Error 1603 during DLP agent install when stopping the vfsmfd driver

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

When attempting to uninstall an old Data Loss Prevention (DLP) agent and install a new DLP agent, the error 1603 occurs when stopping the vfsmfd driver.

You will also see the following warnings in the installAgent.log file.

2019-10-08 22:32:12 | PreInstallCleanup | FINE | StopDriver(): attempting to stop: vfsmfd
2019-10-08 22:32:32 | PreInstallCleanup | INFO | makeServiceStop(): Sleeping before retrying...
2019-10-08 22:32:32 | PreInstallCleanup | WARNING | makeServiceStop(): ControlService() failed: The requested control is not valid for this service. 
2019-10-08 22:32:32 | PreInstallCleanup | WARNING | StopDriver( vfsmfd ): makeServiceStop() failed.
MSI (s) (D0!9C) [22:32:32:365]: Product: AgentInstall-x64_15_5 -- 2019-10-08 22:32:32 | PreInstallCleanup | SEVERE | FindAndRemoveDriver( vfsmfd ): The driver service could not be stopped.  The machine needs to be rebooted before install can proceed.
2019-10-08 22:32:32 | PreInstallCleanup | SEVERE | FindAndRemoveDriver( vfsmfd ): The driver service could not be stopped.  The machine needs to be rebooted before install can proceed.
2019-10-08 22:32:32 | PreInstallCleanup | FINE | findDriverInfFiles( vfsmfd.inf ): found 0 .INF file(s) under 'C:\Program Files\Windows\D56\'
MSI (s) (D0!9C) [22:32:32:370]: Product: AgentInstall-x64_15_5 -- 2019-10-08 22:32:32 | PreInstallCleanup | SEVERE | deleteAgentService( vfsmfd ): the service was already marked for delete: The operation completed successfully. 
2019-10-08 22:32:32 | PreInstallCleanup | SEVERE | deleteAgentService( vfsmfd ): the service was already marked for delete: The operation completed successfully. 
MSI (s) (D0!9C) [22:32:32:373]: Product: AgentInstall-x64_15_5 -- 2019-10-08 22:32:32 | PreInstallCleanup | SEVERE | cleanFile( C:\WINDOWS\system32\drivers\vfsmfd.sys ): file was found but could not be deleted: Access is denied. 
2019-10-08 22:32:32 | PreInstallCleanup | SEVERE | cleanFile( C:\WINDOWS\system32\drivers\vfsmfd.sys ): file was found but could not be deleted: Access is denied. 

Resolution

There are two solutions to this issue.

• Restart the client machine and retry the install
• Run the following command, and then retry the install
  
  fltmc unload vfsmfd
  fltmc unload vrtam
  fltmc unload vnwcd
  fltmc unload vfsenc