ePO 5.10 Service Pack 1 Update (ePO 5.10 SP1 CU):

[cdinet]

You also have to check the apache server service depends on value to ensure it matches what it should.

[cdinet]

One other thing..... if you are getting this error in the updater log when you attempt to install sp1, turn off the wmi service temporarily when running the updater.

error: Error: EPERM: operation not permitted, unlink 'C:/PROGRA~2/McAfee/EPOLIC~1//naprfctr.dll'
at Object.fs.unlinkSync (fs.js:1061:3)

SP1 is updating the counters and evidently the wmi service is interfering or having a lock on the file, so that will prevent that from happening.  That error means that the file is in use or locked by some other process.

[cdinet]

This is more detail on wmi issue...

Manually stop all ePO services, and confirm in task manager that there are no processes running like apache or eventparser.exe

Manually stop the WMI service

Go to the Services tab in task manager and scroll down to the wmiApSrv service - if it is running, stop it

Check with process explorer that nothing has a handle on those DLLs (i.e. search for naprfctr - there should be nothing found)

[SelsKurt]

For my own case, that is NOT the main one of this conversation but the same, i did many checks.

the rollback error workaround (registry forgotten rollback name for tomcat) has been tested with success. 

after that check, i targeted the update error itself and the wmi process conflict. i stopped not one but two services related to WMI and then proceed to the update itself. With a final success. WMI is the problem in my case.

So both workaround for both issues are being seen as the main solution. So let's expect that the epolauncher process will be updated soon with those fixces to obtain a real functionnal SP1 package.

Thanks to the support for the analysis. Now it is Dev Time 😉

[rpd]

Hi folks,

I ran into this stupid error because I forgot to activate the 8.3 names when I rebuilt the server months ago. However, all previous patches could be installed without errors, including patch 15.

The install of SP1 failed and so the roll back.

Please double check:

fsutil behavior set disable8dot3 0

See:

https://kcm.trellix.com/corporate/index?page=content&id=KB76582 and

https://kcm.trellix.com/corporate/index?page=content&id=KB96464&locale=en_US

Happy patching.

[ree5g]

Followed all the guidance from here and support call before updating - update failed.

Setup.exe error - failed to apply update. All applied changes have been reverted.

(no services restart)

Restarting services error - Windows could not start the Trellix ePolicy Orchestrator 5.10.0 Server service on Local Computer. eRROR 1075: The dependency service does not exist or has been marked for deletion. 

[rpd]

Yes. See on page 9:

The entry with: Rename EPOTOMCATSRV5100 to MCAFEETOMCATSRV5100

Reboot.

[cdinet]

These 2 services, in addition to the epo services, need to be stopped before applying sp1.

Windows Management Instrumentation
WMI Performance Adapter

Be sure to restart them manually after the install.

[ree5g]

Thank you @rpd and @cdinet - it seems Windows Management Instrumentation was still running during the first attempt.

2nd attempt this service was definitely stopped. Update applied successfully 

[cdinet]

Glad to hear it!