Removal of Endpoint Protection client fails with error code 1603.

Products

• Endpoint Protection

Issue/Introduction

- There is a need to remove the SEP client on some machines or servers, but during the removal, the SEP client uninstall fails and starts a rollback with error code = 1603.

MSI (s) (B4:30) [14:11:12:277]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIC360.tmp, Entrypoint: StopSMC
stopProtectedService: Attempting to stop SmcService
stopProtectedService: Unloading BASH driver...
stopProtectedService: Failed to unload BASH with HRESULT=0x80070005
CustomAction StopSMC returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (B4:C0) [14:11:12:667]: User policy value 'DisableRollback' is 0
MSI (s) (B4:C0) [14:11:12:667]: Machine policy value 'DisableRollback' is 0
Action ended 14:11:12: InstallFinalize. Return value 3.

Cause

You need to remove the SEP client on some machines, but cannot use the Symantec CleanWipe utility for removal of SEP clients.

Resolution

- Follow the procedures below and remove the SEP client after stopping these SEP services.

1- Open CMD

2 - Type the command lines:

 taskkill /pid smc.exe /f
 taskkill /pid ccSvcHst.exe /f

3 - Once the SEP client services have stopped, rerun the removal.

NOTE: The SC command line did not worked for stop the SEP services. <sc stop SepMasterService>

Applies To

Windows 2008 R2 - x64