This article describes how to review the troubleshooting data collected for an ENS installation failure to identify the root cause of the failure:
- Collect the data needed from KB86691 and a Minimum Escalation Requirements (MER) file. Run the tool as Administrator.
- Review the Process Monitor data:
- Locate the point of failure:
- Apply the following filter:
Column Relation Value Action
Operation is Process Start Include
Operation is Process Create Include
Operation is Process Exit Include
- For the Process Exit operations, review the Details column for an Exit Status of 1603. 1603 is the standard error code meaning failure.
- Determine the process that exited with the 1603 status:
- SetupEP - means that the installation of ENS failed. Look to find an earlier instance of a 1603 Exit Status (in other words, one of the ENS modules failed).
- SetupCC - means that the installation of Common failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
- SetupTP - means that the installation of Threat Prevention failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
- SetupFW - means that the installation of Firewall failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
- SetupWC - means that the installation of Web Control failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
Example:
8:13:08.7017989 PM msiexec.exe 4988 2964 Process Exit 0.0000000 SUCCESS Exit Status: 1603
8:13:08.7278196 PM setupWC.exe 2548 5004 Process Exit 0.0000000 SUCCESS Exit Status: 1603
- Identify the MSI installation log file:
- Open (double-click) the event for the MSI instance that has the Exit Status of 1603.
- Click the Process tab and find the command-line entry.
Example:
msiexec.exe /i"C:\ProgramData\McAfee\Agent\Current\ENDP_WP_1010\Install\0000\McAfee_Web_Control_x64.msi" TRANSFORMS="C:\Windows\Temp\McAfeeTmpMSTPath\1033.mst" /qn /norestart BOOTSTRAPPERCALL=1 /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log" INSTALLDIR="C:\Program Files\McAfee\Endpoint Security\"msiexec.exe /i"C:\ProgramData\McAfee\Agent\Current\ENDP_WP_1010\Install\0000\McAfee_Web_Control_x64.msi" TRANSFORMS="C:\Windows\Temp\McAfeeTmpMSTPath\1033.mst" /qn /norestart BOOTSTRAPPERCALL=1 /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log" INSTALLDIR="C:\Program Files\McAfee\Endpoint Security\"
- Identify the MSI installation log file name from the command-line entry. Continuing from the above example, the log file name is: /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log".
- Review the MER data:
- Open the identified MSI installation log file from the MER data.
- Locate the point of failure in the MSI installation log file. Search the log for return value 3 if the log is in English.
NOTE: return value 3 is a localized string. If the log is in a different language, search for the equivalent text in that language.
- Identify the MSI action that failed (the action concluded with return value 3).
Example:
11:59:59:350 - >> Installing VSCORE: "C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\release\mfehidin.exe" -i ep_exploit_prevention -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_080116_115959.log" -etl "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_etl_080116_115959.etl" -mfetrust_off -x "C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\release\mfeepmpk.xml"
11:59:59:850 - !> Error - VSCORE install failed
- Identify the log file name to inspect from the command-line entry. Continuing from the above example, the log file name is: -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_080116_115959.log". In this example, it is a VSCore failure.
- Open the identified log file from the MER data.
- Search for Error to identify the root cause of the ENS installation failure.
