cancel
Showing results for 
Search instead for 
Did you mean: 

Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution
I am running McAfee ePo 5.3.3. (build 279), installed McAfee Agent 5.5.1.388. I deployed McAfee Endpoint Security (include Threat Prevention, Web Control, Firewall, Adaptive Threat Protection) to many clients (mainly running windows 7 and windows 10) successful but there are a few client I can push ENS package but it cannot install and return unknown error on ePO. I check logs on that clients but I can't find anything. I will give you more logs for investigate as you need. Your help will be most appreciated and thank you so much
2 Solutions

Accepted Solutions
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 8 of 14

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

It might be best to raise an SR with technical support so a proper investigation can be made. Please raise the service request via the portal and attach a MER of the client so we can assist you.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 14 of 14

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

@tassha There are many reasons why the installation of any point product can fail. It's worth gathering the logs and submitting them to support as each case will likely be different. There are currently no major known issues with installations - the only thing to be aware of is the December Update. If you already have 10.6.1 + any HF installed, you'll need to wait for the Febuary Hotfix to update the clients to.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
13 Replies
McAfee Employee patrakshar
McAfee Employee
Report Inappropriate Content
Message 2 of 14

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

Since you have triggered the installation from EPO, hence the installation log should be available under C:\Windows\temp\McAfeeLogs folder. Can you share the complete McAfeeLogs? In the agent monitor are you seeing that the task is downloading ENS packages from EPO?

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

Hi patrakshar

I can see the deployment task from ePO on client via status log of McAfee agent status monitorDeploy_ENS.jpg

I sent you complete log from folder C:\%temp%\McAfeeLogs via your inbox. Here is apart of deployment log:

2018-11-23 13:58:04 I #6752 msgbus Received 336 bytes from pipe <\\.\pipe\ma_5bd9fa52-9d71-e8fd-20b0-306ab91d3db1_3092.00000000016BC8A0_3427364566>
2018-11-23 13:58:04 I #6752 msgbus Set the destination pid to zero to stop the sending this message to other named pipe connections
2018-11-23 13:58:04 I #6752 msgbus Received topic <ma.mue_event.publish>, matched <ma.*>
2018-11-23 13:58:04 I #6752 msgbus Scheduling subscriber <ma.*> callback to run from thread pool...
2018-11-23 13:58:04 I #5884 msgbus Subscriber now invoking handler...
2018-11-23 13:58:04 I #5884 UiProviderAdaptor On Progress Callback EventType=Progress, ProgressStep=12, MaxProgress = 0, Progress Message = Downloading McAfee_Common_x64.msi.
2018-11-23 13:58:04 I #5884 UiProviderAdaptor On Progress Callback EventType=Progress ProgressStep=12 MaxProgress = 0 Progress Message = Downloading McAfee_Common_x64.msi.
2018-11-23 13:58:04 I #6752 msgbus After Worker callback is Invoked in Subscriber
2018-11-23 13:58:32 I #6752 msgbus Received 357 bytes from pipe <\\.\pipe\ma_5bd9fa52-9d71-e8fd-20b0-306ab91d3db1_3092.00000000016BC8A0_3427364566>
2018-11-23 13:58:32 I #6752 msgbus Set the destination pid to zero to stop the sending this message to other named pipe connections
2018-11-23 13:58:32 I #6752 msgbus Received topic <ma.mue_event.publish>, matched <ma.*>
2018-11-23 13:58:32 I #6752 msgbus Scheduling subscriber <ma.*> callback to run from thread pool...
2018-11-23 13:58:32 I #5884 msgbus Subscriber now invoking handler...
2018-11-23 13:58:32 I #5884 UiProviderAdaptor On Progress Callback EventType=Progress, ProgressStep=13, MaxProgress = 0, Progress Message = Error occurred while downloading McAfee_Common_x64.msi.
2018-11-23 13:58:32 I #5884 UiProviderAdaptor On Progress Callback EventType=Progress ProgressStep=13 MaxProgress = 0 Progress Message = Error occurred while downloading McAfee_Common_x64.msi.
2018-11-23 13:58:32 I #6752 msgbus After Worker callback is Invoked in Subscriber
2018-11-23 13:58:32 I #6752 msgbus Received 347 bytes from pipe <\\.\pipe\ma_5bd9fa52-9d71-e8fd-20b0-306ab91d3db1_3092.00000000016BC8A0_3427364566>
2018-11-23 13:58:32 I #6752 msgbus Set the destination pid to zero to stop the sending this message to other named pipe connections
2018-11-23 13:58:32 I #6752 msgbus Received topic <ma.mue_event.publish>, matched <ma.*>
2018-11-23 13:58:32 I #6752 msgbus Scheduling subscriber <ma.*> callback to run from thread pool...
2018-11-23 13:58:32 I #5884 msgbus Subscriber now invoking handler...
2018-11-23 13:58:32 I #5884 UiProviderAdaptor On Progress Callback EventType=Progress, ProgressStep=12, MaxProgress = 0, Progress Message = Error occurred while installing ENDP_AM_1060.
2018-11-23 13:58:32 I #5884 UiProviderAdaptor On Progress Callback EventType=Progress ProgressStep=12 MaxProgress = 0 Progress Message = Error occurred while installing ENDP_AM_1060.
2018-11-23 13:58:32 I #6752 msgbus Received 339 bytes from pipe <\\.\pipe\ma_5bd9fa52-9d71-e8fd-20b0-306ab91d3db1_3092.00000000016BC8A0_3427364566>
2018-11-23 13:58:32 I #6752 msgbus Set the destination pid to zero to stop the sending this message to other named pipe connections
2018-11-23 13:58:32 I #6752 msgbus Received topic <ma.mue_event.publish>, matched <ma.*>
2018-11-23 13:58:32 I #6752 msgbus Scheduling subscriber <ma.*> callback to run from thread pool...
2018-11-23 13:58:32 I #3040 msgbus Subscriber now invoking handler...
2018-11-23 13:58:32 I #6752 msgbus After Worker callback is Invoked in Subscriber
2018-11-23 13:58:32 I #6752 msgbus After Worker callback is Invoked in Subscriber

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 4 of 14

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

As mentioned by patrakshar you can find the logs in: C:/Windows/Temp/McAfeeLogs

What you can do to find the reason for the installation failure is:

  1. Open the installation log location and sort files by date and time > you'll want to look at the first installation-log present and for ENS this will be the Common Installation log first.

  2. Open the first installation related log i.e. Common_Install.log and scroll to bottom, you will see the installation failure code i.e. “return code: 1603” (all MSI installation error codes are listed here, https://msdn.microsoft.com/en-us/library/windows/desktop/aa372835(v=vs.85).aspx)

  3. If you do see 1603, then scroll back up to the top of the log file and search for “value 3” (the word value may be different pending on log language). The first entry you find shows you point of failure.
    e.:
    !> Error - SysCore install failed: 255
    <= leave custom action Install_SysCore()
    CustomAction Install_SysCore returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
    Fin de la acción 12:28:11: InstallExecute. Return value 3.
    MSI (s) (98:70) [12:28:11:908]: Note: 1: 2265 2:  3: -2147287035 >> with these entries “Error - SysCore install failed: 255” and “-2147287035” you can search on the agent portal for errors

  4. It may also point you to look at another log file, in which case you can go to the mentioned log file and search for "error" or "fail". Again you can then search for these in agent portal.

 

We also have a KB which might help you: https://kc.mcafee.com/corporate/index?page=content&id=KB87589

Feel free to share a further extract from the log files!

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

Thank you so much for your instruction. Here is complete log on forder C:\%temp%\McAfeeLogs

https://drive.google.com/file/d/1DmEnjvpgxPYOfkoJQVBBd3_bfmGASugT/view?usp=sharing

McAfee Employee patrakshar
McAfee Employee
Report Inappropriate Content
Message 6 of 14

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

Hi,

Looking at the Logs you shared, there was an installation done on 22/8/2018. I am not seeing the complete uninstallation details of that installation instance. 

There is no 3rd party DLL hook.

There is no Custom install log as well for the installation that you tried on 22nd.

Only log that we have is mfemactl and MfeSysPrep

From mfemactl :

 

2018-11-07 15:27:11.860 mfemactl(14604.15332) mfemactl.Info: mfemactl.exe start...
2018-11-07 15:27:11.861 mfemactl(14604.15332) mfemactl.Info: Monitoring parent process: <C:\Windows\SysWOW64\msiexec.exe(11400)>
2018-11-07 15:27:11.865 mfemactl(14604.15332) mfemactl.Info: Successfully registered mfemactl with controlling parent
2018-11-07 15:27:11.867 mfemactl(14604.15332) mfemactl.Info: mfemactl.exe stopped
2018-11-07 15:27:11.961 mfemactl(12556.4360) mfemactl.Info: mfemactl.exe start...
2018-11-07 15:27:11.962 mfemactl(12556.4360) mfemactl.Info: Monitoring parent process: <C:\Windows\SysWOW64\msiexec.exe(11400)>
2018-11-07 15:27:11.966 mfemactl(12556.4360) mfemactl.Info: Successfully registered mfemactl with controlling parent
2018-11-07 15:27:11.989 mfemactl(12556.4360) mfemactl.Info: Successfully obtained AacControl interface, Aac version: SYSCORE.18.9.0.174
2018-11-07 15:27:11.998 mfemactl(12556.4360) mfemactl.Info: AacControl::EnableDisableGroup({C7080E42-1D78-4B64-8E32-6D9E032123FE}, ma.selfprotect, 0) returned status = <0>
2018-11-07 15:27:11.999 mfemactl(12556.4360) mfemactl.Info: mfemactl.exe stopped
2018-11-14 12:13:24.312 mfemactl(10532.856) mfemactl.Info: mfemactl.exe start...
2018-11-14 12:13:24.312 mfemactl(10532.856) mfemactl.Info: Monitoring parent process: <C:\Windows\SysWOW64\msiexec.exe(3264)>
2018-11-14 12:13:24.316 mfemactl(10532.856) mfemactl.Info: Successfully registered mfemactl with controlling parent
2018-11-14 12:13:24.317 mfemactl(10532.856) mfemactl.Info: mfemactl.exe stopped
2018-11-14 12:13:24.329 mfemactl(3136.8824) mfemactl.Info: mfemactl.exe start...
2018-11-14 12:13:24.329 mfemactl(3136.8824) mfemactl.Info: Monitoring parent process: <C:\Windows\SysWOW64\msiexec.exe(3264)>
2018-11-14 12:13:24.331 mfemactl(3136.8824) mfemactl.Info: Successfully registered mfemactl with controlling parent
2018-11-14 12:13:24.333 mfemactl(3136.8824) mfemactl.Warning: Failed obtaining AacControl interface, status = <0x80092003>
2018-11-14 12:13:24.333 mfemactl(3136.8824) mfemactl.Info: Unable to obtain AacControl interface for EnableDisableGroup() operation
2018-11-14 12:13:24.334 mfemactl(3136.8824) mfemactl.Info: mfemactl.exe stopped
2018-11-22 18:22:22.831 mfemactl(4416.4408) mfemactl.Info: mfemactl.exe start...
2018-11-22 18:22:22.831 mfemactl(4416.4408) mfemactl.Info: Monitoring parent process: <C:\Windows\SysWOW64\msiexec.exe(6168)>
2018-11-22 18:22:22.834 mfemactl(4416.4408) mfemactl.Info: Successfully registered mfemactl with controlling parent
2018-11-22 18:22:22.836 mfemactl(4416.4408) mfemactl.Info: mfemactl.exe stopped
2018-11-22 18:22:22.848 mfemactl(4520.5144) mfemactl.Info: mfemactl.exe start...
2018-11-22 18:22:22.848 mfemactl(4520.5144) mfemactl.Info: Monitoring parent process: <C:\Windows\SysWOW64\msiexec.exe(6168)>
2018-11-22 18:22:22.851 mfemactl(4520.5144) mfemactl.Info: Successfully registered mfemactl with controlling parent
2018-11-22 18:22:22.852 mfemactl(4520.5144) mfemactl.Warning: Failed obtaining AacControl interface, status = <0x80092003>
2018-11-22 18:22:22.852 mfemactl(4520.5144) mfemactl.Info: Unable to obtain AacControl interface for EnableDisableGroup() operation
2018-11-22 18:22:22.853 mfemactl(4520.5144) mfemactl.Info: mfemactl.exe stopped

 

Mostly there is some previous installation remnant present on the machine which includes the core services and currently when AAC is trying to install on top of that, the overwrite is not happening.

My suggession:

If issue on one machine only:

Download the Mcafee Endpoint Removal tool from Download site and Remove all the product from the machine.

Reboot the machine.

Trigger the ENS installation and check the status.

 

If Issue on Multiple machines:

Open a SR with the support team so that we can check on this further.

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

Thanks for your suggesstion. I tried to use MFE Removal Tool, event the third party - Your Uninstall to complete remove McAfee products and re-install McAfee Agent but it not work. I still cannot install McAfee products on that PCs.

I am looking for another solution.

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 8 of 14

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

It might be best to raise an SR with technical support so a proper investigation can be made. Please raise the service request via the portal and attach a MER of the client so we can assist you.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

Thank you for your help

I will try to another way to install McAfee products. If it still not work, I will raise the issue to your techinal support.

Thank you so much 

Re: Cannot Install McAfee Endpoint Security 10.6.1 on Client

Jump to solution

I am facing the same issue here. What was the fix?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator