I have several systems that are getting a "Installation success or error status: 1603." error installing TP. Other modules install OK...
Agent is Version....................... 5.6.1.308
Tychon is Version...................... 1.7.520.10
Security Platform is Version........... 10.6.11910
Threat Prevention is Version...........
Adaptive Threat Protection is Version..
Web Control is Version................. 10.6.11910
HIPS is Version........................ 8.00.1300 8.00.1300
DLP is Version......................... 11.3.2.82
Policy Auditor is Version.............. 6.4.3
ACCM is Version........................ 3.2.5.1
All I can see from the logs is that there is a generic 1603 error meaning the installation failed. I could not find an Microsoft Installer log file. A search on this community only returned one similar issue that was caused by "some type of DLL injection" and this KB article, that was not much help...
https://kc.mcafee.com/corporate/index?page=content&id=KB85033
This happens even if I use the ENS Removal tool to remove everything, and re-install.
McAfee log files are attached.
Thank you for posting your question
I would suggest you to kindly run the sysprep tool on the client machine, restart the machine and then try installing Endpoint security.
Please refer to the below link to download and use the sysprep tool
https://community.mcafee.com/t5/Endpoint-Security-ENS/Download-McAfee-SysPrep-Tool/td-p/632436
If the issue still persists, We request you to kindly share the McAfee logs folder from the C:\Windows\Temp directory
Unfortunately, I do not have access to the SysPrep tool. Attached is the McAfeeLogs folder from C:\Windows\Temp.
Thanks.
Hi @ph0t0g,
Thank you for the logs. I hope you have the issue resolved by contacting out Support with a Service Request. If not, here is what I found!
TP module has already been installed successfully on 17th November:
17/11/2019 04:01:16.764 [6492] [BootstrapperMain] Installing module
17/11/2019 04:04:29.386 [6492] [BootstrapperMain] installation needs a reboot. Return code : 3010
17/11/2019 04:04:29.417 [6492] [BootstrapperMain] Module installation succeeded
17/11/2019 04:04:29.417 [6492] [BootstrapperMain] A system restart is good to complete the installation, but not mandatory.
Looks like it had a pending reboot.
However, the consequent attempt to install on 21 Nov has failed. Wondering what happened between these dates...
21/11/2019 23:09:55.390 [9196] [BootstrapperMain] Installing module
21/11/2019 23:10:25.124 [9196] [BootstrapperMain] installation failed!! return code : 1603
21/11/2019 23:10:25.130 [9196] [BootstrapperMain] CheckIfPreviousProductRemoved: Start
Digging further into ENS threat Prevention install Logs we find this:
23:10:16:474 - Service could not be open. Service does not exist and will be created newly
23:10:16:475 - Error : Could not create the service. Last error : 1059
The failure is at creation of PPL Sevrice:
CustomAction CreateAndStartService_PPL_x64 returned actual error code 1603 but will be translated to success due to continue marking
The Custom action log also points to:
21/11/2019 23:10:15.458 [9060] [GenericCustomAction] Error : Could not create the service. Last error : 1059
Also I do find few injectors were not being tested successfully due to access denial for services, however, It might be safe to assume injectors were not present at this point.
Suggestion:
I would recommend involving a support case if none of the above helps.
I sincerely hope we are helpful!
*Note: Please do not share the entire Logs folder without sanitizing it on community as this would be publicly visible to anyone on the Internet.
From the logs you have shared I see the below mentioned error
Property(S): ENSPDCREATEDSETTINGSFILENAME = ENSPD_TP_Config_Setting.xml
Property(S): ERROR_ATP_LEFT_DURING_UNINSTALL = Please uninstall McAfee Endpoint Security Adaptive Threat Protection before removing this product.
Property(S): ERROR_TIE_LEFT_DURING_UNINSTALL = Please uninstall McAfee Endpoint Security Threat Intelligence before removing this product.
Property(S): ErrorDialog = SetupError
Please confirm me if you are trying to perform a fresh install or upgrade
Did you try running the sysprep utility.
You may also take a look at the below link for more details on how to troubleshoot installation issue
Do you find a sysprep log in the McAfee logs folder, if yes, can you let me know what do you see in that file
I saw those errors too. I completely uninstalled all the modules using the Endpoint Product Removal tool. So I don't understand how it could think that Adaptive Threat Protection is still installed.
McAfeeEndpointProductRemoval.exe --accepteula --ALL --noreboot
Then checked to make sure everything was gone, rebooted the PC, then ran a script I created to reinstall each module in the order listed above. All the modules installed except Threat Prevention and Adaptive Threat Protection.
I don't even know what McAfee Endpoint Security Threat Intelligence is. As far as I can tell that is something that is used with VSE.
Thanks again.
The best thing here would be to log a SR with the McAfee Technical support team and provide them with the MER logs, Process Monitor logs and AMTrace logs
Please follow the below mentioned KB article to enable debug logging for ENS
https://kc.mcafee.com/corporate/index?page=content&id=KB83026
Please follow the steps mentioned in the KB article to generate the MER logs
https://kc.mcafee.com/corporate/index?page=content&id=KB72895
Please follow the steps mentioned in the below KB article to generate a procmon logshttps://kc.mcafee.com/corporate/index?page=content&id=KB50981
Please follow the steps in the below KB article to collect the AMtrace logs
https://kc.mcafee.com/corporate/index?page=content&id=KB86691
Hello @ph0t0g
ATP not getting installed because TP is not present. Looking at the log seems like when AMcore component installation failing here.
Failed Driver Install. launchINFSection for C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\mfencbdc.inf
Are you seeing below location exist on the machine?
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA