MOVE client install fails due to uninstalling ENS partially with SysCore build
Last Modified: 2021-12-14 21:49:05 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
MOVE client install fails due to uninstalling ENS partially with SysCore build
Technical Articles ID:
KB95093
Last Modified: 2021-12-14 21:49:05 Etc/GMT Environment
Management for Optimized Virtual Environments (MOVE) MOVE Problem
MOVE client install fails with the following error message after partially uninstalling ENS: The MOVE client 4.8.1.175 fails with the following errors: The log stored in: C:\windows folder InstallShield 13:00:08: ProductCode is {291E5CBE-DC09-48AC-B3F6-1997B3113966} InstallShield 13:00:08: Initializing Engine InstallShield 13:00:08: Done Initializing... InstallShield 13:00:08: Registering Msi Server... InstallShield 13:00:08: Invoking script function inst_function_MPT McAfee: Installing MPT... McAfee: INSTALLDIR custom property: C:\Program Files (x86)\McAfee\MOVE AV Client\ McAfee: WindowsFolder custom property: C:\WINDOWS\ McAfee: Error: MPT installation failed with error -2 McAfee: Please refer -log:"C:\WINDOWS\\Temp\MOVE_MPT_install.log" for details. McAfee: Removing MPT installer files from the install folders InstallShield 13:01:49: CallScriptFunctionFromMsiCA() ends CustomAction ca_inst_MPT returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) MOVE_MPT_install.log:- The log is stored in the C:\windows folder. [12:24:58:421] - VSCore version is [20.3.0.136.9], per manifest [ALL.xml] [12:24:58:421] - Reboot required after complete uninstall - LastVersion: 21.4.0.156.5 ThisVersion: 20.3.0.136.9 [12:24:58:421] - ERROR. A reboot is required before Installation can proceed. Please reboot before trying to install again. [12:24:58:421] - RecordActionCode: Action Result 0 Category 2 Message 1 (Final 0x20002011). [12:24:58:421] - Cleanup_RemoveService: Failed to open service [mfehidin_svc] [1060] [12:24:58:421] - StartHIP: policy disable 0 service stopped 0 [12:24:58:437] - Total 1 Error Value present [12:24:58:437] - Code [0x20002011] : A reboot is required before installer action can proceed. [12:25:45:515] - The file "C:\Program Files (x86)\McAfee\MOVE AV Client\mfehidin.exe" is signed and the signature was verified. [12:25:45:515] - Error "An error occurred while reading or writing to a file. " validating "C:\Program Files (x86)\McAfee\MOVE AV Client\mfehidk.sys" [12:25:45:515] - Exit code will be 4294967294 Cause
The SysCore entry in the registry isn’t cleared by uninstalling the ENS product, and is running with a higher build than the MOVE client SysCore.
Solution
MOVE client 4.8.1.175 installs the If the system has a higher build of SysCore before the MOVE client is installed, it's due to the following reasons:
The String name: system_core_version. NOTE: Under these circumstances, try removing the ENS completely through EPR tool on one system and verify if the SysCore is cleared from the registry after restarting the system. Example: According to above log snippet, the system is installed with ENS 10.7.0.x and then uninstalled, but SysCore in the registry still displays as: 21.4.0.156.5. Because the MOVE client writes the SysCore as 20.3.0.136.9, it fails due to a higher version of SysCore already present in the system. Related InformationAffected ProductsLanguages:This article is available in the following languages: |
|