Symantec Endpoint Protection client installation rolls back while trying to start IPS driver, or IPS definitions fail to update

Products

• Endpoint Protection
• Endpoint Security

Issue/Introduction

The installation or upgrade of Symantec Endpoint Protection 12.1 or 14.x rolls back while trying to start the Intrusion Prevention driver, or IPS definitions fail to update.

SIS_INST.LOG

2016-11-01T07:24:14.492Z INFO  I SIS    Executing action ( 4457 ) - StartService  currentPosition: 1980244
2016-11-01T07:24:14.523Z INFO  I SIS      [StartService] QueryServiceStatusEx() for service 'IDSVia64' returned ssp.dwCurrentState: 0x00000001
2016-11-01T07:24:14.695Z ERROR I SIS      [StartService] StartService() failed for service 'IDSVia64' with error 0x00000003.
2016-11-01T07:24:14.695Z INFO  I SIS      [StartService] QueryServiceStatusEx() for service 'IDSVia64' returned ssp.dwCurrentState: 0x00000001
2016-11-01T07:24:14.695Z INFO  I SIS      [StartService] QueryServiceStatusEx() for service 'IDSVia64' returned SERVICE_STOPPED or 
SERVICE_STOP_PENDING - will fail the action!

Event Viewer:

Event ID 7000

"The IDSVia64 service failed to start due to the following error: 
The operation completed successfully. (0x00000003)"

SEP System Log:

The latest Intrusion Prevention Signatures update failed to load. The component will continue to use its previous content.	

 

Cause

This can occur if case sensitivity for files and folders has been enabled in Windows. The setting is controlled by HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\obcaseinsensitive. 

Resolution

Disable case sensitivity by changing the value for obcaseinsensitive to 1 and rebooting the computer.