HIPS Patch 11 Not Installing

[malcolmchalmers]

Hi All,

I'm having an issue where HIPS Patch 11 is not installing on some of our machines.

On a small percent it seems to work fine, most though fail with a 1603 or 1636 error.

I'm upgrading from HIPS 9 to HIPS 11

Windows 7 Enterprise

VirusScan Enterprise 9 is also installed, using Agent 5.0.5.658 (I think its 658)

[ktankink]

I would suggest opening a Service Request with McAfee Support so investigation of the install logs can be reviewed to determine the failure.

https://www.mcafee.com/enterprise/en-us/home/contact-us.html

[andrew_robinson]

I have a ton of these too. Just starting to look into why. Many W7 on P10. W10 worked OK.....

[Gatorspoli]

I had some issues going from P10 to P11 on a few systems. Sometimes restarting helped. On others I had to run an uninstall task, then did a full install of the new version.

[sauli]

I have the same problems too. Are you found the solution?

[Captainmark1]

By now I hope you all have the answer.

If not check here.

https://kb.mcafee.com/corporate/index?page=content&id=KB91008

Its in the Patch 12 known issues as found in Patch 11 but not listed in the Patch 11 known issues yet.

[andrew_robinson]

We are seeing 1603 errors when applying P12 to a P11 system. Maybe others. Turning off the HOST IPS element allows the install. Not sure this is the same thing.......

[ktankink]

---

@andrew_robinson wrote:

We are seeing 1603 errors when applying P12 to a P11 system. Maybe others. Turning off the HOST IPS element allows the install. Not sure this is the same thing.......

---

Hi @andrew_robinson.  It may not be the same.  If you're trying upgrade HIPS 8.0 locally (e.g., via non-ePO methods), then disabling the Host IPS module is required due to the Self-protection signatures (Sig 1000-1003); additionally, with HIPS 8.0 Patch 9+ there is a separate Self-protection feature (on its own tab in the HIPS ClientUI), that you would have to disable as well (if you have it enabled).  Both can still be disabled via the HIPS ClientControl.exe tool (included with the product).

Disabling HIPS self-protection functionality is a normal required action when patching/upgrading HIPS via non-ePO methods.  If you don't disable this functionality, it will generate the generic MSI 1603 error codes (which the true error would be "self-protection is still enabled").  

[Captainmark1]

1603 is a very generic error from the MSI installer. IE another install is in process could cause 1603.

Mcafee are working on the HIPs P11 and P12 update issue I expect they will repost when the issue is resolved.

My team have logged a ticket and spoke directly however remove and install is the best solution so far.

Not a happy solution for busy servers but not a big issue for workstations.