Problem Installing Threat Prevention Error 1603

[ph0t0g]

I have several systems that are getting a "Installation success or error status: 1603." error installing TP. Other modules install OK...

Agent is Version....................... 5.6.1.308
Tychon is Version...................... 1.7.520.10
Security Platform is Version........... 10.6.11910
Threat Prevention is Version...........
Adaptive Threat Protection is Version..
Web Control is Version................. 10.6.11910
HIPS is Version........................ 8.00.1300 8.00.1300
DLP is Version......................... 11.3.2.82
Policy Auditor is Version.............. 6.4.3
ACCM is Version........................ 3.2.5.1

All I can see from the logs is that there is a generic 1603 error meaning the installation failed. I could not find an Microsoft Installer log file.  A search on this community only returned one similar issue that was caused by "some type of DLL injection" and this KB article, that was not much help...

https://kc.mcafee.com/corporate/index?page=content&id=KB85033

This happens even if I use the ENS Removal tool to remove everything, and re-install.

McAfee log files are attached.

[Thussain]

Thank you for posting your question

I would suggest you to kindly run the sysprep tool on the client machine, restart the machine and then try installing Endpoint security. 

Please refer to the below link to download and use the sysprep tool

https://community.mcafee.com/t5/Endpoint-Security-ENS/Download-McAfee-SysPrep-Tool/td-p/632436

If the issue still persists, We request you to kindly share the McAfee logs folder from the C:\Windows\Temp directory

[ph0t0g]

Unfortunately, I do not have access to the SysPrep tool. Attached is the McAfeeLogs folder from C:\Windows\Temp.

Thanks.

[AdithyanT]

Hi @ph0t0g,

Thank you for the logs. I hope you have the issue resolved by contacting out Support with a Service Request. If not, here is what I found!

TP module has already been installed successfully on 17th November:

17/11/2019 04:01:16.764 [6492] [BootstrapperMain] Installing module
17/11/2019 04:04:29.386 [6492] [BootstrapperMain] installation needs a reboot. Return code : 3010
17/11/2019 04:04:29.417 [6492] [BootstrapperMain] Module installation succeeded
17/11/2019 04:04:29.417 [6492] [BootstrapperMain] A system restart is good to complete the installation, but not mandatory.

Looks like it had a pending reboot.

However, the consequent attempt to install on 21 Nov has failed. Wondering what happened between these dates...

21/11/2019 23:09:55.390 [9196] [BootstrapperMain] Installing module
21/11/2019 23:10:25.124 [9196] [BootstrapperMain] installation failed!! return code : 1603
21/11/2019 23:10:25.130 [9196] [BootstrapperMain] CheckIfPreviousProductRemoved: Start

Digging further into ENS threat Prevention install Logs we find this:

23:10:16:474 - Service could not be open. Service does not exist and will be created newly
23:10:16:475 - Error : Could not create the service. Last error : 1059

The failure is at creation of PPL Sevrice:

CustomAction CreateAndStartService_PPL_x64 returned actual error code 1603 but will be translated to success due to continue marking

The Custom action log also points to:

21/11/2019 23:10:15.458 [9060] [GenericCustomAction] Error : Could not create the service. Last error : 1059

Also I do find few injectors were not being tested successfully due to access denial for services, however, It might be safe to assume injectors were not present at this point.

Suggestion:

• Reboot the machine and please try the deployment one.
• Noticed presence of Active Client on the endpoint before our installation. Best to ensure that there are no remnants of that present on the machine.
• collect and investigate Process monitor logs while installation fails to dig in further and find out root cause. 

I would recommend involving a support case if none of the above helps.

I sincerely hope we are helpful!

*Note: Please do not share the entire Logs folder without sanitizing it on community as this would be publicly visible to anyone on the Internet.

[Thussain]

From the logs you have shared I see the below mentioned error

Property(S): ENSPDCREATEDSETTINGSFILENAME = ENSPD_TP_Config_Setting.xml
Property(S): ERROR_ATP_LEFT_DURING_UNINSTALL = Please uninstall McAfee Endpoint Security Adaptive Threat Protection before removing this product.
Property(S): ERROR_TIE_LEFT_DURING_UNINSTALL = Please uninstall McAfee Endpoint Security Threat Intelligence before removing this product.
Property(S): ErrorDialog = SetupError

Please confirm me if you are trying to perform a fresh install or upgrade

Did you try running the sysprep utility. 

You may also take a look at the below link for more details on how to troubleshoot installation issue 

https://community.mcafee.com/t5/ePolicy-Orchestrator/HOW-TO-TROUBLESHOOT-CLIENT-UPDATE-DEPLOYMENT-FA...

[Thussain]

Do you find a sysprep log in the McAfee logs folder, if yes, can you let me know what do you see in that file 

[ph0t0g]

I saw those errors too. I completely uninstalled  all the modules using the Endpoint Product Removal tool. So I don't understand how it could think that Adaptive Threat Protection is still installed.

McAfeeEndpointProductRemoval.exe --accepteula --ALL --noreboot

Then checked to make sure everything was gone, rebooted the PC, then ran a script I created to reinstall each module in the order listed above. All the modules installed except Threat Prevention and Adaptive Threat Protection. 

I don't even know what McAfee Endpoint Security Threat Intelligence is. As far as I can tell that is something that is used with VSE.

Thanks again.

[Thussain]

The best thing here would be to log a SR with the McAfee Technical support team and provide them with the MER logs, Process Monitor logs and AMTrace logs

Please follow the below mentioned KB article to enable debug logging for ENS

https://kc.mcafee.com/corporate/index?page=content&id=KB83026 

Please follow the steps mentioned in the KB article to generate the MER logs 

https://kc.mcafee.com/corporate/index?page=content&id=KB72895

Please follow the steps mentioned in the below KB article to generate a procmon logshttps://kc.mcafee.com/corporate/index?page=content&id=KB50981  

Please follow the steps in the below KB article to collect the AMtrace logs

https://kc.mcafee.com/corporate/index?page=content&id=KB86691

[patrakshar]

Hello @ph0t0g 

ATP not getting installed because TP is not present. Looking at the log seems like when AMcore component installation failing here.

Failed Driver Install. launchINFSection for C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\mfencbdc.inf

Are you seeing below location exist on the machine?

C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\

If yes, then can you reboot the machine and try the installation of TP component again?