ENS 10.7.0 November 2022 Repost Update install / Upgrade failing ...

[apoling]

Hello,

we have checked the most common causes of a failing install (from KB article). We could not find a match to the error code, as well.

Perhaps somebody has access to resources to tell, what lies behind this error, found in McAfee_Common_Bottstrapper_<date_time>.log:

24/02/2023 10:40:41.615 [13888] [BootStrapperMain] Verifying process sign of C:\Users\<removed>\Desktop\mc\setupEP.exe
24/02/2023 10:40:41.959 [13888] [BootStrapperMain] Trust Verification Success!
24/02/2023 10:40:41.959 [13888] [BootStrapperMain] Starting Trellix Endpoint Security installer
24/02/2023 10:40:41.959 [13888] [BootStrapperMain] Locale ID obtained is 1033
24/02/2023 10:40:42.099 [13888] [BootStrapperMain] Info: No symbolic links were found in the install path
24/02/2023 10:40:42.099 [1604] [BootStrapperMain] [Pre-requisite]; Deploying XML services
24/02/2023 10:40:42.115 [1604] [BootStrapperMain] System already has MSXML 6 installed
24/02/2023 10:40:42.115 [1604] [BootStrapperMain] [Pre-requisite]; Deploying XML services completed
24/02/2023 10:40:42.693 [1604] [BootStrapperMain] Can't obtain ProductName and ProductVersion from resources 1813
24/02/2023 10:40:42.693 [1604] [BootStrapperMain] Trellix Endpoint Security's running build:5264.1
24/02/2023 10:40:42.693 [1604] [BootStrapperMain] [INFO]: UpgradeID retrieved is {74B710CF-552E-47D1-8CBF-D0AC2DA67B06}
24/02/2023 10:40:42.693 [1604] [BootStrapperMain] [INFO]: UpgradeID retrieved is {B2ABA365-ABA2-4E4F-8FE3-7C216A033359}
24/02/2023 10:40:42.693 [1604] [BootStrapperMain] [INFO]: UpgradeID retrieved is {858BFBEC-CE4F-4C5A-AD02-F88B7A3F670C}
24/02/2023 10:40:42.693 [1604] [BootStrapperMain] [INFO]: UpgradeID retrieved is {E68F630E-837B-4CAF-83F8-3285701D451C}
24/02/2023 10:40:42.693 [1604] [BootStrapperMain] Adaptive Threat Protection dependent on command line switch tp
24/02/2023 10:40:42.693 [1604] [BootStrapperMain] [INFO]: UpgradeID retrieved is {A1460C1B-0603-4AB7-84F0-37F06AB91F6D}
24/02/2023 10:40:42.693 [1604] [BootStrapperMain] Module configurations parsed
24/02/2023 10:40:42.693 [13888] [BootStrapperMain]

24/02/2023 10:40:42.693 [13888] [BootStrapperMain] Looking for pre install applications...
24/02/2023 10:40:42.693 [13888] [BootStrapperMain] Completed pre install applications look up.
24/02/2023 10:40:42.708 [13888] [BootStrapperMain] Found Threat Prevention module is already installed.
24/02/2023 10:40:42.724 [13888] [BootStrapperMain] Checking for minor upgrade scenario.
24/02/2023 10:40:42.724 [13888] [BootStrapperMain] SOFTWARE\McAfee\Endpoint\AV
24/02/2023 10:40:42.724 [13888] [BootStrapperMain] Build.package number of the currently installing Threat Prevention is 5200.1.
24/02/2023 10:40:42.724 [13888] [BootStrapperMain] Build.package number of existing Threat Prevention is 3113.1.
24/02/2023 10:40:42.724 [13888] [BootStrapperMain] Threat Prevention can be minor upgraded...
24/02/2023 10:40:42.724 [13888] [BootStrapperMain] Found Common module is already installed.
24/02/2023 10:40:42.724 [13888] [BootStrapperMain] Checking for minor upgrade scenario.
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] SOFTWARE\McAfee\Endpoint\Common
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] Build.package number of the currently installing Common is 5162.1.
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] Build.package number of existing Common is 3012.1.
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] Common can be minor upgraded...
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] Older ESP version (Major.Minor): 10.7 ..
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] Modules count retrieved
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] Commandline: ADDLOCAL="tp" /qn /nocontentupdate
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] ADDLOCAL="tp"
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] Command Line switches for modules modified with module dependencies : tp
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] /qn
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] /nocontentupdate
24/02/2023 10:40:42.740 [13888] [BootStrapperMain] Locale ID obtained is 1033
24/02/2023 10:40:42.755 [13888] [BootStrapperMain] Trellix Endpoint Security's running build:5264.1
24/02/2023 10:40:42.755 [13888] [BootStrapperMain] ADDLOCAL="tp" /qn /nocontentupdate
24/02/2023 10:40:42.755 [13888] [BootStrapperMain] Product already installed.Skipping conflicting products uninstallation
24/02/2023 10:40:42.755 [13552] [BootStrapperMain] InstallDeliverablesThread: Before IsGUIInstall. Value of 'bladeInstaller.m_bIsProgressRequired': false
24/02/2023 10:40:42.755 [13888] [BootStrapperMain] MainThread: HandleSilentInstallation. Before WaitForDeploymenttoComplete.
24/02/2023 10:40:42.755 [13552] [BootStrapperMain] InstallDeliverablesThread: IsGUIInstall evaluated to 'false'
24/02/2023 10:40:42.755 [13552] [BootStrapperMain] InstallDeliverablesThread: After IsGUIInstall. Value of 'bladeInstaller.m_bIsProgressRequired': false
24/02/2023 10:40:42.755 [13552] [BootStrapperMain] Started installing Dependencies
24/02/2023 10:40:42.755 [13552] [BootStrapperMain] Installing Common 5162.1
24/02/2023 10:40:45.083 [13552] [BootStrapperMain] C:\ProgramData\McAfeeTmpInstall_Common\setupCC.exe /qn INSTALLDIR="C:\Program Files\McAfee\Endpoint Security" /nocontentupdate /ignore /norestart
24/02/2023 10:40:47.098 [13552] [BootStrapperMain] Install failed return code : 3221226505
24/02/2023 10:40:47.160 [13552] [BootStrapperMain] [ERROR]: Dependency Installation Failed. Dependency :Common
24/02/2023 10:40:47.160 [13552] [BootStrapperMain] Modules Installation Failed
24/02/2023 10:40:47.160 [13552] [BootStrapperMain] Exiting Installation.
24/02/2023 10:40:47.160 [13888] [BootStrapperMain] Mode : Silent

We're told that the same happens, when previous ENS is removed, the system is restarted and retried the installation from the command line.

The certificates are in place and TEMP folder is accessible as per what we've been told.

Thanks for any serious clue.

Attila

[Pravas]

Hi @apoling ,

From the logs, it appears that Endpoint Security Platform fails to install.

24/02/2023 10:40:47.098 [13552] [BootStrapperMain] Install failed return code : 3221226505
24/02/2023 10:40:47.160 [13552] [BootStrapperMain] [ERROR]: Dependency Installation Failed. Dependency :Common

I would suggest to look at the below logs to narrow it down.

VsCore Install log - Open the logs and scroll to the bottom and verify if the return code is 0.

Common Install Log - It may provide more details about the failure.

Thanks

[apoling]

Hi Pravas,

Thank you for your response.

There are actually only 2 logs in regards of ENS upgrade in %TEMP%\McAfeeLogs and only 2 gets created from the point of launching SetupEP.exe till it fails. These two logs are the McAfee_Endpoint_Bootstrapper_<datetime>.log (content: see in my original post) and the McAfee_Common_Bootstrapper_<datetime>.log, I copy the content of this here:

24/02/2023 10:40:45.223 [13440] [BootstrapperMain] Common:Product version :10.7.0
24/02/2023 10:40:45.223 [13440] [BootstrapperMain] Common:Build number - 5162 , Package number - 1
24/02/2023 10:40:45.223 [13440] [BootstrapperMain] Package MA version 5.0.0.2620 Minimum MA Build supported is 5.0.0.0
24/02/2023 10:40:45.223 [13440] [BootstrapperMain] Checking for Mcfee Agent Iteration : 0
24/02/2023 10:40:45.239 [13440] [BootstrapperMain] GetInstallLocation start >>
24/02/2023 10:40:45.239 [13440] [BootstrapperMain] GetInstallLocation - szUninstallKey = SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6BFBE083-B521-43F7-B01C-B5A949B1564B}
24/02/2023 10:40:45.239 [13440] [BootstrapperMain] GetInstallLocation - RegOpenKeyEx succeeded.
24/02/2023 10:40:45.239 [13440] [BootstrapperMain] GetInstallLocation - InstallLocation = C:\Program Files\McAfee\Agent\
24/02/2023 10:40:45.239 [13440] [BootstrapperMain] Product code obtained : {6BFBE083-B521-43F7-B01C-B5A949B1564B}
24/02/2023 10:40:45.239 [13440] [BootstrapperMain] McAfee Agent could be installed on the system, if further checks pass.

<last entry>

So nothing much to look at in my perspective. (Note that before ENS installation/upgrade, Trellix Agent was upgraded successfully, to version 5.7.8.262. Their logs are also in %TEMP%\McAfeeLogs)

Could you please fetch the meaning of the error code seen in the Endpoint Bootstrapper log?

Thank you.

[apoling]

Hi Pravas,

please state if you can help me in the framework of this board. Otherwise I need to open a service call.

Are you able to fetch the resolution of the error message/code, please?

Server in question is windows 2016 Standard, no cluster, Trellix certificates are in place, system TEMP points to C:\Windows\TEMP folder.

Thank you in advance for your response.

Attila

[Pravas]

Hi @apoling ,

I've looked through your post but couldn't find any relevant KB with the error code.

Is Trellix Agent installed on the System? If yes, it should be 5.7.x, incase its older upgrade agent and re-try.

Please log a ticket with Support as it may require deeper investigation.

Thanks