cancel
Showing results for 
Search instead for 
Did you mean: 
c8822131
Level 7

HIPS 8 x64 installation failure.

Hi all,

We have approx 10 - 15 endpoints that for some reason are not taking the HIPS 8 deployment via ePO 4.6

From an MA perspective the following is observed:

10 April 2014 14:47:21

Info

Scheduler

Scheduler: Invoking task [Deploy: HIPS 8.0.0 - Immediate (Workstations)]...

10 April 2014 14:47:21

Info

Updater

Checking update packages from repository ePOSA_WBV-EPO-P0001.

10 April 2014 14:47:21

Info

Updater

Initializing update...

10 April 2014 14:47:21

Info

Updater

Verifying catalog.z.

10 April 2014 14:47:21

Info

Updater

Extracting catalog.z.

10 April 2014 14:47:21

Info

Updater

Loading update configuration from: catalog.xml

10 April 2014 14:47:22

Info

Updater

Verifying HIP_ClientDetect.mcs.

10 April 2014 14:47:22

Info

Updater

Downloading PkgCatalog.z.

10 April 2014 14:47:22

Info

Updater

Verifying PkgCatalog.z.

10 April 2014 14:47:22

Info

Updater

Extracting PkgCatalog.z.

10 April 2014 14:47:22

Info

Updater

Loading update configuration from: PkgCatalog.xml

10 April 2014 14:47:23

Info

Updater

Installing HOSTIPS_8000.

10 April 2014 14:47:23

Info

Updater

Verifying HIP_ClientInstall.mcs.

10 April 2014 14:47:23

Info

Updater

Verifying McAfeeHIP_ClientSetup.exe.

10 April 2014 14:47:23

Info

Updater

Verifying McAfeeHIP_ClientSetup_X64.msi.

10 April 2014 14:47:23

Info

Updater

Verifying 0x0409.ini.

10 April 2014 14:47:23

Info

Updater

Verifying HOSTIPS.cab.

10 April 2014 14:47:23

Info

Updater

Verifying X64.cab.

10 April 2014 14:47:23

Info

Updater

Verifying Setup64.ini.

10 April 2014 14:47:23

Info

Updater

Verifying WindowsInstaller-KB893803-x86.exe.

10 April 2014 14:47:23

Info

Updater

Verifying setup_util_x64.exe.

10 April 2014 14:47:23

Info

Updater

Verifying vcredist_x86.exe.

10 April 2014 14:47:23

Info

Updater

Verifying vcredist_x64.exe.

After the "Veifying vcredist_64.exe" entry, the process appears to hang with MA logs reverting to BAU activity checking for policy updates etc.

The HIPS 8 install log shows the following:

Property(S): PackageCode = {2E136503-9709-4987-9E41-CB0F49D3FFB8}

MSI (s) (50:EC) [14:55:06:884]: Note: 1: 1708

MSI (s) (50:EC) [14:55:06:884]: Product: McAfee Host Intrusion Prevention -- Installation operation failed.

MSI (s) (50:EC) [14:55:06:884]: Windows Installer installed the product. Product Name: McAfee Host Intrusion Prevention. Product Version: 8.00.0202. Product Language: 1033. Manufacturer: McAfee, Inc.. Installation success or error status: 1603.

MSI (s) (50:EC) [14:55:06:884]: Deferring clean up of packages/files, if any exist

MSI (s) (50:EC) [14:55:06:884]: MainEngineThread is returning 1603

MSI (s) (50:70) [14:55:06:884]: No System Restore sequence number for this installation.

=== Logging stopped: 4/10/2014  14:55:06 ===

MSI (s) (50:70) [14:55:06:884]: User policy value 'DisableRollback' is 0

MSI (s) (50:70) [14:55:06:884]: Machine policy value 'DisableRollback' is 0

MSI (s) (50:70) [14:55:06:884]: Incrementing counter to disable shutdown. Counter after increment: 0

MSI (s) (50:70) [14:55:06:884]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2

MSI (s) (50:70) [14:55:06:884]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2

MSI (s) (50:70) [14:55:06:884]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1

MSI (s) (50:70) [14:55:06:884]: Restoring environment variables

MSI (s) (50:70) [14:55:06:884]: Destroying RemoteAPI object.

MSI (s) (50:E0) [14:55:06:884]: Custom Action Manager thread ending.

MSI (c) (74:E4) [14:55:06:884]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1

MSI (c) (74:E4) [14:55:06:884]: MainEngineThread is returning 1603

=== Verbose logging stopped: 4/10/2014  14:55:06 ===

I'm assuming the 1603 error is an MSIEXEC error not specific to HIPS 8.

Unistalls are completed with no issues but attempted reinstalls are constsntly failing on the identified machines.

Any guidance on resolving this issue will be appreciated.

8 Replies
fuzziest
Level 9

Re: HIPS 8 x64 installation failure.

I have the same issue on one of my installations. Did you come up with any solutions yet?

Re: HIPS 8 x64 installation failure.

Hi there,

I have seen issues like this in the past and it is because there are reminds in the Machine.

The best option and the one that I have seen to work is to request a McAfee suport a HIPS removal tool and then try to install again after the removal has been run.

Best regards,

Jose Maria

0 Kudos
davidp64
Level 10

Re: HIPS 8 x64 installation failure.

Hi llaman,

can you provide me hips removal tool..

Thanks

0 Kudos
ansarias
Level 13

Re: HIPS 8 x64 installation failure.

Tool called ripper which can be provide by gold and platinum support

0 Kudos
ansarias
Level 13

Re: HIPS 8 x64 installation failure.

Hello,

Try to first disable IPS from ePO policy on those systems than run the deployment task and see if it fixes the issue.

0 Kudos
Troja
Level 14

Re: HIPS 8 x64 installation failure.

Hi,

figured out the same problem.

- No installation possible if there was Patch 5 for VSE or HIPS was installed.

- Upgrading with Patch 6 does not work

- Not able to deploy HIPS on Windows 10 Systems.

Tested with EPO 5.1.1, 5.1.2, 5.3.1, 5.3.1 and Agent 5.0.1 and 5.0.2.

Nothing helps. On some Systems HIPS coud be installed, but then the product is not visible in the Tray icon and it is NOT working....

Will be interested if there will be a solution available.

Cheers

0 Kudos
McAfee Employee

Re: HIPS 8 x64 installation failure.

Please open a support ticket with Intel Security Support.  The details you provided are not showing the actual install failure.  It is not actually hanging at "Verifying vcredist_x64.exe"; that's just where the Agent stops logging while the HIPS install is performed.  The failure will be in the HIPS 8 install log file; usually somewhere above the lines that start with "Property".

0 Kudos
rolydee
Level 7

Re: HIPS 8 x64 installation failure.

I had a very similar issue on some Windows 7 computers, and our users were prompted to reboot after each failed attempt to install HIP (which I eventually told them to ignore ).

The HIP install logs are really verbose, so I got assistance from McAfee Support who identified the issue as KB77740 - Deployment of Host Intrusion Prevention 8.x fails on some systems running Windows 7 (https://kc.mcafee.com/corporate/index?page=content&id=KB77740). This relates to a Windows setting which limits the number of "network filter drivers" and the value is stored under [HKLM\SYSTEM\CurrentControlSet\Control\Network]

0 Kudos