Error: "SEP Installation failed with error code 1603"

Products

• Endpoint Protection
• Endpoint Security

Issue/Introduction

The Symantec Endpoint Protection (SEP) client installation rolls back (rollback) or fails during a fresh installation or upgrade.  An error code of 1603 is displayed or in the SEP_inst.log the follow error message is found.

ScriptGen: ShowServiceProgress() script execution failed.
ScriptGen: ShowServiceProgress() reset script failure event.
ScriptGen: ShowServiceProgress() is returning an error (so close to the end!)
CustomAction ShowServiceProgress returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 14:39:35: InstallFinalize. Return value 3.

Environment

• Symantec Endpoint Protection 14.x
• Symantec Endpoint Security

Cause

Error code 1603 is a generic installation error message and can have several different causes, however permissions issues is the most common for this particular set of errors.

Permissions on C:\Program Files\Symantec\Symantec Endpoint Protection\, and %temp% (%systemdrive%\Windows\Temp. %userprofile%\AppData\Local\Temp) are not sufficient to run the proper install/upgrade scripts.

Resolution

1. If third-party deployment software is used, make sure the user context for the execution has full administrative rights. If using the SEPM upgrade methods, the System account must have full administrative rights to the proper folders:
   
   • C:\Program Files\Symantec\Symantec Endpoint Protection\
   • %temp%
   • %systemdrive%\Windows\Temp
   • %userprofile%\AppData\Local\Temp
2. If permission changes do not help, see the below details.
3. Ensure that all tasks to prepare the device for deployment have been completed.
   
   Preparing Windows and Mac computers for remote deployment
   
   This includes:
   
   • Having administrative rights.
   • Modifying firewall settings.
   • Removing an existing third-party security software.
   • Uninstalling any SEP clients that do not uninstall normally. (CleanWipe)
   • Uninstalling unsupported or consumer Symantec security software.
   • Making any OS specific changes.
4. If the installation still fails with a 1603, further details about the installation failure are logged in SIS_INST.log located in the following directory.
   C:\ProgramData\Symantec\Symantec Endpoint Protection\14.#.###.####\Data\Install\Logs
   
   For a complete list of SEP installation logs used to troubleshoot installation failures see: Required logs for troubleshooting failed Endpoint Protection 14.x client installations.
5. A SymDiag can also be used to detect common problems causing installation failures using the Self-Help option. See: Download SymDiag to detect product issues for more details.