Event 1005 logged after SEPM Install or Upgrade, Though no Prompt for Reboot is Displayed

Products

• Endpoint Protection

Issue/Introduction

Upgrading the SEPM from MR4 to MR4 MP1 does not seem to require a reboot. (Service and console come up and work without trouble.) However, in the Windows Application Event log, there is always an Event ID 1005 logged. Does the SEPM computer actually need a reboot, or not?

Symptoms
Type: Information

Date: 1/20/2009
Time: 5:42:29 PM
Event: 1005
Source: MsiInstaller
Category: None
User: \S-1-5-21-2920048690-3115618796-353437041-500
Computer: SERVERNAME
Description: The Windows Installer initiated a system restart to complete or continue the configuration of 'Symantec Endpoint Protection Manager'.

Cause

This entry is logged because a file that is replaced during the upgrade (secars.dll) is also being held by MS Internet Information Services (IIS). This usually requires a reboot, though during the SEPM upgrade the file is successfully replaced regardless.

Resolution

This "The Windows Installer initiated a system restart" event log entry may safely be ignored. The server does not require a reboot in order for the SEPM to function correctly.



Technical Information
If IIS is stopped prior to the upgrade, the log entry will not be made. However, this will result in a loss of connectivity to the SEP clients until IIS is restarted..