Symantec Critical System Protection agent upgrade fails with error 1260.

Products

• Data Center Security Server Advanced

Issue/Introduction

Symantec Critical System Protection agent upgrade from an older version to a newer version fails with error 1260 if Microsoft hotfix 2918614 is installed on the windows agent.

Error 1260: Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system Administrator.

Resolution

Microsoft has released security bulletin MS14-049. This bulletin contains information about the known issues with the Security update for Windows Installer Service. The bulletin provides workaround which is mentioned below. 

 

To resolve this issue perform the following steps as per one of the option provided by Microsoft in the above KB article. To know more options please visit http://support.microsoft.com/kb/2918614.

 

Note: Ensure that you follow the procedure carefully. If you modify the registry incorrectly, you may face critical problems.   For added protection, back up the registry before you modify it. 

 

To modify the registry:

 

1. Click Start > Run.

2. Type regedit, and then click OK. 

3. Locate and then click the following subkey in the registry: 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer 

4. Click Edit > New > DWORD Value. 

5. Type SecureRepairPolicy for the name of the DWORD, and then press Enter.

6. Right-click SecureRepairPolicy, and then click Modify. 

7. In the Value data box, type 2, and then click OK.

8. Locate and then click the following subkey in the registry: 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer 

9. Click Edit > New > Key. 

10. Type SecureRepairWhitelist for the name of the key, and then press Enter.

11. Double-click the SecureRepairWhitelist key to open it.

12. Click Edit > New > String Value. Create String Values that contain the product codes (including braces {}) of the products that have to be added to the Safe Recipients list. 

 

Note: For more information on how to obtain the product code, see ‘To obtain the product code’ below.

 

The NAME of the String Value is the "product code" and the VALUE can be left blank. 

 

For example:

 

To obtain the product code:

 

1. Click Start > Run.

2. Type regedit, and then click OK. 

3. In the left pane, locate the following key in the registry:

a. For 32 bit Windows HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

b. For 64 bit Windows HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall

4. The Uninstall key displays the list of products installed on the machine.

5. Use the Find... option on the Uninstall key to search for the product key. Specify the search filter as “Symantec Critical System Protection Agent”.

6. On the right-hand pane, the search result appears. The product code appears in the Data column of the UninstallString / ModifyPath. The product code is highlighted in the screenshot below: