Symantec Endpoint Protection Installation Issue on Win7

Recently I had tried to deploy SEP on an Windows 7 client PC. The installation keep failing stated that the installation rolled back. This is a common issue for Windows 7 when trying to install SEP version 11.0. 

Here is the solution to solve this problem, it is caused by LiveUpdate.

To check the installation log

Click Start > Run
Type %temp% and click OK.
Open the file "SEP_INST.LOG" in a text editor, and look for the following text:
-- DECABI_LOGGING -- Enter LURegisterDecomposerABI()
-- DECABI_LOGGING -- LiveUpdate registration failed. (HRESULT=-2147221164)

If those entries exist, remove any leftover Symantec program files and then install Symantec Endpoint Protection.

To remove leftover Symantec program files

Delete the following folders (if they exist):
C:\Program Files\Symantec
C:\Program Files\Symantec Antivirus
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate
or c:\program data\symantec\liveupdate (Windows 7 or Windows Server 2008)
Install LiveUpdate by running the following file from CD1:
\SEP\LUSETUP.EXE
NOTE: Do not install LiveUpdate version 3.4 or newer (available from Symantec's FTP site). As of this writing, LiveUpdate 3.3 is the only version supported with enterprise products.
Install Symantec Endpoint Protection.

http://www.symantec.com/business/support/index?page=content&id=TECH102674&locale=en_US

Difference Between Remote Desktop and mstsc /console

In Windows Server 2003, when you use Terminal Services, you can connect to the console session (session 0), and at the same time, open a shadow session to it (as long as you connect from a session other than the console). With this added functionality, you can log on to a Windows Server 2003-based server that is running Terminal Services remotely and interact with session 0 as if you were sitting at the physical console of the computer. This session can also be shadowed so that the remote user and the local user at the physical console can see and interact with the same session.

While for normal Remote Desktop Connection, the session will remained in remote computer after user disconnected. However, the user will not be able to login to continue that session. The user need to manually connect back to that session.

"The user domain\username is logged locally on to this computer. The user has been idled for number minutes. The desktop is unlocked. If you continue, this user's session will end and any unsaved data will be lost."

Normal remote desktop command,

mstsc {target_computer_name}

Remote desktop to console session,

mstsc /console {target_computer_name}

http://support.microsoft.com/kb/278845

Troubleshooting SCCM Client Deployment Issue

Recently I have involved in a SCCM client deployment project in an company, the server has done setup and my responsible is to deploy every computer with SCCM client.

SCCM client is a client software provided by SCCM, as a receiver on client computer to receive any updates pushed from SCCM server. Most of the client computer has been installed with SCCM client by using group policy, however, partial computers has not installed properly, due to some issues. Here is the list of common issues which I encountered during deployment. The setup log can be found in the following location.

\windows\system32\ccmsetup\ccmsetup.logThis is the common I had encountered.

1. WMI corrupted or services unable to start

2. BITS service unable to start

3. Error 1603

4. WINS enabled

To deploy SCCM client, firstly the installer is needed. Before the installation begins, ccmclean.exe must be ran to ensure the computer is cleaned from existing SCCM installation. Next, WINS has to be disabled. The server will not able to update the computer with WINS in list of SCCM console. In this environment, WINS has been already not used, however, the WINS records still remained in client computers. To check the computer whether WINS is disabled, go to command prompt and type ipconfig /all, and make sure WINS proxy enabled is NO. If WINS is enabled, type in the following commands to refresh ipconfig,

ipconfig /release

ipconfig /renew

Troubleshooting BITS issue

I encountered this issue on several computer, where the computer has installed with SCCM client, however it cannot be started. Culprit was BITS service was not started.

If BITS unable to get started, apply BITS patch from Microsoft from the following link.

http://www.microsoft.com/downloads/details.aspx?FamilyID=8771DBBA-58B3-4EC3-B373-AA23F23AD0DF&displaylang=ko

Else, can try using this method,

Click Start > Run

Type “cmd“

In CMD, type “regsvr32 qmgr.dll” & hit enter

Also type “regsvr32 qmgrprxy.dll” & hit enter

Exit CMD

Troubleshooting WMI Issue

Certain client computer Windows Management Instrumentation were not shown as Started or ccmsetup.log indicates WMI issue.

This problem might caused by WMI repository corrupted. So I need to get Windows to create a new repository to overwrite corrupted one. Here are the steps,

1. Disable WMI service.

2. Go to c:\windows\system32\wbem\Repository

3. Rename "Repository" folder to "oldRepository"

4. Enable WMI service.

5. Restart SCCM client installation.

After doing this, a new Repository folder will appear in wbem folder, means Windows has create a WMI repository and replace the old one.

If WMI service missing from services, can try this method,

1. Go to cmd

2. run rundll32 wbemupgd, UpgradeRepository

3. Recheck WMI service in services.

Troubleshooting Error 1603

1) Uninstall the SCCM client from the target computer

2) Open a command line on the target and type REGSVR32 ATL.DLL

3) Reinstall the client using CCMSETUP

After the deployment of SCCM client, the computer names will not update to server on SCCM

console immediately, it took up to 7 days to appear in the list.