Troubleshoot an Endpoint Security installation failure

Technical Articles ID: KB87589
Last Modified: 3/19/2021

Environment

McAfee Endpoint Security (ENS) Firewall 10.x
McAfee ENS Platform 10.x
McAfee ENS Threat Prevention 10.x
McAfee ENS Web Control 10.x

Summary

This article describes how to review the troubleshooting data collected for an ENS installation failure to identify the root cause of the failure:

Collect the data needed from KB86691 - Minimum data collection steps for Endpoint Security issues and a Minimum Escalation Requirements (MER) file. Run the tool as Administrator.
Review the Process Monitor data:
1. Locate the point of failure:
  1. Apply the following filter:
    
    Column                  Relation          Value                            Action
    Operation            is                    Process Start               Include
    Operation            is                    Process Create            Include
    Operation            is                    Process Exit                 Include
  2. For the Process Exit operations, review the Details column for an Exit Status of 1603. 1603 is the standard error code meaning failure.
  3. Determine the process that exited with the 1603 status:
    - SetupEP - means that the installation of ENS failed. Look to find an earlier instance of a 1603 Exit Status (in other words, one of the ENS modules failed).
    - SetupCC - means that the installation of Common failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
    - SetupTP - means that the installation of Threat Prevention failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
    - SetupFW - means that the installation of Firewall failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
    - SetupWC - means that the installation of Web Control failed. Look to find an earlier instance of a 1603 Exit Status from an MSI process.
    Example:
    
    8:13:08.7017989 PM msiexec.exe 4988 2964 Process Exit 0.0000000 SUCCESS Exit Status: 1603
    8:13:08.7278196 PM setupWC.exe 2548 5004 Process Exit 0.0000000 SUCCESS Exit Status: 1603
2. Identify the MSI installation log file:
  1. Open (double-click) the event for the MSI instance that has the Exit Status of 1603.
  2. Click the Process tab and find the command-line entry.
    
    Example:
    
    msiexec.exe /i"C:\ProgramData\McAfee\Agent\Current\ENDP_WP_1010\Install\0000\McAfee_Web_Control_x64.msi" TRANSFORMS="C:\Windows\Temp\McAfeeTmpMSTPath\1033.mst" /qn /norestart BOOTSTRAPPERCALL=1 /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log" INSTALLDIR="C:\Program Files\McAfee\Endpoint Security\"msiexec.exe /i"C:\ProgramData\McAfee\Agent\Current\ENDP_WP_1010\Install\0000\McAfee_Web_Control_x64.msi" TRANSFORMS="C:\Windows\Temp\McAfeeTmpMSTPath\1033.mst" /qn /norestart BOOTSTRAPPERCALL=1 /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log" INSTALLDIR="C:\Program Files\McAfee\Endpoint Security\"
  3. Identify the MSI installation log file name from the command-line entry. Continuing from the above example, the log file name is: /l*v "C:\Windows\TEMP\\McAfeeLogs\McAfee_WebControl_Install_1907201620125658.log".
Review the MER data:
1. Open the identified MSI installation log file from the MER data.
2. Locate the point of failure in the MSI installation log file. Search the log for return value 3 if the log is in English.
  
  NOTE: return value 3 is a localized string. If the log is in a different language, search for the equivalent text in that language.
3. Identify the MSI action that failed (the action concluded with return value 3).
  
  Example:
  
  11:59:59:350 - >> Installing VSCORE: "C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\release\mfehidin.exe" -i ep_exploit_prevention -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_080116_115959.log" -etl "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_etl_080116_115959.etl" -mfetrust_off -x "C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\release\mfeepmpk.xml"
  11:59:59:850 - !> Error - VSCORE install failed
4. Identify the log file name to inspect from the command-line entry. Continuing from the above example, the log file name is: -l "C:\Windows\TEMP\\McAfeeLogs\McAfee_Threat_Prevention_EP_VScore_Install_080116_115959.log". In this example, it is a VSCore failure.
5. Open the identified log file from the MER data.
6. Search for Error to identify the root cause of the ENS installation failure.

Affected Products

Diagnostic Data Collection
Endpoint Security Firewall 10.7.x
Endpoint Security Firewall 10.6.x
Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Endpoint Security Web Control 10.7.x
Endpoint Security Web Control 10.6.x
Install/Uninstall
Troubleshooting

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

Troubleshoot an Endpoint Security installation failure

Environment

Summary

Affected Products

Languages:

Title

Title

Knowledge Center

Troubleshoot an Endpoint Security installation failure

Environment

Summary

Affected Products

Languages:

Choose your region

Title

Title