Loading...

Knowledge Center


How to troubleshoot an Endpoint Security installation failure
Technical Articles ID:   KB87589
Last Modified:  7/19/2018

Environment

McAfee Endpoint Security (ENS) Firewall 10.x
McAfee ENS Platform 10.x
McAfee ENS Threat Prevention 10.x
McAfee ENS Web Control 10.x

Summary

This article describes how to review the troubleshooting data collected for an ENS installation failure to identify the root cause of the failure:
  1. Collect the data required from KB86691 and a Minimum Escalation Requirements (MER) file (run as Administrator).
  2. Review the Process Monitor data:
    1. Locate the point of failure:
      1. Apply the following filter:
         
        Column                  Relation          Value                            Action
        Operation              is                     Process Start               Include
        Operation              is                     Process Create            Include
        Operation              is                     Process Exit                 Include
         
      2. For the Process Exit operations, review the Details column for an Exit Status of 1603. 1603 is the standard error code meaning failure.
      3. Determine the process that exited with the 1603 status:
        • SetupEP - means the installation of ENS failed. Look to find an earlier instance of a 1603 Exit Status (in other words, one of the ENS modules failed).
        • SetupCC - means the installation of Common failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
        • SetupTP - means the installation of Threat Prevention failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
        • SetupFW - means the installation of Firewall failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
        • SetupWC - means the installation of Web Control failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
         
        Example:
         
        8:13:08.7017989 PM    msiexec.exe    4988    2964    Process Exit        0.0000000    SUCCESS    Exit Status: 1603
        8:13:08.7278196 PM    setupWC.exe    2548    5004    Process Exit        0.0000000    SUCCESS    Exit Status: 1603
         
    2. Identify the MSI installation log file:
      1. Open (double-click) the event for the MSI instance that has the Exit Status of 1603.
      2. Click the Process tab and find the command-line entry.
         
        Example:
         
        msiexec.exe /i"C:\ProgramData\McAfee\Agent\Current\ENDP_WP_1010\Install\0000\McAfee_Web_Control_x64.msi" TRANSFORMS="C:\Windows\Temp\McAfeeTmpMSTPath\1033.mst" /qn /norestart BOOTSTRAPPERCALL=1 /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log" INSTALLDIR="C:\Program Files\McAfee\Endpoint Security\"msiexec.exe /i"C:\ProgramData\McAfee\Agent\Current\ENDP_WP_1010\Install\0000\McAfee_Web_Control_x64.msi" TRANSFORMS="C:\Windows\Temp\McAfeeTmpMSTPath\1033.mst"  /qn /norestart BOOTSTRAPPERCALL=1 /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log" INSTALLDIR="C:\Program Files\McAfee\Endpoint Security\"
         
      3. Identify the MSI installation log file name from the command-line entry. Continuing from the above example, the log file name is: /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log".
         
  3. Review the MER data:
    1. Open the identified MSI installation log file from the MER data.
    2. Locate the point of failure in the MSI installation log file. Search the log for return value 3 if the log is in English.
       
      NOTE: return value 3 is a localized string. If the log is in a different language, search for the equivalent text in that language.
       
    3. Identify the MSI action that failed (the action concluded with return value 3).
       
      Example:
       
      11:59:59:350 - >> Installing VSCORE: "C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\release\mfehidin.exe" -i ep_exploit_prevention -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_080116_115959.log" -etl "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_etl_080116_115959.etl" -mfetrust_off -x "C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\release\mfeepmpk.xml"
      11:59:59:850 - !> Error - VSCORE install failed
       
    4. Identify the log file name to inspect from the command-line entry. Continuing from the above example, the log file name is: -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_080116_115959.log". In this example, it is a VSCore failure.
    5. Open the identified log file from the MER data.
    6. Search for Error to identify the root cause of the ENS installation failure.

Rate this document

Languages:

This article is available in the following languages:

English United States
Japanese

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.