How to Troubleshoot ENS Installation

[AdithyanT]

Welcome to McAfee Community! This write up is all about Installation for ENS and the common issues you may run into.

There are commonly two types of installation methods as found below.

• ENS Standalone (Local Install)
• Remote Deployment (ePO)

We have penned down some of the easiest ways to troubleshoot installation issues, identifying failures and resolving them.

Please read through below for more details:

Troubleshooting Installation Failures with ENS

Via ePO/3rdParty Deployment tool

When installation/Upgrades fail via any of the remote deployment methods (ePO or 3rd party application, please check for presence of installation log files in the below folder:

Logs location: %Windir%\Temp\McAfeeLogs\

If no files are found/ McAfeeLogs folder not present, it means the installer never started locally. Please verify if the deployment tool/ePO was successfully able to download the package to machine.

Test running the installation locally  to ensure local installation works.

Please visit this page for help with identifying and resolving Agent related issues.

Standalone deployment

In Standalone deployment, log Files are populated at %temp%\McAfeeLogs.

One unique log file to Stand alone deployment is "McAfee_Endpoint_BootStrapper_<%timestamp%>.log" in logs location.

This log file contains installation results of each individual module that is installed by the "SetupEP.exe" program.

This log file should tell us which module fails to get installed first. Each module (Common, Threat Prevention, Web Control, Firewall and Adaptive Threat Protection) has their own Bootstrapper and Installation log files.

A sample failure for common module in this log file would look like this:

15/12/2021 13:29:43.361 [3460] [BootStrapperMain] Install failed return code : 4294965695

15/12/2021 13:29:43.454 [3460] [BootStrapperMain] [ERROR]: Dependency Installation Failed. Dependency :Common

15/12/2021 13:29:43.454 [3460] [BootStrapperMain] Modules Installation Failed

15/12/2021 13:29:43.454 [3460] [BootStrapperMain] Exiting Installation.

From this point onwards, Installation troubleshooting remains common to both remote deployment and standalone deployment of ENS.

If No log Files are generated in the prescribed location:

If no log files are populated, please run process monitor and capture the installation attempt and look for "Access Denied" events in the logs if you are familiar with the process monitor tool.

Most common reasons can be presence of Third party AV

Please collect MER and Process Monitor and contact technical Support.

Process Monitor log collection Steps: McAfee Endpoint Security Data Collection   Procmon

Mer download and log collection:

https://kc.mcafee.com/corporate/index?page=content&id=KB59385

If Log Files are generated in the prescribed Log locations:

If log Files are generated, depending on the failing module, please look for the below log file:

McAfee_<Module>_Bootstrapper_<%timestamp%>.log

Below is a typical example where VSCore installation (a core component within Common Module) that failed resulting in common Module installation failure)

15/12/2021 09:41:24.34 [2088] [BootstrapperMain] RunCommandLine: "C:\ProgramData\McAfee\Agent\Current\ENDP_GS_1070\Install\0000\\mfehidin.exe" -installcab:"vscore_all.cab" -guid:{EA334ECD-7513-486B-A265-0C698FACBB06} -log:"C:\Windows\TEMP\\McAfeeLogs\McAfee_Common_VSCore_Install_All_1512202109412419.log" -etl:"C:\Windows\TEMP\\McAfeeLogs\McAfee_Common_VSCore_Install_All_1512202109412419.etl" -mfetrust_off

15/12/2021 09:41:49.251 [2088] [BootstrapperMain] RunCommandLine: Process return code : 4294967295

15/12/2021 09:41:49.251 [2088] [BootstrapperMain] VSCore Installation Return value : 4294967295

15/12/2021 09:41:49.267 [2088] [BootstrapperMain] VSCore Error 0x20005011 Message: Internal error has occurred during installation.

15/12/2021 09:41:49.267 [2088] [BootstrapperMain] VSCore Installation failed!!

Each module also has its own msi installer log file  and Custom action log files generated as applicable.

Log file name would look like this: McAfee_<module>_Install_<%timestamp%>.log

Within these msi log files, please look for the keyword "Return value 3" and look into the lines above this keyword to understand why the failure occurred.

Also, you may find the error codes returned by the installer in its last lines. Look into the below article from Microsoft for relevant reason(s) behind msiexec returning such errors:

https://docs.microsoft.com/en-gb/windows/win32/msi/error-codes?redirectedfrom=MSDN

Another way to review logs with Process Monitor is explained in the below KBA:

https://kb.mcafee.com/corporate/index?page=content&id=KB87589

Please search for the obtained error codes on our support portal (support.mcafee.com) and you may find relevant KBAs on the same.

In case you do not find any relevant KBAs, please do contact Support via a Service Request or further assistance.

Commonly encountered issues:

1. Product install or upgrade issues due to missing root certificates:

When ENS Common/Platform fails to install, The most common reason is missing root certificates.

In McAfee_Common_Bootstrapper_date_time.log please search for "return code: 3221225506"

Also, in Setupapi.dev.log, found in %Windir%\Inf may contain the below errors:

!    sig:                     Verifying file against specific (valid) catalog failed! (0x800b0109)

!    sig:                     Error 0x800b0109: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

To resolve this, please refer to below KBA:

https://kb.mcafee.com/corporate/index?page=content&id=KB87096

- @Pravas and @AdithyanT

[AdithyanT]

-----------------LOCKED-----------------