Client uninstallation failure/rollback - StopSaepServices error 1603

Products

• Endpoint Protection

Issue/Introduction

While trying to uninstall SEP client with PowerShell uninstallation command (Get-WmiObject -Class Win32_Product -Filter "Name='Symantec Endpoint Protection'" -ComputerName . ).Uninstall() uninstallation fails and rollback is automatically triggered. In the command output you can see ReturnValue : 1603.

In the MSI uninstallation log you can find the following entries:

MSI (s) (B0:10) [10:12:06:488]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI920F.tmp, Entrypoint: StopSaepServices
DEBUG StopSaepServices begin.
INFO Running in install mode
INFO Service heCAF is stopping, waiting...
ERROR WaitForSingleObject: timeout. Error code: 1460: This operation returned because the timeout period expired.
DEBUG StopSaepServices end, return value: 1603.
CustomAction StopSaepServices returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

Environment

SEP 14.3 MP1

Cause

The heCAF service is busy retrying, it cannot respond to any service stop requests. As a result, the SEP uninstallation times out after 30 seconds.

This is fixed in SEP 14.3 RU2.

Resolution

Upgrade to SEP 14.3-RU2 to get the fix for an error in CAF service.

Workaround:

1. Change the heCAF start type to 4 (Disabled)
2. Reboot the computer.
3. After reboot, confirm that the heCAF service is stopped.
4. Then, try to uninstall SEP client again.

Path for the required registries to edit:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\heCAF
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SISIDSService
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SISIPSService
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SISIPSUtil