Endpoint Security installation fails and enters a restart loop

Technical Articles ID: KB91309
Last Modified: 2023-06-05 08:53:22 Etc/GMT

Environment

Endpoint Security (ENS) Threat Prevention 10.6.1

Problem

When you upgrade from a previous ENS version to 10.6.1, the installation becomes stuck in an infinite restart loop.

In the logs, you can see the following.

From the McAfee_Common_Bootstrapper.log:

05/02/2019 08:00:43.872 [3532] [BootstrapperMain] Common:Product version :10.6.1
05/02/2019 08:00:48.530 [3532] [BootstrapperMain] Check if installed common is 10.5.3, need to install a HF for 10.5.3 before upgrade
05/02/2019 08:00:48.530 [3532] [BootstrapperMain] Installed ENS Common Product Version : 10.5.3
05/02/2019 08:01:39.843 [3532] [BootstrapperMain] Utility to update ENS exp driver returned reboot required.
05/02/2019 08:01:39.858 [3532] [BootstrapperMain] Common failed during install or Upgrade!!!

From the McAfee_Update_Exp_Driver.log:

[+] MFEEPMPK_WORKAROUND - About to run ENS mfeepmk fixer utility
[+] MFEEPMPK_WORKAROUND - Faulty driver was found. Now attempting replacement
[+] MFEEPMPK_WORKAROUND - Old driver still running!
[+] MFEEPMPK_WORKAROUND - Reboot is required
[+] MFEEPMPK_WORKAROUND - About to disable ENS workaround. This will take some time.
[+] MFEEPMPK_WORKAROUND - Disabled ENS workaround

After the restart, you see the same point of failure for all attempts and the McAfee_Update_Exp_Driver.log contains the following entry:

[+] MFEEPMPK_WORKAROUND - About to run ENS mfeepmk fixer utility
[+] MFEEPMPK_WORKAROUND - Checking for faulty driver existence
[+] MFEEPMPK_WORKAROUND - Old version of faulty driver was found.
[+] MFEEPMPK_WORKAROUND - Old driver file is flagged as DELETE_PENDING
[+] MFEEPMPK_WORKAROUND - Reboot is required

NOTE: The tool mfeempmk_utility was built into the installer for ENS 10.6.1 to fix a faulty driver. For more information, see KB90301 - Blue screen error or hang when SysCore upgrades and Endpoint Security or Host Intrusion Prevention Exploit Prevention is enabled.

Solution

This issue is resolved in the ENS 10.6.1 July 2019 Update Repost.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround

Delete the McAfeeEndpointSecurity_100 registry key on the client:

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
Do not run a REG file that is not confirmed to be a genuine registry import file.

Log on to the client as an administrator and start the installation task.
Press Windows+R, type regedit, and click OK.
Navigate to the following location:

Software\Microsoft\Windows\CurrentVersion\RunOnce
Delete the following key:

"McAfeeEndpointSecurity_100" : "C:\ProgramData\McAfee\Endpoint Security

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Endpoint Security installation fails and enters a restart loop

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Endpoint Security installation fails and enters a restart loop

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title