McAfee Agent installation rolls back with 1603

[vnaidu]

Dear @AdithyanT @cdinet @Hawkmoon @chealey and All,

We are trying to install McAfee Agent 5.6.5 on a client machine. The installation rolls back and says Fatal Error. while checking the logs it says 1603. The machine does not have ENS or Agent. Verified all the folders to find nothing related to McAfee. We also tried to check the uninstall strings and find nothing.

Kindly suggest.

MSI (s) (F0:D8) [18:48:51:387]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIB33D.tmp, Entrypoint: stopOtherAgentProcesses CustAct [18:48:51:696] main [I] stopOtherAgentProcesses START CustAct [18:48:51:700] main [I] Wait for previous install's cleanup to complete, if running CustAct [18:48:51:701] main [I] Cleanup wait completed CustAct [18:48:51:704] main [I] Failed to disable lockdown on service CustAct [18:48:51:706] main [I] Trying to change the configuration of service masvc 0 CustAct [18:48:51:712] main [E] Error trace: CustAct [18:48:51:714] main [E]  [stopOtherAgentProcesses START]-> CustAct [18:48:51:716] main [E]   OpenService failed 122 CustAct [18:48:51:720] main [I] Failed to disable lockdown on service CustAct [18:48:51:722] main [I] Trying to change the configuration of service macmnsvc 0 CustAct [18:48:51:728] main [E] Error trace: CustAct [18:48:51:731] main [E]  [stopOtherAgentProcesses START]-> CustAct [18:48:51:732] main [E]   OpenService failed 122 CustAct [18:48:51:735] main [I] Failed to disable lockdown on service CustAct [18:48:51:736] main [I] Trying to change the configuration of service McAfeeFramework 0 CustAct [18:48:51:739] main [E] Error trace: CustAct [18:48:51:739] main [E]  [stopOtherAgentProcesses START]-> CustAct [18:48:51:740] main [E]   OpenService failed 122 CustAct [18:48:51:744] main [I] Failed to disable lockdown on service CustAct [18:48:51:746] main [I] Failed to disable lockdown on service CustAct [18:48:51:748] main [I] Failed to disable lockdown on service

CustAct [18:49:13:8] main [I] ***********CopyMsiFile****************. CustAct [18:49:13:920] main [I]  szProductCode= {​​​​​​​4C3A8CA3-B83A-477C-AAB3-AABE42E62DD2}​​​​​​​ CustAct [18:49:13:922] main [I]  MsiGetProductInfoW failed, error=1605 CustAct [18:49:13:984] Filer [I] Copied file C:\WINDOWS\Installer\9fbaa.msi to C:\ProgramData\McAfee\Agent\MFEagent_x64.msi

MSI (s) (F0:40) [18:53:28:919]: Product: McAfee Agent -- Installation operation failed. MSI (s) (F0:40) [18:53:28:920]: Windows Installer installed the product. Product Name: McAfee Agent. Product Version: 5.06.0503. Product Language: 1033. Manufacturer: McAfee, Inc.. Installation success or error status: 1603.

Also 

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\macmnsvc does not have any keys to delete.

[rackroyd]

Hi,

I'd suggest you open a support case so that it can be checked in more detail and a clean-up of the machine can be made if needed - it sounds possibly like some remnants of prior installation attempts may be causing concern.

Hth.

[vnaidu]

@rackroyd @Hawkmoon @AjaySundar 

4-21700860341

[cdinet]

It is failing to set file permissions here:

MSI (s) (40:74) [17:18:47:228]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIA0.tmp, Entrypoint: setFilePermissions
CustAct [17:18:47:246] main [I] setFilePermissions START
CustAct [17:18:48:353] Acl [E] Error trace:
CustAct [17:18:48:355] main [E] [setFilePermissions START]->
CustAct [17:18:48:356] Acl [E] [SetNamedSecurityInfo,C:\ProgramData\McAfee\Agent\Current\AMCORDAT2000\DAT\0000\content-00000001-000935-amcontent.dat,1,536870916,1]->
CustAct [17:18:48:357] Acl [E] error 123: The filename, directory name, or volume label syntax is incorrect.
CustAct [17:18:48:358] main [I] setFilePermissions END
CustomAction SetFilePermissions returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (40:74) [17:18:48:401]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (40:74) [17:18:48:403]: User policy value 'DisableRollback' is 0
MSI (s) (40:74) [17:18:48:403]: Machine policy value 'DisableRollback' is 0
Action ended 17:18:48: InstallFinalize. Return value 3.

It looks like it is being blocked by ENS self protection.

2021-02-09 10:08:29.367Z|Activity|ApBl |mfeesp | 2288| 8492|SP |XModuleEvents.cpp(844) | NT AUTHORITY\SYSTEM ran C:\Windows\System32\msiexec.exe, which tried to access C:\ProgramData\McAfee\, violating the rule "Adaptive Threat Protection - Protect core McAfee files and folders", and was blocked. For information about how to respond to this event, see KB85494.
2021-02-09 10:19:10.629Z|Activity|ApBl |mfeesp | 2288| 8492|SP |XModuleEvents.cpp(844) | AMERICAS\$$$$$$$ ran C:\Program Files\internet explorer\iexplore.exe, which tried to access HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}\, violating the rule "Threat Prevention - Protect McAfee core registry keys and values", and was blocked. For information about how to respond to this event, see KB85494.
2021-02-09 10:21:34.966Z|Activity|ApBl |mfeesp | 6992| 35032|SP |ApState.cpp(287) | Errors occurred during rule processing. Check the error log for details.
2021-02-09 10:21:35.047Z|Activity|ApBl |mfeesp | 6992| 35032|SP |ApState.cpp(287) | Errors occurred during rule processing. Check the error log for details.

[vnaidu]

@cdinet please help me with a solution then

[cdinet]

If ENS self protection is blocking and no agent to get policy changes, open up ens console and go to settings, common, show advanced and uncheck enable self protection.  Then try to install the agent.

[vnaidu]

@cdinet I have removed ENS and VSE for some reason. So there is no VSE or ENS or Agent while we tried installing Agent, they have been already removed. But this Agent is rolling back now.

[ChrisQ]

Very occasionally, I find you need to manually clear the registry of McAfee and Network Associates keys to make sure everything is completely removed.

Check for the following folders and delete them (after making a back up):

HKEY_LOCAL_MACHINE\SOFTWARE\McAfee
HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\McAfee
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Network Associates

Then retry the agent install.

If it still fails it must be something else (another anti-virus product possibly? )  or a broken installer as there won't be anything McAfee related left on the system to prevent the install.

[cdinet]

That is very true, otherwise you need to look at the agent msi log to see what failed specifically.