locked
[Resolved] FEP 2010 Client - installation problem RRS feed

  • Question

  • Hi!

     

    I've deployed FEP 2010 with SCCM 2007 R3. On some client computers (e.g. Windows 7 Enterprise x64 EN-US) problem with installation is.

    Previously Forefront Client Security was installed but currently is completly uninstalled. Any other security software is not running on computer.

     

    Application log event is created and error is displayed

     

    Log Name:      Application
    Source:        Microsoft Security Client Setup
    Date:          2011-01-14 23:02:56
    Event ID:      100
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          DOMAIN\ADMIN_USER
    Computer:      NB-007.DOMAIN.LOCAL
    Description:
    HRESULT:0x80070643
    Description:Cannot complete the Forefront Endpoint Protection installation. An error has prevented the Forefront Endpoint Protection setup wizard from completing successfully. Please restart your computer and try again. Error code:0x80070643. Fatal error during installation.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft Security Client Setup" />
        <EventID Qualifiers="0">100</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2011-01-14T22:02:56.000000000Z" />
        <EventRecordID>19813</EventRecordID>
        <Channel>Application</Channel>
        <Computer>NB-007.DOMAIN.LOCAL</Computer>
        <Security UserID="S-1-5-21-683700866-3936568016-373131377-1663" />
      </System>
      <EventData>
        <Data>HRESULT:0x80070643
    Description:Cannot complete the Forefront Endpoint Protection installation. An error has prevented the Forefront Endpoint Protection setup wizard from completing successfully. Please restart your computer and try again. Error code:0x80070643. Fatal error during installation.</Data>
      </EventData>
    </Event>

     

    FEP 2010 Client installation file (C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppSetup.log) contains

     

    START    2011/01/14 23:01:32:179 TID:5040 PID:4460

    INFO    2011/01/14 23:01:32:179 TID:5040 PID:4460
    Log location [C:\ProgramData\Microsoft\Microsoft Security Client\Support]

    ERROR    2011/01/14 23:01:32:183 TID:5040 PID:4460
    Operation failed: Start WPP logging - Can't complete the Setup Wizard. An error has prevented Setup Wizard from continuing. Please restart your computer and try again. Error code:0x80070020. The process cannot access the file because it is being used by another process.   [80070020]

    INFO    2011/01/14 23:01:32:183 TID:5040 PID:4460
    Initializing WPP Logging with APP NAME[MSSESetup]

    SUCCESS    2011/01/14 23:01:32:183 TID:5040 PID:4460
    Starting setup...

    INFO    2011/01/14 23:01:32:188 TID:5040 PID:4460
    Package version number is '2.0.657.0'

    INFO    2011/01/14 23:01:32:188 TID:5040 PID:4460
    Command line arguments: []

    INFO    2011/01/14 23:01:32:188 TID:5040 PID:4460
    Setup type is 0x2

    INFO    2011/01/14 23:01:32:199 TID:5040 PID:4460
    Market set to 'en-us'

    INFO    2011/01/14 23:01:32:206 TID:5040 PID:4460
    Internal brand name is 'FEP 2010'

    INFO    2011/01/14 23:01:32:207 TID:5040 PID:4460
    Processor Architecture: amd64

    INFO    2011/01/14 23:01:32:207 TID:5040 PID:4460
    OS type: 16

    INFO    2011/01/14 23:01:32:207 TID:5040 PID:4460
    OS friendly name: Windows 7 Enterprise

    INFO    2011/01/14 23:01:32:208 TID:5040 PID:4460
    Attempt to run Install scenario

    INFO    2011/01/14 23:01:32:309 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetInstallPrequalChecksAction

    INFO    2011/01/14 23:01:32:309 TID:5040 PID:4460
    Show dialog, ID [1]

    INFO    2011/01/14 23:01:34:120 TID:5040 PID:4460
    Show dialog, ID [9]

    INFO    2011/01/14 23:01:35:993 TID:5040 PID:4460
    Show dialog, ID [45]

    INFO    2011/01/14 23:01:38:892 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetSqmOptInAction

    INFO    2011/01/14 23:01:38:892 TID:5040 PID:4460
    Show dialog, ID [51]

    INFO    2011/01/14 23:01:51:518 TID:5040 PID:4460
    Show dialog, ID [52]

    INFO    2011/01/14 23:01:52:173 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetWmiInfrastructureCheckAction

    INFO    2011/01/14 23:01:54:185 TID:2600 PID:4460
    Show dialog, ID [34]

    INFO    2011/01/14 23:01:58:616 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetCompetitiveAppRemoveAction

    INFO    2011/01/14 23:01:58:616 TID:5040 PID:4460
    Show dialog, ID [2]

    INFO    2011/01/14 23:02:18:272 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetInstallNisPrequal

    INFO    2011/01/14 23:02:18:272 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetClientLocUninstallPackage

    INFO    2011/01/14 23:02:18:303 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetClientUninstallAction

    INFO    2011/01/14 23:02:18:319 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetAMUninstallAction

    INFO    2011/01/14 23:02:18:319 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetAMLocUninstallAction

    INFO    2011/01/14 23:02:18:350 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetUninstallExternalPackagesAction

    INFO    2011/01/14 23:02:18:350 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetCopyFileAction

    INFO    2011/01/14 23:02:18:350 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetDrWatsonInstallAction

    INFO    2011/01/14 23:02:22:328 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetClientInstallAction

    INFO    2011/01/14 23:02:22:328 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::InternalRun - GetClientLocInstallPackage

    ERROR    2011/01/14 23:02:49:488 TID:5040 PID:4460
    Operation failed: MorroBootstraper::CInstallFlow::InternalRun - GetAMInstallAction - Cannot complete the Forefront Endpoint Protection installation. An error has prevented the Forefront Endpoint Protection setup wizard from completing successfully. Please restart your computer and try again. Error code:0x80070643. Fatal error during installation.   [80070643]

    INFO    2011/01/14 23:02:49:488 TID:5040 PID:4460
    Performing Rollback

    INFO    2011/01/14 23:02:49:488 TID:5040 PID:4460
    Show dialog, ID [38]

    INFO    2011/01/14 23:02:49:534 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::RollbackInstallation - GetBetaUninstallAction

    INFO    2011/01/14 23:02:49:566 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::RollbackInstallation - GetUninstallExternalPackagesAction

    INFO    2011/01/14 23:02:49:566 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::RollbackInstallation - GetAMLocUninstallAction

    INFO    2011/01/14 23:02:53:668 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::RollbackInstallation - GetClientUninstallAction

    INFO    2011/01/14 23:02:53:668 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::RollbackInstallation - GetClientLocUninstallPackage

    INFO    2011/01/14 23:02:53:684 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::RollbackInstallation - GetAMUninstallAction

    INFO    2011/01/14 23:02:53:684 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::RollbackInstallation - GetArpUninstallAction

    INFO    2011/01/14 23:02:53:684 TID:5040 PID:4460
    Operation finished: MorroBootstraper::CInstallFlow::RollbackInstallation - GetDrWatsonUninstallAction

    INFO    2011/01/14 23:02:53:700 TID:5040 PID:4460
    Show dialog, ID [10]

    ERROR    2011/01/14 23:02:56:648 TID:5040 PID:4460
    Operation failed: Flow InternalRun - Cannot complete the Forefront Endpoint Protection installation. An error has prevented the Forefront Endpoint Protection setup wizard from completing successfully. Please restart your computer and try again. Error code:0x80070643. Fatal error during installation.   [80070643]

    ERROR    2011/01/14 23:02:56:648 TID:5040 PID:4460
    Operation failed: Setup - Cannot complete the Forefront Endpoint Protection installation. An error has prevented the Forefront Endpoint Protection setup wizard from completing successfully. Please restart your computer and try again. Error code:0x80070643. Fatal error during installation.   [80070643]

    INFO    2011/01/14 23:02:56:679 TID:5040 PID:4460
    Operation finished: Sending setup completed event to event log


    Wojciech Sciesinski
    • Edited by it-praktyk Thursday, January 27, 2011 10:13 PM
    Monday, January 17, 2011 7:34 AM

Answers

  • Hi

     

    I've resolved this issue.

     

    In my case on computer Base Filter Engine service was disabled. This service was disabled intentionally because CPU time usage with started exced 50% only for one svchost thread.

     

    After enabling and starting this service FEP 2010 Client has installed correctly.


    Wojciech Sciesinski
    • Marked as answer by it-praktyk Thursday, January 27, 2011 10:18 PM
    Thursday, January 27, 2011 10:18 PM

All replies

  • Hi,

    Thanks for the post.

    Please check if this issue will occur in Clean Boot Mode. Please be assured that any security program has been turned off in this mode.

    Clean Boot
    =============
    Let's disable all startup items and third party services when booting. This method will help us determine if this issue is caused by a loading program or service. Please perform the following steps:

    1. Click "Start", go to "Run", and type "msconfig" (without the quotation marks) in the open box to start the System Configuration Utility.
    2. Click the "Services" tab, check the "Hide All Microsoft Services" box and click "Disable All" (if it is not gray).
    3. Click the "Startup" tab, click "Disable All" and click "OK".
    4. Click "OK" to restart your computer to Selective Startup environment.
    5. When the "System Configuration Utility" window appears, please check the "Don't show this message or launch the System Configuration Utility when Windows starts" box and click OK.
    6. Check whether or not the issue still appears in this environment.

    Note: Temporarily disabling the Startup Group only prevents the startup programs from loading at startup. This shouldn't affect the system or other programs. We may still manually run these programs later.

    Does it work?

    Thanks,

    Miles

     

     

     

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Tuesday, January 18, 2011 7:04 AM
  • Hi!

    Please check if this issue will occur in Clean Boot Mode. Please be assured that any security program has been turned off in this mode.

     

    In Clean Boot Mode problem with installation still exists :(


    Wojciech Sciesinski
    Tuesday, January 18, 2011 5:30 PM
  • Hi,

    Thanks for the post.

    FEP 2010 clients require the Windows Filtering Platform (WFP) rollup package KB981889 on Windows Vista, 2008, 2008 R2, and Windows 7. Please check it.

    http://social.technet.microsoft.com/wiki/contents/articles/fep-2010-deploying-client-kb981889-ahead-of-time.aspx

    In addition, you could find FEP client installation log files in the following location:

    • %allusersprofile%\Microsoft\Microsoft Antimalware\Support: log files specific for the antimalware service
    • %allusersprofile%\Microsoft\Microsoft Security Client\Support: log files specific for the FEP client software
    • %windir%\WindowsUpdate.log: Windows Update log files, which include information about definition updates

    Please use Windows Live SkyDrive (http://windowslive.com/online/skydrive ) to upload these log files and then send the download address to me directly at
    (Note: With this thread title or link in the email. Please don’t share documents with tfwst@microsoft.com)

    Thanks,

    Miles


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Miles Zhang Friday, January 21, 2011 1:51 AM
    • Unmarked as answer by it-praktyk Tuesday, January 25, 2011 8:31 AM
    Wednesday, January 19, 2011 9:37 AM
  • Hi!
    FEP 2010 clients require the Windows Filtering Platform (WFP) rollup package KB981889 on Windows Vista, 2008, 2008 R2, and Windows 7. Please check it.

    This update is correctly installed on my system.

    In addition, you could find FEP client installation log files in the following location:
    • %allusersprofile%\Microsoft\Microsoft Antimalware\Support : log files specific for the antimalware service

    This link doesn't work on my system< br /> But I've checked in folder C:\Users\All Users\Microsoft\Microsoft Antimalware\Definition Updates\Updates\ - only vdm and dll files exist.

  • %allusersprofile%\Microsoft\Microsoft Security Client\Support : log files specific for the FEP client software
  • %windir%\WindowsUpdate.log : Windows Update log files, which include information about definition updates
  • Files uploaded to SkyDrive, notification (used SkyDrive function) sended.

     

    Regards


    Wojciech Sciesinski
    • Marked as answer by it-praktyk Tuesday, January 25, 2011 8:30 AM
    • Unmarked as answer by it-praktyk Wednesday, January 26, 2011 6:02 AM
    Friday, January 21, 2011 6:39 PM
  • Hi

    Please use Windows Live SkyDrive (http://windowslive.com/online/skydrive ) to upload these log files and then send the download address to me directly at
    (Note : With this thread title or link in the email. Please don’t share documents with tfwst@microsoft.com )

    Please tell me how I can send you directly link for log files?

     


    Wojciech Sciesinski
    • Marked as answer by it-praktyk Tuesday, January 25, 2011 8:30 AM
    • Unmarked as answer by it-praktyk Wednesday, January 26, 2011 6:01 AM
    Tuesday, January 25, 2011 8:30 AM
  • Hi

     

    I've resolved this issue.

     

    In my case on computer Base Filter Engine service was disabled. This service was disabled intentionally because CPU time usage with started exced 50% only for one svchost thread.

     

    After enabling and starting this service FEP 2010 Client has installed correctly.


    Wojciech Sciesinski
    • Marked as answer by it-praktyk Thursday, January 27, 2011 10:18 PM
    Thursday, January 27, 2011 10:18 PM
  • how did you enable Base Filter Engine?
    Thursday, March 17, 2011 2:47 PM
  • Hey, this also fixed my issue as well. I went into services and found that my Base Filter Engine was disabled. After enabled and then starting the service. FEP 2010 installed correctly. Thanks for this solution!

    Thursday, April 14, 2011 4:48 PM
  • Hi

    Please help as I cannot get Base Filter Engine service on Windows XP SP3 machines

    Wednesday, June 22, 2011 5:35 AM
  • Hi all, i previously have symantec and i uninstall it completely from windows 7 PC but when i installing FEP using SCCM or Manually i got the same error. I also try to enable base filter engine service and also clean boot the system but no luck. Can anybody help me to find a workaround. Regards, Xoobii
    Xohaib
    Friday, December 9, 2011 11:51 AM
  • I had the same error, but in my case I had FCS installed on my clients.  When the FEP installation occurred and tried to uninstall the antimailware component of FCS, it couldn't find the source files to remove it, so it failed with this same error.  As soon as I restored the source files, the upgrade to FEP went fine.


    wde

    Friday, September 14, 2012 6:05 PM