mfenlfk.sys prevented from being installed due to third-party software

Technical Articles ID: KB90111
Last Modified: 5/13/2020

Environment

McAfee Endpoint Security (ENS) 10.x
McAfee VirusScan Enterprise (VSE) 8.8
McAfee Management for Optimized Virtual Environments (MOVE)
McAfee MOVE Antivirus Multi-platform (MOVE AV Multi-Platform) 4.8.x

Check Point VPN
Check Point ZoneAlarm
Shrewsoft VPN Client

Problem

When certain third-party software is installed on the system, installation of ENS, VSE, or MOVE AV MP fails. The fail can occur via an ePolicy Orchestrator deployment, or local installation.

The third-party software that is known to cause this issue is listed in the Environment field of this article.

From the McAfee_Endpoint_Bootstrapper_<timestamp>.log:

14/11/2017 18:03:31.921 [8672] [BootStrapperMain] Started installing Dependencies
14/11/2017 18:03:31.937 [8672] [BootStrapperMain] Installing Common 3178.1
14/11/2017 18:03:34.453 [8672] [BootStrapperMain] C:\ProgramData\McAfeeTmpInstall_Common\setupCC.exe /qn INSTALLDIR="C:\Program Files\McAfee\Endpoint Security" /ignore /norestart
14/11/2017 18:04:16.394 [8672] [BootStrapperMain] Install failed return code : 4294967295
14/11/2017 18:04:16.534 [8672] [BootStrapperMain] [ERROR]: Dependency Installation Failed. Dependency :Common
14/11/2017 18:04:16.534 [8672] [BootStrapperMain] Modules Installation Failed
14/11/2017 18:04:16.534 [8672] [BootStrapperMain] Exiting Installation.

From the McAfee_Common_VSCore_Install_All_<timestamp>.log:

[10:21:54:730] - Creating AAC policy to allow NDIS Install

[10:21:54:745] - Installing mfe_ndisfilt...
[10:21:55:101] - NDISInstall returned hr=80070005
[10:21:55:101] - Got failure, reverting changes
...
[10:21:55:322] - Removing AAC policy to allow NDIS Install/Uninstall
[10:21:55:333] - CNdisInstaller::Iinstall() hr=80070005
[10:21:55:333] - WARNING: Could not open BehaviorBlocking key
[10:21:55:334] - Lock Service DACL mfenlfk
[10:21:55:334] - InstallCustomDriver failed
[10:21:55:334] - mfenlfk.sys is not installed properly
[10:21:55:334] - parseDriver: exit=0
[10:21:55:334] - ERROR: parseFeature: Failed to parse element [Driver]
[10:21:55:334] - parseFeature: exit=0
[10:21:55:334] - ERROR: parseCoreInstall: Failed to parse element [Feature]!
[10:21:55:334] - parseCoreInstall: return=0
[10:21:55:334] - ParseXMLFile: ERROR: parseCoreInstall returned failure
[10:21:55:334] - ParseXMLFile: return=0
[10:21:55:334] - Install error: un-winding install

Cause

ENS, VSE, and MOVE AV MP, use the Network Driver Interface Specification (NDIS) filter driver. The third-party software places a lock on the NDIS filter driver. The lock prevents changes that are needed for product functionality.

Solution

If you experience the issue with Check Point VPN, there is a hotfix available from Check Point that resolves the issue. For more information, see: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116313.

Workaround

Disable the conflicting third-party software services during the installation of ENS, VSE, or MOVE AV MP.

Affected Products

Endpoint Security Firewall 10.7.x
Endpoint Security Firewall 10.6.x
Endpoint Security Firewall 10.5.x (EOL)
Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Endpoint Security Threat Prevention 10.5.x (EOL)
Endpoint Security Web Control 10.7.x
Endpoint Security Web Control 10.6.x
Endpoint Security Web Control 10.5.x (EOL)
Install/Uninstall
MOVE Antivirus Multi-platform 4.8.x
VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

mfenlfk.sys prevented from being installed due to third-party software

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

mfenlfk.sys prevented from being installed due to third-party software

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title