cancel
Showing results for 
Search instead for 
Did you mean: 
ph0t0g
Level 8
Report Inappropriate Content
Message 1 of 9

Problem Installing Threat Prevention Error 1603

I have several systems that are getting a "Installation success or error status: 1603." error installing TP. Other modules install OK...

Agent is Version....................... 5.6.1.308
Tychon is Version...................... 1.7.520.10
Security Platform is Version........... 10.6.11910
Threat Prevention is Version...........
Adaptive Threat Protection is Version..
Web Control is Version................. 10.6.11910
HIPS is Version........................ 8.00.1300 8.00.1300
DLP is Version......................... 11.3.2.82
Policy Auditor is Version.............. 6.4.3
ACCM is Version........................ 3.2.5.1

All I can see from the logs is that there is a generic 1603 error meaning the installation failed. I could not find an Microsoft Installer log file.  A search on this community only returned one similar issue that was caused by "some type of DLL injection" and this KB article, that was not much help...

https://kc.mcafee.com/corporate/index?page=content&id=KB85033

This happens even if I use the ENS Removal tool to remove everything, and re-install.

McAfee log files are attached.

8 Replies
McAfee Employee Thussain
McAfee Employee
Report Inappropriate Content
Message 2 of 9

Re: Problem Installing Threat Prevention Error 1603

Thank you for posting your question

I would suggest you to kindly run the sysprep tool on the client machine, restart the machine and then try installing Endpoint security. 

Please refer to the below link to download and use the sysprep tool

https://community.mcafee.com/t5/Endpoint-Security-ENS/Download-McAfee-SysPrep-Tool/td-p/632436

If the issue still persists, We request you to kindly share the McAfee logs folder from the C:\Windows\Temp directory

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
ph0t0g
Level 8
Report Inappropriate Content
Message 3 of 9

Re: Problem Installing Threat Prevention Error 1603

Unfortunately, I do not have access to the SysPrep tool. Attached is the McAfeeLogs folder from C:\Windows\Temp.

Thanks.

 

McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 4 of 9

Re: Problem Installing Threat Prevention Error 1603

Hi @ph0t0g,

Thank you for the logs. I hope you have the issue resolved by contacting out Support with a Service Request. If not, here is what I found!

TP module has already been installed successfully on 17th November:

17/11/2019 04:01:16.764 [6492] [BootstrapperMain] Installing module
17/11/2019 04:04:29.386 [6492] [BootstrapperMain] installation needs a reboot. Return code : 3010
17/11/2019 04:04:29.417 [6492] [BootstrapperMain] Module installation succeeded
17/11/2019 04:04:29.417 [6492] [BootstrapperMain] A system restart is good to complete the installation, but not mandatory.

Looks like it had a pending reboot.

However, the consequent attempt to install on 21 Nov has failed. Wondering what happened between these dates...

21/11/2019 23:09:55.390 [9196] [BootstrapperMain] Installing module
21/11/2019 23:10:25.124 [9196] [BootstrapperMain] installation failed!! return code : 1603
21/11/2019 23:10:25.130 [9196] [BootstrapperMain] CheckIfPreviousProductRemoved: Start

Digging further into ENS threat Prevention install Logs we find this:

23:10:16:474 - Service could not be open. Service does not exist and will be created newly
23:10:16:475 - Error : Could not create the service. Last error : 1059

The failure is at creation of PPL Sevrice:

CustomAction CreateAndStartService_PPL_x64 returned actual error code 1603 but will be translated to success due to continue marking

The Custom action log also points to:

21/11/2019 23:10:15.458 [9060] [GenericCustomAction] Error : Could not create the service. Last error : 1059

Also I do find few injectors were not being tested successfully due to access denial for services, however, It might be safe to assume injectors were not present at this point.

Suggestion:

  • Reboot the machine and please try the deployment one.
  • Noticed presence of Active Client on the endpoint before our installation. Best to ensure that there are no remnants of that present on the machine.
  • collect and investigate Process monitor logs while installation fails to dig in further and find out root cause. 

I would recommend involving a support case if none of the above helps.

I sincerely hope we are helpful!

*Note: Please do not share the entire Logs folder without sanitizing it on community as this would be publicly visible to anyone on the Internet.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
McAfee Employee Thussain
McAfee Employee
Report Inappropriate Content
Message 5 of 9

Re: Problem Installing Threat Prevention Error 1603

From the logs you have shared I see the below mentioned error

Property(S): ENSPDCREATEDSETTINGSFILENAME = ENSPD_TP_Config_Setting.xml
Property(S): ERROR_ATP_LEFT_DURING_UNINSTALL = Please uninstall McAfee Endpoint Security Adaptive Threat Protection before removing this product.
Property(S): ERROR_TIE_LEFT_DURING_UNINSTALL = Please uninstall McAfee Endpoint Security Threat Intelligence before removing this product.
Property(S): ErrorDialog = SetupError

Please confirm me if you are trying to perform a fresh install or upgrade

Did you try running the sysprep utility. 

You may also take a look at the below link for more details on how to troubleshoot installation issue 

https://community.mcafee.com/t5/ePolicy-Orchestrator/HOW-TO-TROUBLESHOOT-CLIENT-UPDATE-DEPLOYMENT-FA...

 

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
McAfee Employee Thussain
McAfee Employee
Report Inappropriate Content
Message 6 of 9

Re: Problem Installing Threat Prevention Error 1603

Do you find a sysprep log in the McAfee logs folder, if yes, can you let me know what do you see in that file 

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
ph0t0g
Level 8
Report Inappropriate Content
Message 7 of 9

Re: Problem Installing Threat Prevention Error 1603

I saw those errors too. I completely uninstalled  all the modules using the Endpoint Product Removal tool. So I don't understand how it could think that Adaptive Threat Protection is still installed.

McAfeeEndpointProductRemoval.exe --accepteula --ALL --noreboot

Then checked to make sure everything was gone, rebooted the PC, then ran a script I created to reinstall each module in the order listed above. All the modules installed except Threat Prevention and Adaptive Threat Protection. 

I don't even know what McAfee Endpoint Security Threat Intelligence is. As far as I can tell that is something that is used with VSE.

Thanks again.

McAfee Employee Thussain
McAfee Employee
Report Inappropriate Content
Message 8 of 9

Re: Problem Installing Threat Prevention Error 1603

The best thing here would be to log a SR with the McAfee Technical support team and provide them with the MER logs, Process Monitor logs and AMTrace logs

Please follow the below mentioned KB article to enable debug logging for ENS

https://kc.mcafee.com/corporate/index?page=content&id=KB83026 

Please follow the steps mentioned in the KB article to generate the MER logs 

https://kc.mcafee.com/corporate/index?page=content&id=KB72895

Please follow the steps mentioned in the below KB article to generate a procmon logshttps://kc.mcafee.com/corporate/index?page=content&id=KB50981  

Please follow the steps in the below KB article to collect the AMtrace logs

https://kc.mcafee.com/corporate/index?page=content&id=KB86691

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
Highlighted
McAfee Employee patrakshar
McAfee Employee
Report Inappropriate Content
Message 9 of 9

Re: Problem Installing Threat Prevention Error 1603

Hello @ph0t0g 

ATP not getting installed because TP is not present. Looking at the log seems like when AMcore component installation failing here.

 

Failed Driver Install. launchINFSection for C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\mfencbdc.inf

Are you seeing below location exist on the machine?

C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\Install\
If yes, then can you reboot the machine and try the installation of TP component again?

 

Want to Ask a Question?
Many members like to perform a search first in case other customers have already asked and answered a similar question. However, to ask a question, first select a forum then click on Post a Topic. You must sign in or log in with your existing credentials.

McAfee Service Portal customers please use your existing username and password to log into the community.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community