Firewall malfunctioning after installing Endpoint Protection on Windows 7

Products

• Endpoint Protection

Issue/Introduction

After you install Symantec Endpoint Protection (SEP) on Windows 7 Service Pack 1 (SP1), the client GUI shows the Firewall is malfunctioning.

TeeferInstall.log shows:​

2019-08-30 16:11:04 Release write lock for 'Symantec Firewall' 
2019-08-30 16:11:04 Start to query teefer service status. 
2019-08-30 16:11:04 OpenService Teefer2 failed. GetLastError(): 1060 
2019-08-30 16:11:04 Teefer install failed, trying once more in 5 seconds 2019-08-30 16:11:09 Found 'oem132.inf' 
2019-08-30 16:11:09 Uninstalling 'oem132.inf' 
2019-08-30 16:11:10 Find residual registry key SYSTEM\CurrentControlSet\Services\teefer2, delete it succeeded. 
2019-08-30 16:11:10 ERROR: No instance guid found. 
2019-08-30 16:11:10 Check the service database lock status. 
2019-08-30 16:11:10 The service database is unlocked. 
2019-08-30 16:11:10 Acquired write lock for 'Symantec Firewall' 
2019-08-30 16:11:11 ERROR: Call to installNetComponent() failed: 0x8004a029 
2019-08-30 16:11:11 Release write lock for 'Symantec Firewall' 
2019-08-30 16:11:11 Start to query teefer service status. 2019-08-30 16:11:11 OpenService Teefer2 failed. GetLastError(): 1060 
2019-08-30 16:11:11 InstallFirewall failed second attempt: 0x8004a029

Environment

• SEP for Windows (any version)

Cause

Windows 7 features the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\MaxNumFilters registry key, which allows to limit the number of concurrent network filter drivers. By default, this is set to 8, but it can be changed at will. The attempted installation of any more filter drivers over the configured maximum will lead to Windows' network configuration interface (INetCfg) failing the operation.

 

Resolution

Increase MaxNumFilters to a number higher than 8 or delete the key, which will enable a maximum of 14 network filter drivers to be loaded concurrently.