Welcome to McAfee Community! This write up is all about Installation for ENS and the common issues you may run into.
There are commonly two types of installation methods as found below.
We have penned down some of the easiest ways to troubleshoot installation issues, identifying failures and resolving them.
Please read through below for more details:
Troubleshooting Installation Failures with ENS
Via ePO/3rdParty Deployment tool
When installation/Upgrades fail via any of the remote deployment methods (ePO or 3rd party application, please check for presence of installation log files in the below folder:
Logs location: %Windir%\Temp\McAfeeLogs\
If no files are found/ McAfeeLogs folder not present, it means the installer never started locally. Please verify if the deployment tool/ePO was successfully able to download the package to machine.
Test running the installation locally to ensure local installation works.
Please visit this page for help with identifying and resolving Agent related issues.
Standalone deployment
In Standalone deployment, log Files are populated at %temp%\McAfeeLogs.
One unique log file to Stand alone deployment is "McAfee_Endpoint_BootStrapper_<%timestamp%>.log" in logs location.
This log file contains installation results of each individual module that is installed by the "SetupEP.exe" program.
This log file should tell us which module fails to get installed first. Each module (Common, Threat Prevention, Web Control, Firewall and Adaptive Threat Protection) has their own Bootstrapper and Installation log files.
A sample failure for common module in this log file would look like this:
15/12/2021 13:29:43.361 [3460] [BootStrapperMain] Install failed return code : 4294965695
15/12/2021 13:29:43.454 [3460] [BootStrapperMain] [ERROR]: Dependency Installation Failed. Dependency :Common
15/12/2021 13:29:43.454 [3460] [BootStrapperMain] Modules Installation Failed
15/12/2021 13:29:43.454 [3460] [BootStrapperMain] Exiting Installation.
From this point onwards, Installation troubleshooting remains common to both remote deployment and standalone deployment of ENS.
If No log Files are generated in the prescribed location:
If no log files are populated, please run process monitor and capture the installation attempt and look for "Access Denied" events in the logs if you are familiar with the process monitor tool.
Most common reasons can be presence of Third party AV
Please collect MER and Process Monitor and contact technical Support.
Process Monitor log collection Steps: McAfee Endpoint Security Data Collection Procmon
Mer download and log collection:
https://kc.mcafee.com/corporate/index?page=content&id=KB59385
If Log Files are generated in the prescribed Log locations:
If log Files are generated, depending on the failing module, please look for the below log file:
McAfee_<Module>_Bootstrapper_<%timestamp%>.log
Below is a typical example where VSCore installation (a core component within Common Module) that failed resulting in common Module installation failure)
15/12/2021 09:41:24.34 [2088] [BootstrapperMain] RunCommandLine: "C:\ProgramData\McAfee\Agent\Current\ENDP_GS_1070\Install\0000\\mfehidin.exe" -installcab:"vscore_all.cab" -guid:{EA334ECD-7513-486B-A265-0C698FACBB06} -log:"C:\Windows\TEMP\\McAfeeLogs\McAfee_Common_VSCore_Install_All_1512202109412419.log" -etl:"C:\Windows\TEMP\\McAfeeLogs\McAfee_Common_VSCore_Install_All_1512202109412419.etl" -mfetrust_off
15/12/2021 09:41:49.251 [2088] [BootstrapperMain] RunCommandLine: Process return code : 4294967295
15/12/2021 09:41:49.251 [2088] [BootstrapperMain] VSCore Installation Return value : 4294967295
15/12/2021 09:41:49.267 [2088] [BootstrapperMain] VSCore Error 0x20005011 Message: Internal error has occurred during installation.
15/12/2021 09:41:49.267 [2088] [BootstrapperMain] VSCore Installation failed!!
Each module also has its own msi installer log file and Custom action log files generated as applicable.
Log file name would look like this: McAfee_<module>_Install_<%timestamp%>.log
Within these msi log files, please look for the keyword "Return value 3" and look into the lines above this keyword to understand why the failure occurred.
Also, you may find the error codes returned by the installer in its last lines. Look into the below article from Microsoft for relevant reason(s) behind msiexec returning such errors:
https://docs.microsoft.com/en-gb/windows/win32/msi/error-codes?redirectedfrom=MSDN
Another way to review logs with Process Monitor is explained in the below KBA:
https://kb.mcafee.com/corporate/index?page=content&id=KB87589
Please search for the obtained error codes on our support portal (support.mcafee.com) and you may find relevant KBAs on the same.
In case you do not find any relevant KBAs, please do contact Support via a Service Request or further assistance.
Commonly encountered issues:
1. Product install or upgrade issues due to missing root certificates:
When ENS Common/Platform fails to install, The most common reason is missing root certificates.
In McAfee_Common_Bootstrapper_date_time.log please search for "return code: 3221225506"
Also, in Setupapi.dev.log, found in %Windir%\Inf may contain the below errors:
! sig: Verifying file against specific (valid) catalog failed! (0x800b0109)
! sig: Error 0x800b0109: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
To resolve this, please refer to below KBA:
https://kb.mcafee.com/corporate/index?page=content&id=KB87096
- @Pravas and @AdithyanT
-----------------LOCKED-----------------
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use our Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership: