The Symantec Endpoint Protection (SEP) 14.3 Windows client may fail to install on Windows 7 or Windows Server 2008 unless SHA-2 code signing support is installed. Both first time client installations and upgrades may fail.
Error: Symantec Endpoint Protection can only be installed on systems with SHA-2 code signing support update (KB4474419).
Endpoint Protection Version
Lack of SHA-2 support for legacy operating systems, or unsupported OS.
Install SHA-2 code signing support on legacy operating systems by visiting the site below.
This issue may also occur if you attempt to install a newer client than is supported for the OS. Check the compatibility matrix to confirm.
Windows compatibility with Symantec Endpoint Protection clients (broadcom.com)