ePO 5.10 (no updates) -> Update 4 fails with Event Parser error

[Former Member]

Hello,

Recently I've been trying to apply update 4 but I get a "Failed to apply update. All applied changes have been reverted." Details show the failures as:

Apply file MobilePluginService.exe

Apply file EventParser.exe

I followed KB91402 because my situation is very similar, but it didn't seem to work. I'm upgrading an air gapped system so I cannot provide logs but I can do my best to explain what they say.

ePOUpdater.log:

Error: Unknown error while executing other file
Error:  Error: EPERM: operation not permitted, unlink 'C:\PROGRA~2\McAfee\EPOLIC~1\EventParser.exe'
    at Object.fs.unlinkSync (fs.js:1079:18)
    at mayCopyFile (C:\Users\Joe\Downloads\ePO_5.10.0_Update_4\resources\app\node_modules\fs-extra\lib\copy-sync\copy-sync.js:57:8)
    at onFile (C:\Users\Joe\Downloads\ePO_5.10.0_Update_4\resources\app\node_modules\fs-extra\lib\copy-sync\copy-sync.js:52:10)
    at getStats (C:\Users\Joe\Downloads\ePO_5.10.0_Update_4\resources\app\node_modules\fs-extra\lib\copy-sync\copy-sync.js:46:44)
    at startCopy (C:\Users\Joe\Downloads\ePO_5.10.0_Update_4\resources\app\node_modules\fs-extra\lib\copy-sync\copy-sync.js:36:10)
    at Object.copySync (C:\Users\Joe\Downloads\ePO_5.10.0_Update_4\resources\app\node_modules\fs-extra\lib\copy-sync\copy-sync.js:31:10)
    at copyFileInSync (C:\Users\Joe\Downloads\ePO_5.10.0_Update_4\resources\app\js\core.js:1596:13)
    at executeOtherFiles (C:\Users\Joe\Downloads\ePO_5.10.0_Update_4\resources\app\js\core.js:1529:13)
    at C:\Users\Joe\Downloads\ePO_5.10.0_Update_4\resources\app\js\core.js:1273:17
    at C:\Users\Joe\Downloads\ePO_5.10.0_Update_4\resources\app\node_modules\async\dist\async.js:3110:16

[cdinet · Accepted solution]

That typically means there is a file lock somewhere on the epo directory - either services haven't stopped completely, or a 3rd party monitoring tool restarted them.  Other causes are if there are shortcuts anywhere to the epo install directory, mapped drives, or if antivirus is scanning and locking the files.  Sometimes a reboot might remove any unknown locks on files too.

[Former Member]

So I restarted the machine and it didn't help. Then turned off UAC controls restarted again and stopped services. still the same error coming up. there are no mapped drives and I'm pretty sure no shortcuts. I don't believe anti-virus is on the machine and able to access anything.

If it helps it is a Win 2008 R2 virtual server. Any Ideas on things to check? Possible KBs?

[cdinet]

You might need to use process explorer then to find any handles on the directory.  See KB88085 for info on using process explorer, or go to sysinternals.com and you can get Microsoft's instructions.  You can also run procmon (also from sysinternals) to see what might be causing any access denied.

[Former Member · Accepted solution]

Ok I discovered "MobilePluginService.exe" and "EventParser.exe" are set to read only. I'm assuming now that is why.

[cdinet]

Yes, that would do it.