Symantec Endpoint Protection Manager (SEPM) reports error "LiveUpdate finish with Return code = 4" and LU error 1875, 1845, 1853, 1806 are present in Log.LiveUpdate.

book

Article ID: 177446

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

After migration / upgrade from SAV 10.x to Symantec Endpoint protection, LiveUpdate finish with Return code = 4 . In Log.LiveUpdate you see errors LU 1875, 1845, 1853, 1806.

Previously with SAV 10.x all updates were downloaded and applied correctly.

Symptoms
On SEPM Console, you see error: "Error: LiveUpdate encountered one or more errors. Return code = 4"


In Log.LiveUpdate you see:

03/12/2008, 16.17.12 GMT -> The WelcomeText callback for product SESM AntiVirus Client Win32 completed with a result of 0x80070005
03/12/2008, 16.17.12 GMT -> LiveUpdate aborted product SESM AntiVirus Client Win32 for the following reason (error code 1875), Errore durante la fase di pre-elaborazione del testo di benvenuto
03/12/2008, 16.17.12 GMT -> LiveUpdate has called the last callback for product SESM AntiVirus Client Win32, so LiveUpdate is informing the callback proxy that it can exit.


03/12/2008, 16.17.57 GMT -> LiveUpdate couldn't expand replacement path [sesmDecAbi32updateDir].
03/12/2008, 16.17.57 GMT -> Progress Update: PATCH_ERROR: Patch File: "C:\Documents and Settings\All Users\Dati applicazioni\Symantec\LiveUpdate\Downloads\Updt179\1203515784jtun_the_updecabi.zip.full.zip", Script File: "C:\Documents and Settings\All Users\Dati applicazioni\Symantec\LiveUpdate\Downloads\Updt179\sesmDecAbi32.dis", HR: 0x802A0006
03/12/2008, 16.17.57 GMT -> HR 0x802A0006 DECODE: E_DIS_SCRIPT_SYNTAX_ERROR
03/12/2008, 16.17.57 GMT -> Progress Update: PATCH_FINISH: Patch File: "C:\Documents and Settings\All Users\Dati applicazioni\Symantec\LiveUpdate\Downloads\Updt179\1203515784jtun_the_updecabi.zip.full.zip", Script File: "C:\Documents and Settings\All Users\Dati applicazioni\Symantec\LiveUpdate\Downloads\Updt179\sesmDecAbi32.dis", HR: 0x802A0006
03/12/2008, 16.17.57 GMT -> HR 0x802A0006 DECODE: E_DIS_SCRIPT_SYNTAX_ERROR

03/12/2008, 15.44.15 GMT -> EVENT - PRODUCT UPDATE FAILED EVENT - Update available for Catalogo del contenuto di Symantec Endpoint Protection Manager 11.0 - 11.0 - SymAllLanguages. Update for takes product from update 0 to . Server name - , Update file - , Signer - , package install code 0. The Update executed with a result code of 1845, => Aggiornamento interrotto durante l'elaborazione di pre-sessione di LiveUpdate. È molto probabile che questo errore sia causato da una sottoscrizione scaduta.
03/12/2008, 15.44.15 GMT -> Product = SESM AntiVirus Client Win32, Version = 11.0.0, and Language = English was aborted from this LiveUpdate session.
03/12/2008, 15.44.15 GMT -> Reason for product being aborted => Errore durante la fase di pre-elaborazione del testo di benvenuto

03/12/2008, 15.44.15 GMT -> EVENT - PRODUCT UPDATE FAILED EVENT - Update available for Symantec Endpoint Protection Win32 11.0.0 (inglese) - 11.0.0 - English. Update for takes product from update 0 to . Server name - , Update file - , Signer - , package install code 0. The Update executed with a result code of 1853, => Si è verificato un errore interno durante il recupero degli aggiornamenti.
03/12/2008, 15.44.15 GMT -> Product = SESM AntiVirus Client Win64, Version = 11.0.0, and Language = English was aborted from this LiveUpdate session.
03/12/2008, 15.44.15 GMT -> Reason for product being aborted => Errore durante la fase di pre-elaborazione del testo di benvenuto

03/12/2008, 15.44.16 GMT -> EVENT - SESSION END FAILED EVENT - The LiveUpdate session ran in Silent Mode. LiveUpdate found 23 updates available, of which 0 were installed and 23 failed to install.
The LiveUpdate session exited with a return code of 1806, Tutti gli aggiornamenti richiesti sono stati scaricati, ma è stato impossibile installarli.

In English: "The LiveUpdate session exited with a return code of 1806, LiveUpdate downloaded all of the updates you requested, but was unable to install any of them."

Cause

One possible cause is that the computer's DCOM settings are not correct for usage with Symantec Endpoint Protection updates.

Resolution

Follow the steps Checking DCOM settings.



Technical Information
User/Permission can be checked with TestSEC - TECH105027.


In case some user/permission are wrong, will be reported in Testsec.log :

Scan Started 04/12/2008 (10.02.12) on SERVER
-------------------------------------------------
Environment: Microsoft Windows Server 2003 Service Pack 2
Administrators is missing in the access permissions for DCOM.
SYSTEM is missing in the access permissions for DCOM.
INTERACTIVE is missing in the access permissions for DCOM.
DCOM Default Impersonation Level is not set to Identify.
-------------------------------------------------
Scan Finished (10.02.15)