Knowledge Center

This article describes how to review the troubleshooting data collected for an ENS installation failure to identify the root cause of the failure:

1. Collect the data required from KB86691 and a Minimum Escalation Requirements (MER) file (run as Administrator).
2. Review the Process Monitor data:
   1. Locate the point of failure:
      1. Apply the following filter:
          
         Column                  Relation          Value                            Action
         Operation              is                     Process Start               Include
         Operation              is                     Process Create            Include
         Operation              is                     Process Exit                 Include
          
      2. For the Process Exit operations, review the Details column for an Exit Status of 1603. 1603 is the standard error code meaning failure.
      3. Determine the process that exited with the 1603 status:
         • SetupEP - means the installation of ENS failed. Look to find an earlier instance of a 1603 Exit Status (in other words, one of the ENS modules failed).
         • SetupCC - means the installation of Common failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
         • SetupTP - means the installation of Threat Prevention failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
         • SetupFW - means the installation of Firewall failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
         • SetupWC - means the installation of Web Control failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
          
         Example:
          
         8:13:08.7017989 PM    msiexec.exe    4988    2964    Process Exit        0.0000000    SUCCESS    Exit Status: 1603
         8:13:08.7278196 PM    setupWC.exe    2548    5004    Process Exit        0.0000000    SUCCESS    Exit Status: 1603
          
   2. Identify the MSI installation log file:
      1. Open (double-click) the event for the MSI instance that has the Exit Status of 1603.
      2. Click the Process tab and find the command-line entry.
          
         Example:
          
         msiexec.exe /i"C:\ProgramData\McAfee\Agent\Current\ENDP_WP_1010\Install\0000\McAfee_Web_Control_x64.msi" TRANSFORMS="C:\Windows\Temp\McAfeeTmpMSTPath\1033.mst" /qn /norestart BOOTSTRAPPERCALL=1 /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log" INSTALLDIR="C:\Program Files\McAfee\Endpoint Security\"msiexec.exe /i"C:\ProgramData\McAfee\Agent\Current\ENDP_WP_1010\Install\0000\McAfee_Web_Control_x64.msi" TRANSFORMS="C:\Windows\Temp\McAfeeTmpMSTPath\1033.mst"  /qn /norestart BOOTSTRAPPERCALL=1 /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log" INSTALLDIR="C:\Program Files\McAfee\Endpoint Security\"
          
      3. Identify the MSI installation log file name from the command-line entry. Continuing from the above example, the log file name is: /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log".
          
3. Review the MER data:
   1. Open the identified MSI installation log file from the MER data.
   2. Locate the point of failure in the MSI installation log file. Search the log for return value 3 if the log is in English.
       
      NOTE: return value 3 is a localized string. If the log is in a different language, search for the equivalent text in that language.
       
   3. Identify the MSI action that failed (the action concluded with return value 3).
       
      Example:
       
      11:59:59:350 - >> Installing VSCORE: "C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\release\mfehidin.exe" -i ep_exploit_prevention -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_080116_115959.log" -etl "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_etl_080116_115959.etl" -mfetrust_off -x "C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\release\mfeepmpk.xml"
      11:59:59:850 - !> Error - VSCORE install failed
       
   4. Identify the log file name to inspect from the command-line entry. Continuing from the above example, the log file name is: -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_080116_115959.log". In this example, it is a VSCore failure.
   5. Open the identified log file from the MER data.
   6. Search for Error to identify the root cause of the ENS installation failure.