Endpoint Protection Manager upgrade quits during schema upgrade

Products

• Endpoint Protection

Issue/Introduction

You are upgrading the Symantec Endpoint Protection Manager (SEPM) to 14.3 MP1. During the upgrade, you receive the notification "Server Schema is newer than database schema. Upgrade wizard needs to run to bring the schemas into sync. Remember to run Server Configuration Wizard after the upgrade wizard completes. Run the upgrade wizard now?" 

After selecting "Yes", a DOS window briefly appears, then you are returned to the desktop. 

Running `upgrade.bat` from the Symantec Endpoint Protection Manager\bin directory has the same result. 

Environment

Upgrading from SEPM 14.2 RU2 to 14.3 MP1. 

This can affect other upgrade paths as well (i.e. 14.3 MP1 to 14.3 RU3)

Cause

FIPS mode is enabled.

Resolution

Disable the FIPS-compliant Java libraries and re-run the upgrade wizard:

1. To disable FIPS, navigate to the bin folder and double-click the FIPSMode-Disable.bat file (\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin).
   
   
2. Once FIPS is disabled, run the SEPM upgrade wizard (upgrade.bat) again from path: \Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin.
   NOTE: If when upgrade.bat is ran and the SEPM upgrade wizard doesn't come up, then open cmd.exe as Administrator and then navigate to the same above path and run it again. This will show more details. 
   
   If this still doesn't happen, then something in the environment is preventing upgrade.bat from running properly. To resolve, check your environment and allow the batch file to execute.
   
   If you still have issues kindly open a case with Support for further assistance.   
   
   After completion of the upgrade, FIPS can be re-enabled as follows:
   
   
3. To re-enable FIPS, Navigate to the bin folder (\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\bin) and double-click the FIPSMode-Enable.bat file.

Additional Information

When checking the Upgrade-0.log under SEPM\Tomcat\Logs, you may see these log entries: 

Exception in thread "Upgrade" 
java.lang.NoClassDefFoundError: com/rsa/jsafe/provider/JsafeJCE
 	at com.sygate.scm.server.util.RecoveryData.composeRecoveryDataFile(RecoveryData.java:621)
 	at com.sygate.scm.server.upgrade.ui.Main.createRecoveryFile(Main.java:1083)
 	at com.sygate.scm.server.upgrade.ui.Main.executePreLaunchSteps(Main.java:682)
 	at com.sygate.scm.server.upgrade.ui.Main.(Main.java:563)
 	at com.sygate.scm.server.upgrade.ui.Main.main(Main.java:1351)
 Caused by: java.lang.ClassNotFoundException: com.rsa.jsafe.provider.JsafeJCE
 	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581)
 	at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
 	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
 	... 5 more