The Windows agent installation failure by denied to access AMSI registry.

Products

• Endpoint Security Complete

Issue/Introduction

The Windows agent of Symantec Endpoint Security (SES) failed to install to Windows 10. 
The installation was rollback during install script to change the registry.

SIS_INST.LOG

2024-03-21T07:55:25.917Z INFO  I SIS    Executing action ( 2692 ) - CreateRegistryKey  currentPosition: 1074492
2024-03-21T07:55:25.917Z INFO  I SIS      KEY_NAME=[Software\Microsoft\AMSI\Providers\{96237786-C89D-4504-837A-A3BA2C29524D}]
2024-03-21T07:55:25.917Z ERROR I SIS        RegistryCreateKey() failed. Status: 0xC0000022 =

{Access Denied} A process has requested access to an object but has not been granted those access rights.

2024-03-21T07:55:25.917Z ERROR I SIS         
2024-03-21T07:55:25.917Z ERROR I SIS        Dumping action parameters from the script:
2024-03-21T07:55:25.917Z ERROR I SIS          Exists=[Overwrite]
2024-03-21T07:55:25.917Z ERROR I SIS          WOW64=[Default]
2024-03-21T07:55:25.917Z ERROR I SIS          Key=[HKLM\Software\Microsoft\AMSI\Providers\{96237786-C89D-4504-837A-A3BA2C29524D}]

Environment

14.3 RU8 agent
Windows 10 22H2

Resolution

Before SES agent installation, please change the settings for Windows tamper protection to 'OFF' as disable. 

Prevent changes to security settings with Tamper Protection