Upgrading ePO 4.5 P1 to ePO 4.5 P3 'cant install parser service'

[pierce]

Hi All,

I am trying to upgrade our ePO 4.5 Patch 1 boxto the latest available release which is 4.5 P3.

.

Running through the install it produces the follow error message

Error reads: Error 1923: Service McAfeeePolicy Orchestrator 4.5.0 Event Parser (MCAFEEEVENTPARSERSRV) could not beinstalled. Verify that you have sufficient privileges to install systemservices.

I have local admin rights to this box and I amconnecting remotely, I did see another discussion indicating you should connectdirectly to the box but this is not an option as its on VMware.

Raised a ticket with McAfee and they advisedthis was due to our SQL password having an invalid character (an '@' symbol).Made all the changes (including on this pesky link that took some work to find: https://localhost:8443/core/config) and re-ran installwhich produced exact same error message.

Also we have all 3 key McAfee processesrunning under an active directory account that has been permissioned to the SQLserver etc...

Any advice would be greatly appreciated.

thanks,

Pierce

[tonyb99]

What were the errors in the EPO450-Install-MSI.LOG file?

I havn't had this error on patches before myself, only when doing an actual full version upgrade where you get this on the removal of the other version sometimes.

[pierce]

The errors from the logs are:

MSI (s) (0C:94) [12:11:55:803]: NOTE: custom action Prod_ReplaceTokenInProperties unexpectedly closed the hInstall handle (type MSIHANDLE) provided to it. The custom action should be fixed to not close that handle.

MSI (s) (0C:20) [12:11:55:834]: Executing op: ActionStart(Name=InstallServices,Description=Installing new services,Template=Service: [2])

InstallShield 12:11:55: CallScriptFunctionFromMsiCA() ends

MSI (s) (0C:20) [12:11:55:850]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)

MSI (s) (0C:20) [12:11:55:850]: Executing op: ServiceInstall(Name=MCAFEEEVENTPARSERSRV,DisplayName=McAfee ePolicy Orchestrator 4.5.0 Event Parser,ImagePath="C:\Program Files\McAfee\ePolicy Orchestrator\EventParser.exe",ServiceType=272,StartType=2,ErrorControl=1,,,,,Password=**********,Description=McAfee ePolicy Orchestrator 4.5.0 Event Parser service.)

MSI (s) (0C:20) [12:12:08:006]: Product: McAfee ePolicy Orchestrator -- Error 1923.Service McAfee ePolicy Orchestrator 4.5.0 Event Parser (MCAFEEEVENTPARSERSRV) could not be installed.  Verify that you have sufficient privileges to install system services.

Error 1923.Service McAfee ePolicy Orchestrator 4.5.0 Event Parser (MCAFEEEVENTPARSERSRV) could not be installed.  Verify that you have sufficient privileges to install system services.

MSI (s) (0C:20) [12:13:56:738]: Product: McAfee ePolicy Orchestrator -- Error 1923.Service McAfee ePolicy Orchestrator 4.5.0 Event Parser (MCAFEEEVENTPARSERSRV) could not be installed.  Verify that you have sufficient privileges to install system services.

Error 1923.Service McAfee ePolicy Orchestrator 4.5.0 Event Parser (MCAFEEEVENTPARSERSRV) could not be installed.  Verify that you have sufficient privileges to install system services.

Also after i restored the server (the roll back just caused more issues). I upgraded DLP from 3 to 9.1 and as part of this I had to upgrade the service running for that, so this to me would rule out any permissions issue.

thanks,

Pierce

[alexander_h · Accepted solution]

Hi before the installation procces you should disable all automated task and to disconect all agent handlers.

I just found this article which could help you

https://kc.mcafee.com/corporate/index?page=content&id=KB69686&cat=CORP_PRODUCTS&actp=LIST

[pierce]

Hi alexandar_h,

thanks i did disabled all automated tasks before starting.

On the agent handler screen I only have the ePO server listed as a handler so dont think this is necessary

Your link looks promising, could you check and see how your ePO services are setup for comparisions sake?

McAfee ePolicy Orchestrator 4.5.0 Application Server

McAfee ePolicy Orchestrator 4.5.0 Event Parser

McAfee ePolicy Orchestrator 4.5.0 Server

Are all running under a domain account on my box, would be interested to see if we have just setup this sever incorrectly.

many thanks,

Pierce

[tonyb99]

I have only ever once had to use a service account versus the normal system accounts (and that was with a bodged version of epo 4) all the other times including now I use the local system account

[rackroyd]

The ePO services would normally all be using the system account, so yes KB69686 looks quite promising.

Try resetting the service accounts to system and re-run the upgrade.

Rgds,

Rob.

[alexander_h]

As i can see from that KB it sounds like well known issue, for all error messages first i use google then kc.mcafee.com , this two sources are reloving more of the problems we have

[pierce]

Hi Rackroyd and tonyb99,

Just to confirm (and sorry for the newbie questions here). If i change those 3 services to run under the local account this wont affect the SQL access as thats all handled from the details on the https://localhost:8443/core/config page?

Thanks,

Pierce

[rackroyd]

Yep