:411]: Note: 1: 2205 2:  3: PatchPackage 
    MSI (s) (F0:28) [18:10:39:411]: Machine policy value 'DisableRollback' is 0
    MSI (s) (F0:28) [18:10:39:411]: User policy value 'DisableRollback' is 0
    MSI (s) (F0:28) [18:10:39:411]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    === Logging started: 3/15/2013  18:10:39 ===
    MSI (s) (F0:28) [18:10:39:411]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
    MSI (s) (F0:28) [18:10:39:411]: Doing action: INSTALL
    Action start 18:10:39: INSTALL.
    MSI (s) (F0:28) [18:10:39:411]: Running ExecuteSequence
    MSI (s) (F0:28) [18:10:39:411]: Doing action: Check32BitSupport
    MSI (s) (F0:AC) [18:10:39:894]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI37B5.tmp, Entrypoint: Check32BitSupport
    MSI (s) (F0:24) [18:10:39:894]: Generating random cookie.
    MSI (s) (F0:24) [18:10:39:910]: Created Custom Action Server with PID 6864 (0x1AD0).
    MSI (s) (F0:DC) [18:10:39:926]: Running as a service.
    MSI (s) (F0:DC) [18:10:39:926]: Hello, I'm your 32bit Elevated custom action server.
    MSI (s) (F0!BC) [18:10:40:113]: PROPERTY CHANGE: Adding Supports32BitDlls property. Its value is '1'.
    Action start 18:10:39: Check32BitSupport.
    MSI (s) (F0:28) [18:10:40:113]: Skipping action: No32BitSupportError (condition is false)
    MSI (s) (F0:28) [18:10:40:113]: Doing action: FindRelatedProducts
    Action ended 18:10:40: Check32BitSupport. Return value 1.
    Action start 18:10:40: FindRelatedProducts.
    MSI (s) (F0:28) [18:10:40:113]: Skipping action: DowngradeError (condition is false)
    MSI (s) (F0:28) [18:10:40:113]: Skipping action: LegacyNortonError (condition is false)
    MSI (s) (F0:28) [18:10:40:113]: Skipping action: LegacySymError (condition is false)
    MSI (s) (F0:28) [18:10:40:113]: Doing action: DriverCheck
    Action ended 18:10:40: FindRelatedProducts. Return value 1.
    MSI (s) (F0:AC) [18:10:40:175]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3A74.tmp, Entrypoint: DriverCheck
    Action start 18:10:40: DriverCheck.
    DriverCheck SymEvent did not open. Trying accessing via CreateFile
    DriverCheck SymEvent did not open (probably doesn't exist -- this is fine) with: 2
    DriverCheck SymTDI did not open. Trying accessing via CreateFile
    DriverCheck SymTDI did not open (probably doesn't exist -- this is fine) with: 2
    DriverCheck WPS did not open. Trying accessing via CreateFile
    DriverCheck WPS did not open (probably doesn't exist -- this is fine) with: 2
    MSI (s) (F0:28) [18:10:40:206]: Doing action: SetMigrateProperty
    Action ended 18:10:40: DriverCheck. Return value 1.
    MSI (s) (F0:30) [18:10:40:238]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3AD2.tmp, Entrypoint: SetMigrateProperty
    Action start 18:10:40: SetMigrateProperty.
    MSI (s) (F0:28) [18:10:40:269]: Skipping action: SetIdcMultistageProperty (condition is false)
    MSI (s) (F0:28) [18:10:40:269]: Skipping action: SetSNACMigratePropertyAmberPlus (condition is false)
    MSI (s) (F0:28) [18:10:40:269]: Skipping action: SetSNACMigratePropertyOlder (condition is false)
    MSI (s) (F0:28) [18:10:40:269]: Skipping action: SetSNACMigratePropertyPreAmber (condition is false)
    MSI (s) (F0:28) [18:10:40:269]: Doing action: VerifyBFERunning
    Action ended 18:10:40: SetMigrateProperty. Return value 1.
    MSI (s) (F0:24) [18:10:40:300]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3B12.tmp, Entrypoint: VerifyBFERunning
    Action start 18:10:40: VerifyBFERunning.
    InstallUtils::CServiceUtil::isServiceRunningChecking status of service: BFE
    MSI (s) (F0!70) [18:10:40:316]: PROPERTY CHANGE: Adding BFEServiceRunning property. Its value is '1'.
    InstallUtils::CServiceUtil::isServiceRunningService BFE is currently running.
    MSI (s) (F0:28) [18:10:40:316]: Doing action: LocateSourceDir
    Action ended 18:10:40: VerifyBFERunning. Return value 1.
    MSI (s) (F0:E0) [18:10:40:347]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3B42.tmp, Entrypoint: LocateSourceDir
    Action start 18:10:40: LocateSourceDir.
    preclientca: SourceDir=
    MSI (s) (F0!54) [18:10:40:347]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'C:\Windows\Temp\Symantec\'.
    preclientca: OriginalDatabase=C:\Windows\Temp\Symantec\Sep64.msi
    MSI (s) (F0:28) [18:10:40:347]: Doing action: AppSearch
    Action ended 18:10:40: LocateSourceDir. Return value 1.
    Action start 18:10:40: AppSearch.
    MSI (s) (F0:28) [18:10:40:347]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:347]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Sygate Technologies, Inc.\Sygate Personal Firewall 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\Symantec Endpoint Protection\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\Symantec Endpoint Protection 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding OS_SUPPORTS_UI property. Its value is 'C:\Windows\explorer.exe'.
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding IE6FOUND property. Its value is 'C:\Windows\SysWOW64\shdocvw.dll'.
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SPMXMLFOUND property. Its value is 'C:\Windows\Temp\Symantec\SyLink.xml'.
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\Common 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SERDEFDATFOUND property. Its value is 'C:\Windows\Temp\Symantec\serdef.dat'.
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\Symantec Endpoint Protection\VolatileInstallData 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding UNINSTALLREBOOTREQUIRED property. Its value is '1'.
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG13_PATH property. Its value is 'C:\Windows\system32\rastls.dll'.
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG13_INTERACTIVEUIPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG13_CONFIGUIPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG13_IDENTITYPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG25_PATH property. Its value is 'C:\Windows\system32\rastls.dll'.
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG25_INTERACTIVEUIPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG25_CONFIGUIPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SYMRASMAN_REG25_IDENTITYPATH property. Its value is 'C:\Windows\system32\rastls.dll'.
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Sygate Technologies, Inc.\Sygate Personal Firewall 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\Symantec Endpoint Protection\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1324 2: Data\Config 3: 1 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1324 2: Data\Config 3: 1 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1324 2: Data\Config 3: 1 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1324 2: Data\Config 3: 1 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Microsoft\WinFLP\Optional Components 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding DEFENDERFOUND property. Its value is 'Microsoft Windows Defender'.
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\TSE 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1325 2: sysferThunk.dll 
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding OUTLOOKFOUND property. Its value is 'C:\Program Files\Microsoft Office\Office14\'.
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\EXCHNG32.EXE 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding NOTESFOUND property. Its value is 'C:\Program Files (x86)\lotus\notes\'.
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Norton AntiVirus Corporate Edition 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7} 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\SymBPL\{D270A25E-8BB6-4895-8517-89B898969BBF} 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps 3: 2 
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding SDIDATFOUND property. Its value is 'C:\Windows\Temp\Symantec\sdi.dat'.
    MSI (s) (F0:28) [18:10:40:362]: Note: 1: 1325 2: sysferThunk.dll 
    MSI (s) (F0:28) [18:10:40:362]: PROPERTY CHANGE: Adding FOUNDSEPSLF property. Its value is 'C:\Windows\Temp\Symantec\sep.slf'.
    MSI (s) (F0:28) [18:10:40:378]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Symantec\Symantec Endpoint Protection\{3771A34D-2132-48EA-A486-D62ECDF9D553}\Install 3: 2 
    MSI (s) (F0:28) [18:10:40:378]: PROPERTY CHANGE: Adding VC8B762CHECK property. Its value is 'C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2\'.
    MSI (s) (F0:28) [18:10:40:378]: PROPERTY CHANGE: Adding VC8B42CHECK property. Its value is 'C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_93b21c24844efba7\'.
    MSI (s) (F0:28) [18:10:40:378]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SOFTWARE\WholeSecurity Inc.\Confidence Online(tm) Server 3: 2 
    MSI (s) (F0:28) [18:10:40:378]: Doing action: checkInstallBlocksIE
    Action ended 18:10:40: AppSearch. Return value 1.
    MSI (s) (F0:04) [18:10:40:456]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3B81.tmp, Entrypoint: checkInstallBlocksIE
    MSI (s) (F0!14) [18:10:40:472]: PROPERTY CHANGE: Adding IdcXmlPath property. Its value is 'C:\Windows\Temp\idc.xml'.
    Action start 18:10:40: checkInstallBlocksIE.
    IDCCA:  CMsiUtil::isActionScheduled: Unable to fetch view (Result: 259)
    MSI (s) (F0:28) [18:10:40:581]: Doing action: CommunicateLaunchConditions
    Action ended 18:10:40: checkInstallBlocksIE. Return value 1.
    MSI (s) (F0:70) [18:10:40:643]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3C4D.tmp, Entrypoint: CommunicateLaunchConditions
    Action start 18:10:40: CommunicateLaunchConditions.
    Communicate LC: NOT Version9X=1
    Communicate LC: VersionNT > 500=1
    Communicate LC: NOT WINDOWSFUNDAMENTALS=1
    Communicate LC: (NOT MIGRATIONPENDINGREBOOT) OR SISFAILED=1
    Communicate LC: (NOT UNINSTALLREBOOTREQUIRED) OR Installed=0
    Communicate LC: Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
    Communicate LC:  calling communicate state with the following arguments: 
    Communicate LC: Prodversion = 12.1.2015.2015
    Communicate LC: PathToSylink = C:\Windows\Temp\Symantec\
    Communicate LC: Oldversion = 
    Communicate LC: ReasonStr = Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
    Communicate LC: StatusCode = 302469124
    MSI (s) (F0:28) [18:10:44:980]: Skipping action: IsAdmin (condition is false)
    MSI (s) (F0:28) [18:10:44:980]: Doing action: preLaunchCond
    Action ended 18:10:44: CommunicateLaunchConditions. Return value 1.
    MSI (s) (F0:14) [18:10:45:027]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4D7D.tmp, Entrypoint: preLaunchCond
    Action start 18:10:44: preLaunchCond.
    MSI (s) (F0!0C) [18:10:45:245]: Note: 1: 2731 2: 0 
    IDCCA:  preLaunchCond - Launch condition `4Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.` with condition `(NOT UNINSTALLREBOOTREQUIRED) OR Installed` failed
    MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:261]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2731 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2732 2: 0 
    Unable to determine feature state: 1606 
    MSI (s) (F0!0C) [18:10:45:277]: Note: 1: 2732 2: 0 
    IDCCA: Unable to get target path (Result: 267)
    IDCCA: Unable to get target path (Result: 267)
    IDCCA: Machine ID: 11f4cf80b018069d291865ca26c93df33d6a79
    IDCCA: HttpQueryInfo: 200 OK Error: 0
    IDCCA: SETI::CUploadFile::logout200 OK
    MSI (s) (F0:28) [18:10:52:843]: Doing action: LaunchConditions
    Action ended 18:10:52: preLaunchCond. Return value 1.
    Action start 18:10:52: LaunchConditions.
    MSI (s) (F0:28) [18:10:52:843]: Product: Symantec Endpoint Protection -- 4Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
     
    4Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
    Action ended 18:10:52: LaunchConditions. Return value 3.
    Action ended 18:10:52: INSTALL. Return value 3.
    Property(S): UpgradeCode = {F7BE9C8A-C2E6-470D-B703-0A1845E6FF8C}
    Property(S): OS_SUPPORTS_UI = C:\Windows\explorer.exe
    Property(S): IE6FOUND = C:\Windows\SysWOW64\shdocvw.dll
    Property(S): SPMXMLFOUND = C:\Windows\Temp\Symantec\SyLink.xml
    Property(S): SERDEFDATFOUND = C:\Windows\Temp\Symantec\serdef.dat
    Property(S): UNINSTALLREBOOTREQUIRED = 1
    Property(S): SYMRASMAN_REG13_PATH = C:\Windows\system32\rastls.dll
    Property(S): SYMRASMAN_REG13_INTERACTIVEUIPATH = C:\Windows\system32\rastls.dll
    Property(S): SYMRASMAN_REG13_CONFIGUIPATH = C:\Windows\system32\rastls.dll
    Property(S): SYMRASMAN_REG13_IDENTITYPATH = C:\Windows\system32\rastls.dll
    Property(S): SYMRASMAN_REG25_PATH = C:\Windows\system32\rastls.dll
    Property(S): SYMRASMAN_REG25_INTERACTIVEUIPATH = C:\Windows\system32\rastls.dll
    Property(S): SYMRASMAN_REG25_CONFIGUIPATH = C:\Windows\system32\rastls.dll
    Property(S): SYMRASMAN_REG25_IDENTITYPATH = C:\Windows\system32\rastls.dll
    Property(S): DEFENDERFOUND = Microsoft Windows Defender
    Property(S): OUTLOOKFOUND = C:\Program Files\Microsoft Office\Office14\
    Property(S): NOTESFOUND = C:\Program Files (x86)\lotus\notes\
    Property(S): SDIDATFOUND = C:\Windows\Temp\Symantec\sdi.dat
    Property(S): FOUNDSEPSLF = C:\Windows\Temp\Symantec\sep.slf
    Property(S): VC8B762CHECK = C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2\
    Property(S): VC8B42CHECK = C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_93b21c24844efba7\
    Property(S): ProductName = Symantec Endpoint Protection
    Property(S): ProductDisplayName = Symantec Endpoint Protection
    Property(S): ProductVersion = 12.1.2015.2015
    Property(S): OPTOUTREPSUBMISSION = 0
    Property(S): ENABLEAUTOPROTECT = 1
    Property(S): DISABLEDEFENDER = 1
    Property(S): RUNLIVEUPDATE = 1
    Property(S): IDCENABLE = 1
    Property(S): VersionNT64 = 601
    Property(S): Managed_Client_Type = Unmanaged
    Property(S): SetupType = Typical
    Property(S): _IsSetupTypeMin = Typical
    Property(S): SBE_Feature_Set = Typical
    Property(S): AgreeToLicense = No
    Property(S): _IsMaintenance = Change
    Property(S): RestartManagerOption = CloseRestart
    Property(S): SMSName = SepMasterService
    Property(S): SMSDescription = Symantec Endpoint Protection
    Property(S): InUISequence = 0
    Property(S): REBOOT = ReallySuppress
    Property(S): System64Folder = C:\Windows\system32\
    Property(S): ProgramFilesFolder = C:\Program Files (x86)\
    Property(S): WindowsFolder = C:\Windows\
    Property(S): CommonFilesFolder = C:\Program Files (x86)\Common Files\
    Property(S): SourceDir = C:\Windows\Temp\Symantec\
    Property(S): CommonAppDataFolder = C:\ProgramData\
    Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
    Property(S): DesktopFolder = C:\Users\Public\Desktop\
    Property(S): Manufacturer = Symantec Corporation
    Property(S): ProductCode = {C2103AF2-E66C-446B-9791-9207840EC821}
    Property(S): ProductLanguage = 1033
    Property(S): ALLUSERS = 1
    Property(S): APPTYPE = 105
    Property(S): LUMoniker = {A8BA6A8E-8DB4-4575-8C7B-13CAF85B70AB}
    Property(S): ARPSYSTEMCOMPONENT = 1
    Property(S): INSTALLLEVEL = 100
    Property(S): MSIENFORCEUPGRADECOMPONENTRULES = 1
    Property(S): IDCDATASERVER = tses.symantec.com
    Property(S): IDCDATALOC = /incoming
    Property(S): IDCDEPLOYMENT = Local
    Property(S): IDCEXTRAINFO = 0
    Property(S): SISUSETRANSACTIONS = 1
    Property(S): MAXMIGRATIONDELAY = 60
    Property(S): MIGRATIONDELAY = 30
    Property(S): MsiLogging = voicewarmupx
    Property(S): MSIRESTARTMANAGERCONTROL = Disable
    Property(S): SMSLongDescription = Provides malware and threat protection for Symantec Endpoint Protection
    Property(S): SymMigrationRebootMessage = To provide complete protection, Symantec Endpoint Protection requires this computer to restart.
    Property(S): SymRebootAtEndMessage = To provide complete protection, Symantec Endpoint Protection requires this computer to restart.
    Property(S): InstallCompleteMessage = The installation has completed successfully
    Property(S): ShowServiceProgressMessage = Executing install script via service
    Property(S): ShowServiceProgress_RBMessage = Executing rollback script via service
    Property(S): SiloGUID = {3771A34D-2132-48EA-A486-D62ECDF9D553}
    Property(S): SILO_REGHIVE = SOFTWARE\Symantec\Symantec Endpoint Protection
    Property(S): HIGHCONTRAST = 0
    Property(S): SYM_MAJOR_UPGRADE = 0
    Property(S): SEPLicprop = SB
    Property(S): SEPLicpropReg = sepsb
    Property(S): SYMLICENSETYPE = 0
    Property(S): SYMLICENSETYPESTRING = sepe
    Property(S): MIGLICENSETYPE = 0
    Property(S): LOADEDDRIVERSFOUND = 0
    Property(S): RESOLVEFEATURES = 0
    Property(S): InstallingToReparse = 0
    Property(S): SYMCOMPRESSFOLDERS = 1
    Property(S): VMWAREDETECTED = 0
    Property(S): ValidInstallDir = 0
    Property(S): CACHEINSTALL = 1
    Property(S): MIGRATESETTINGS = 1
    Property(S): CMC_PRODUCT_BUILD = #2015
    Property(S): CMC_PRODUCT_VERSION = 12.1
    Property(S): CACHE_INSTALLER = 1
    Property(S): ADDSTARTMENUICON = 1
    Property(S): ErrorDialog = SetupError
    Property(S): ApplicationUsers = AllUsers
    Property(S): DefaultUIFont = Tahoma8
    Property(S): ProgressType0 = install
    Property(S): ProgressType1 = Installing
    Property(S): ProgressType2 = installed
    Property(S): ProgressType3 = installs
    Property(S): INSTALLSYMELAM = 1
    Property(S): LibSep64 = 1
    Property(S): SysPlantStartType = disabled
    Property(S): LibSepCommon = 1
    Property(S): HITYPE = 0
    Property(S): LOCATIONSENSOR = 0
    Property(S): REVERSEDNS = 0
    Property(S): WSCAVALERT = 1
    Property(S): WSCAVUPTODATE = 7
    Property(S): WSCCONTROL = 0
    Property(S): LibSnac64 = 1
    Property(S): LaunchBrowserProp = Rundll32.Exe url.Dll,FileProtocolHandler
    Property(S): Lang = 1033
    Property(S): LiveUpdateVars = 1
    Property(S): SecureCustomProperties = ADDLOCAL;ADDSTARTMENUICON;AMBERPLUSFOUND;AMBERSNACPLUSFOUND;APPDATAINSTALL;APPDATAINSTALLLOGS;APPDATAINSTALLSCRIPTS;APPLOGS;APTEMP;AVLOGS;BADPATTS;CACHE_INSTALLER;CACHED_INSTALLS;CACHEINSTALL;CMC_PRODUCT_BUILD;CMC_PRODUCT_VERSION;COMPANYNAME;CONFIGDIR;CONTENTCACHE;CONTENTMIGRATION;DB;DECTEMP;DEFENDERFOUND;DISABLEDEFENDER;ENABLEAUTOPROTECT;EXCHANGEFOUND;FEATURESTATEDIR;FOREFRONEXCFOUND;FOREFRONTTMGFOUND;FOUNDBROWSERPROTECTIONLITE;FOUNDLIVEUPDTHST;FOUNDSEPSLF;FOUNDSETTINGSHOSTSLIVEUPDATE;FOUNDSNACSLF;HELP;HITYPE;I2_LDVP.VDB;IDCDATALOC;IDCDATASERVER;IDCDEPLOYMENT;IDCENABLE;IDCEXTRAINFO;IE6FOUND;INSTALLEDPRODUCTTYPE;INSTALLSCRIPTS;INSTALLSYMELAM;JAGUARSNACPLUSFOUND;LANG1033;LEGACYSEA_NM;LEGACYSEA_NM1;LEGACYSEA_NM2;LOADEDDRIVERSFOUND;LOCATIONSENSOR;MAXMIGRATIONDELAY;MIGLICENSETYPE;MIGRATESETTINGS;MIGRATIONDELAY;MIGRATIONPENDINGREBOOT;MSIRESTARTMANAGERCONTROL;NEWERFOUND;NEWERSNACFOUND;NORTONAV;NORTONAVPRO;NORTONFOUND;NOTESFOUND;OLDAPPDATADIR;OLDERFOUND;OLDPRODUCTVERSION;OLDSILOFOUND;OPTOUTREPSUBMISSION;OS_SUPPORTS_UI;OUTLOOKFOUND;PENDINGMODULEREMOVAL;PERSISTEDDATA;PREAMBERFOUND;PREAMBERSNACFOUND;PREHAMLETFOUND;PRODUCTINSTALLDIR;PRODUCTINSTALLDIRINSETAID;QUARANTINE;REINSTALL;REMOVE;RES;RESOLVEFEATURES;REVERSEDNS;ROOTDRIVE;RUNLIVEUPDATE;SAVCORP7XFOUND;SAVFOUND;SAVMIGINSTDIR;SAVSMIGFOLDER;SCSMIGINSTDIR;SDIDATFOUND;SEAMIGINSTDIR;SEPMIGINSTDIR;SERDEFDATFOUND;SILO_REGHIVE;SISFAILED;SISUSETRANSACTIONS;SMCLU;SNACFOUND;SNACMIGINSTDIR;SNACNPFOUND32;SNACNPFOUND64;SOURCEDIR;SPA51BLOCK;SPAFOUND;SPMXMLFOUND;SRCLICFILE;STATEDIR;STATICDATA;SYLINKSRCDIR;SYM_MAJOR_UPGRADE;SYMCOMPRESSFOLDERS;SYMFORCEFAIL;SYMFORCEFAILPHASE;SYMLICENSETYPE;SYMLICENSETYPESTRING;SYMRASMAN_REG13_CONFIGUIPATH;SYMRASMAN_REG13_IDENTITYPATH;SYMRASMAN_REG13_INTERACTIVEUIPATH;SYMRASMAN_REG13_PATH;SYMRASMAN_REG25_CONFIGUIPATH;SYMRASMAN_REG25_IDENTITYPATH;SYMRASMAN_REG25_INTERACTIVEUIPATH;SYMRASMAN_REG25_PATH;SYMREBOOT;SYMSRCDIR;SYMSTARTMENUDIR;SYSFERFOUND32;SYSFERFOUND64;SYSFERTHUNKFOUND32;SYSFERTHUNKFOUND64;TARGETDIR;TEEFERVISTA;TEEFERWIN8;TEEFERXP;TPAR;UNINSTALLREBOOTREQUIRED;USEDCUSTOMINSTALL;USERNAME;VC8B1416CHECK;VC8B42CHECK;VC8B762CHECK;VMWAREDETECTED;WINDOWSFIREWALLSTATE;WSCAVALERT;WSCAVUPTODATE;WSCCONTROL;WSCONFONLINE;XFER;XFER_TMP
    Property(S): MsiLogFileLocation = C:\Windows\TEMP\SEP_INST.LOG
    Property(S): PackageCode = {FCBCA23E-67D3-469D-9B7C-03580B8BC8B5}
    Property(S): ProductState = -1
    Property(S): PackagecodeChanging = 1
    Property(S): SRCLICFILE = EE
    Property(S): CURRENTDIRECTORY = C:\Windows\TEMP\Symantec
    Property(S): CLIENTUILEVEL = 3
    Property(S): CLIENTPROCESSID = 5584
    Property(S): VersionDatabase = 200
    Property(S): MsiSystemRebootPending = 1
    Property(S): VersionMsi = 5.00
    Property(S): VersionNT = 601
    Property(S): WindowsBuild = 7601
    Property(S): ServicePackLevel = 1
    Property(S): ServicePackLevelMinor = 0
    Property(S): MsiNTProductType = 1
    Property(S): WindowsVolume = C:\
    Property(S): SystemFolder = C:\Windows\SysWOW64\
    Property(S): RemoteAdminTS = 1
    Property(S): TempFolder = C:\Windows\TEMP\
    Property(S): ProgramFiles64Folder = C:\Program Files\
    Property(S): CommonFiles64Folder = C:\Program Files\Common Files\
    Property(S): AppDataFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\
    Property(S): FavoritesFolder = C:\Windows\system32\config\systemprofile\Favorites\
    Property(S): NetHoodFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
    Property(S): PersonalFolder = C:\Windows\system32\config\systemprofile\Documents\
    Property(S): PrintHoodFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
    Property(S): RecentFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\
    Property(S): SendToFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\
    Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
    Property(S): LocalAppDataFolder = C:\Windows\system32\config\systemprofile\AppData\Local\
    Property(S): MyPicturesFolder = C:\Windows\system32\config\systemprofile\Pictures\
    Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
    Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
    Property(S): FontsFolder = C:\Windows\Fonts\
    Property(S): GPTSupport = 1
    Property(S): OLEAdvtSupport = 1
    Property(S): ShellAdvtSupport = 1
    Property(S): MsiAMD64 = 6
    Property(S): Msix64 = 6
    Property(S): Intel = 6
    Property(S): PhysicalMemory = 3958
    Property(S): VirtualMemory = 5638
    Property(S): AdminUser = 1
    Property(S): MsiTrueAdminUser = 1
    Property(S): LogonUser = SYSTEM
    Property(S): UserSID = S-1-5-18
    Property(S): UserLanguageID = 1033
    Property(S): ComputerName = MGUKASYAN-E6410
    Property(S): SystemLanguageID = 1033
    Property(S): ScreenX = 1024
    Property(S): ScreenY = 768
    Property(S): CaptionHeight = 22
    Property(S): BorderTop = 1
    Property(S): BorderSide = 1
    Property(S): TextHeight = 16
    Property(S): TextInternalLeading = 3
    Property(S): ColorBits = 32
    Property(S): TTCSupport = 1
    Property(S): Time = 18:10:52
    Property(S): Date = 3/15/2013
    Property(S): MsiNetAssemblySupport = 4.0.30319.1
    Property(S): MsiWin32AssemblySupport = 6.1.7601.17514
    Property(S): RedirectedDllSupport = 2
    Property(S): MsiRunningElevated = 1
    Property(S): Privileged = 1
    Property(S): USERNAME = admin
    Property(S): DATABASE = C:\Windows\Installer\903786.msi
    Property(S): OriginalDatabase = C:\Windows\Temp\Symantec\Sep64.msi
    Property(S): UILevel = 2
    Property(S): ACTION = INSTALL
    Property(S): Supports32BitDlls = 1
    Property(S): BFEServiceRunning = 1
    Property(S): IdcXmlPath = C:\Windows\Temp\idc.xml
    MSI (s) (F0:28) [18:10:52:905]: Note: 1: 1708 
    MSI (s) (F0:28) [18:10:52:905]: Product: Symantec Endpoint Protection -- Installation operation failed.
     
    MSI (s) (F0:28) [18:10:52:905]: Windows Installer installed the product. Product Name: Symantec Endpoint Protection. Product Version: 12.1.2015.2015. Product Language: 1033. Manufacturer: Symantec Corporation. Installation success or error status: 1603.
     
    MSI (s) (F0:28) [18:10:52:905]: Deferring clean up of packages/files, if any exist
    MSI (s) (F0:28) [18:10:52:905]: MainEngineThread is returning 1603
    MSI (s) (F0:CC) [18:10:52:905]: No System Restore sequence number for this installation.
    === Logging stopped: 3/15/2013  18:10:52 ===
    MSI (s) (F0:CC) [18:10:52:905]: User policy value 'DisableRollback' is 0
    MSI (s) (F0:CC) [18:10:52:905]: Machine policy value 'DisableRollback' is 0
    MSI (s) (F0:CC) [18:10:52:905]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (F0:CC) [18:10:52:905]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 
    MSI (s) (F0:CC) [18:10:52:905]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 
    MSI (s) (F0:CC) [18:10:52:905]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2 
    MSI (s) (F0:CC) [18:10:52:905]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2 
    MSI (s) (F0:CC) [18:10:52:905]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (s) (F0:CC) [18:10:52:905]: Restoring environment variables
    MSI (s) (F0:CC) [18:10:52:905]: Destroying RemoteAPI object.
    MSI (s) (F0:24) [18:10:52:905]: Custom Action Manager thread ending.
    MSI (c) (D0:A0) [18:10:52:905]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
    MSI (c) (D0:A0) [18:10:52:905]: MainEngineThread is returning 1603
    === Verbose logging stopped: 3/15/2013  18:10:52 ===
     


  • 4.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Mar 19, 2013 05:25 PM
    MSI (s) (F0:28) [18:10:52:843]: Product: Symantec Endpoint Protection -- 4Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.
     
    Open the registry and navigate to:
     
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager
     
    Locate the PendingFileRenameOperations key and rename it to PendingFileRenameOperations2 or delete it and then try the install again.
     
    Do not reboot after deleting the key. Re-run the install immmediately after deleting as it usually comes back after a reboot.

     



  • 5.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Mar 19, 2013 11:14 PM

    While installing Symantec Products , we get an error “Symantec Endpoint Protection has detected that there are pending system changes that require a reboot. Please reboot the system and rerun the installation.”
     
    To resolve this issue, typically, you would navigate in the registry to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager and locate the PendingFileRenameOperations key and rename it to  PendingFileRenameOperations2 and then try to install the product.
      
    But why do we get the error?
       
    The fact that executable images and DLLs are memory-mapped when they are used makes it impossible to update core system files after Windows has finished booting. The MoveFileEx Windows API has an option to specify that a file move be delayed until the next boot. Service Packs and hotfixes that must update in-use memory mapped files install replacement files onto a system in temporary locations and use the MoveFileEx API to have them replace otherwise in-use files. When used with that option,
    MoveFileEx simply records commands in the PendingFileRenameOperations and PendingFileRenameOperations2 values under HKLM\SYSTEM\CurrentControlSet\
    Control\Session Manager. These registry values are of type MULTI_SZ, where each operation is specified in pairs of file names: the first file name is the source location, and the second is the target location. Delete operations use an empty string as their target path.
      
    The PendingFileRenameOperations key stores the names of files to be renamed when the system restarts. It consists of pairs of file names. The file specified in the first item of the pair is renamed to match the second item of the pair. The system adds this entry to the registry when a user or program tries to rename a file that is in use. The file names are stored in the value of this entry until the system is restarted and they are renamed. This entry is not created by the Operating System.
     
    In order to prevent such things from happening in the, it is mandatory to reboot the server after installing any application/driver when it requests for a reboot immediately.



  • 6.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Mar 20, 2013 02:59 PM

    I tried this but i keep getting the error "Symantec Endpoint Protection has detected that there are pending system changed that require a reboot. Please reboot the system and rerun the installation."

    After rebooting the key also dissappears.



  • 7.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Mar 20, 2013 03:40 PM

    Another update on this. Started to do a custom install, first did just live update and left off everything else, then did network threat protection, then tried the other 2 options and now it has failed again and rolled back. 



  • 8.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Mar 20, 2013 11:22 PM

    There are two keys to be deleted. Delete the keys and do reboot and then install again

    http://www.symantec.com/business/support/index?page=content&id=TECH103109&locale=en_US



  • 9.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Trusted Advisor
    Posted Mar 21, 2013 07:28 AM

     

    Hello,

    What OS are you running on your machine?

    Make sure you uninstall the Liveupdate from the Add/Remove Programs. Secondly, disable the UAC (incase of windows 7 and above)

    Suggestions:

    First, Check this Article:

    Installer Information - "Symantec Endpoint Protection has detected that there are pending system changes that require a reboot." when trying to install SEP 11.0 on Windows 7

    http://www.symantec.com/docs/TECH95608

    Steps -

    1. Open registry and go to

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\

    hightlight Session Manager on the right hand side delete the value PendingFileRenameOperations

    2. Also delete the same value from

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet001\Control\Session Manager\PendingFileRenameOperations

    then run the install...without rebooting the PC

    http://service1.symantec.com/SUPPORT/ent-security.nsf/ppfdocs/2007121609023348?Open&dtype=corp&src=&seg=&om=1&om_out=prod

    Then

    3.Disable UAC (Incase of Windows 7 and above)

    4.If it's an upgrade uninstall SEP using cleanwipe utility and restart the system.

    How to get the CleanWipe tool (Endpoint Removal)

    https://www-secure.symantec.com/connect/forums/how-get-cleanwipe-tool-endpoint-removal

    OR

    4. Manually uninstall SEP.

    Delete the contents of the SEP from the computer and registry after backing up the registry, then try reinstalling SEP.

    http://www.symantec.com/docs/TECH184988

    NOTE: For receiving CleanWipe utility requires you to create a case with Symantec.

    In your case, I would recommend you to check this Article below:

    Methods for uninstalling Symantec Endpoint Protection

    https://www-secure.symantec.com/connect/forums/methods-uninstalling-symantec-endpoint-protection

    Manual uninstall documents for Symantec Endpoint Protection

    http://www.symantec.com/docs/TECH164769

    Hope that helps!!



  • 10.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Mar 28, 2013 10:48 PM

    http://www.symantec.com/business/support/index?page=content&id=TECH203996 appears to be the solution.  It's also documented at http://social.technet.microsoft.com/Forums/en-US/winserverManagement/thread/8f4f4c74-f250-42b4-afdd-a76598dd863f.  

    Unfortuantly based on past experience with Symantec and bugs, it may be 6 months before we see this fixed unless Microsoft fixes it on their end so every new Win8 box is doomed to have this problem if you choose to patch first and install SEP second.  I won't debate the logic of patching first before installing security software or installing security first before patching, but history tells me it will be many months before this is fixed.  It's a shame Symantec doesn't have a hot-fix cycle like every other software vendor does.  This really needs fixed.



  • 11.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Apr 16, 2013 10:08 AM

    Hello. I have tried all of the suggested steps in this thread and nothing works. Removing the registry keys does not help as it won't let me re-run the installation and requires a reboot. The Windows 8 thread doesn't help either as it's a Windows 7 pc and windows defender is already disabled. 



  • 12.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Apr 17, 2013 01:34 AM

    Hey try this:

    if you're using package to install SEP recreate the package with the option to create SEP shortcut on the Start Menu disabled, just uncheck it and try to reinstall the SEP.

    if you're using the SEPM's default packages, just change the install settings to create SEP shortcut on the Start Menu as disabled.



  • 13.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Apr 18, 2013 01:51 PM

    Hi. I will have to give this a try. Out of curiousity though, what impact would that shortcut have on the installation failing? 



  • 14.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Apr 18, 2013 08:43 PM

    Im not sure but I found it on a knowledge base before, I just cant remember where, but we used that procedure before when we had the rolling back issue. if you want deeper analysis of that you should call support for them to check why the shortcut on start has something to do with the rollback,.



  • 15.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Apr 26, 2013 12:34 AM

    Check it

    https://www-secure.symantec.com/connect/forums/sep-roll-back-win-8#comment-8636301



  • 16.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted Apr 26, 2013 03:06 AM

     

    Hi,

     

    When I faced the  Roll back Issue I followed these step....

    First check you are login with admin rights
    then 
    try to remove live and symanec from add & remove
    then stop and all symantec services ...services.msc
    stop all extra startup ,,,,msconfig
    and stop symantec ccap..ccset ccevt process via taskkill /IM ccap* /F

    then 
    cut these folders to other path 
    C:\Documents and Settings\currentloginuser\Application Data\Symantec
    C:\Documents and Settings\All Users\Application Data\Symantec
    C:\Program Files\Common Files\Symantec Shared
    C:\Program Files\Symantec
    C:\Program Files\Symantec AntiVirus

    remove symantec from these registry
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer

    then try to install



  • 17.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Broadcom Employee
    Posted Apr 26, 2013 10:04 AM

    Hi,

    You have tried almost all the steps which are required to troubleshoot.

    If possible involve the support to troubleshoot it further.

    I would suggest that try to install any legacy version if possible & then go with an upgrade.

     



  • 18.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted May 07, 2013 01:39 PM

    Legacy version is the only thing that seemed to work. Pretty dissapointed with the support on this one when I contacted Symantec as they couldn't explain why this was occurring. Since then I've seen it happen in about 4-5 other instances. 12.1.1 seems to work fine though. Haven't had a chance to test if it will upgrade automatically on it's own yet. 



  • 19.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install

    Posted May 07, 2013 09:15 PM

    did you try to recreate a new package with the option unchecked on the create start menu shortcut?

     



  • 20.  RE: Symantec Endpoint Protection 12.1.2 rolling back during install
    Best Answer

    Posted May 09, 2013 10:37 AM

    Yes we're way past the start menu option. I did FINALLY resolve this though and wanted to share my findings. Basically this was a combination of a number of different methods suggested above. 

    The following steps were necessary to get the 12.1.2 installation to work properly. If the installation currently has been corrupted (12.1.2), run the clean wipe utility from Symantec to start fresh with the 12.1.1 installation.


    1. Install a legacy version, in my case I used 12.1.1
    2. Disable windows firewall
    3. Disable windows defender
    4. Disable UAC
    5. Uninstall Microsoft Security Essentials completely (this will remove windows defender completely)

    6. Open registry and go to
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\
    hightlight Session Manager on the right hand side delete the value in PendingFileRenameOperations

    7. Allow the SEPM server to push the latest package update to the laptop (12.1.2), it should then prompt that a new update is available and to download now. (This is under the assumption that laptop is sitting in the same container the 12.1.2 version is set to as the default installation package in the SEPM console)

    8. Once the installation is complete, reboot the laptop. The version should now show as up to date and on 12.1.2