Installation Rollback due to GPOPolicyReview. Access is DENIED.

[Roman Adyev]

Hello guys

I'm trying to setup newly downloaded Symantec_Endpoint_Protection_14.2.0_RU1_Part1_Trialware_EN

But it does rollback during installation process. Here is an error from SEPM_INST.log

INFO  Exception CreateProcessW. Error code: 5: Access is denied.
CustomAction GPOPolicyReview returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

According to the post I found here https://support.symantec.com/us/en/article.tech233569.html the issue can have a couple different causes:

1. TMP and TEMP variables do not have the same path.
2. Restrictive permissions are prohibiting the installation.

But I checked all those causes and they are OK, TMP and TEMP have same path and the user is new and placed only in Administrators group.

Full log file is attached

Please help me

Attachment(s)

SEPM_INST.docx   450 KB 1 version

[TonyS]

Have a look at this - https://support.symantec.com/us/en/article.tech237298.html

[Roman Adyev]

Hi Tony, thanks for reply

Of course I did, but that post is about the situation when the process of verification has already been started.

That's not the case with my situation according logs. I have access denied error 5.

I've also checked the duration of that operation "gpresult /scope COMPUTER /f /X gpresult.xml" - it's very fast.

 

[TonyS]

Thanks. I wanted to make sure that we have covered both sides.

I still feel it's still to do with your admin login and/or your GPO setup that is causing this. Have you tried temporarily disabling GPO on this machine and see if it works? If it worked, then your GPO must be doing something to block this. Do you have software restriction enabled in your GPO?

[Roman Adyev]

Tony, can you provide mini guide how to disable GPO in Windwos 10 1903 if it's possible? 

I can't figure out even using google : (

[TonyS]

Is your machine connected to AD Domain? If so, you may ned to speak to your IT administrator to see if they could work with you to make this work?

[Roman Adyev]

No, the machine is in Workgoup called Workgroup : )

[TonyS]

Okay, so that rules out GPO issue as your machine is a stand alone. Assuming it has *never* been connected to an AD domain, that means the focus is with your admin account.

Try creating a new account and give it an admin privileges. Reboot the machine, log on using the new admin account and try again with the install.

Does it work?

[Roman Adyev]

Okay, that I've done:

1) Reseted GPO to default using that guide https://www.windowscentral.com/how-reset-local-group-policy-objects-their-default-settings-windows-10

2) Reseted Local Security Policy Settings using that guide https://winaero.com/blog/reset-local-security-policy-settings-all-at-once-in-windows-10/

3) Installed new user Test - with only membership in admin group and trying to install - the error still the SAME.

The log isn't verbose enough, if it's running command "gpresult /scope COMPUTER /f /X gpresult.xml" so it should be OK because in regular CMD it's OK with and admin user.

I just can't undestand.

Any help will be appreciated.

[TonyS]

Ok, thanks for trying these other steps.

Last one for you to try... download the CleanWipe file - https://support.symantec.com/us/en/article.howto74877.html

Run it - it will remove any traces of Symantec software that may be on your computer

Reboot and then try the installer again. Let's see how you get on with this.

[TonyS]

Very odd & puzzling!

Do you have another machine that you could test this on?

[Roman Adyev]

Thank you very much, Tony. 

I tried - same result but uninstallation went flawlessly.

I also tried intsllation in safe mode with enabling msi in command prompt - no joy and reinstalling Windows with keeping apps and data - no joy, absolutely same error.

Any ideas what's the crazy access is denied?

[TonyS]

Thanks, so you're able to verify that the installer itself is not corrupted and that it worked fine on a clean VM. Which is good.

Let's focus on the current machine that you're having issue with. But first, some questions...

* What is the operating system on it?

* What's the hardware spec

* What is installed on it?

* And how many are you planning to deploy the SEP client to (assuming you're going ahead with this)

[Roman Adyev]

Yes, I tried at new VM with same version of Windows - it installs without any error but if it's possible I can't reinstall that server because there will be huge downtime for critical business services.

Is there any chance to figure out what the access is denied? What provokes that or I have to negotiate about servers downtime?

[Roman Adyev]

Thank you very much Tony for your help and professinal assistance.

I tried to uninstall every app one by one and run setup after every uninstallation.

I spent two long nights to that procedure and fugured out the cause.

The problem was CryptoPro CSP 4.0 installed.

In some miraculous way it blocks Symantec not only to install but even to uninstall.

So I just upgraded CryptoPro CSP 4.0 to CryptoPro CSP 5.0 and now looks like the problem solved.

I still can't understand how CryptoPro is able to block access to GPOPolicyReview.

It was very tough to be honest.

[TonyS]

Thank you for the update and for sharing your findings, it will be helpful to others who might have similar issue. This is indeed strange, but glad you have figured it out and upgrading CryptoPro CSP to the latest version has resolved the issue!

All the best.