Agent uninstall results in a 1603 error code

Products

• Data Loss Prevention Endpoint Discover
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention
• Data Loss Prevention Core Package
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Plus Suite

Issue/Introduction

Windows Installer removed the product. Product Name: AgentInstall-x64. Product Version: 16.1.00100.60108. Product Language: 1033. Manufacturer: Symantec Corp.. Removal success or error status: 1603.

Environment

Windows

Cause

This is caused by corrupted .EAD files (sto.ead, ks.ead)
These files are responsible for storing the uninstall password, and when showing as zero byte files, that means we cannot perform the uninstallation.

 

You should also see the following error in the uninstall.log...

ERROR: Failed to read UninstallPassword, check if Keystore database is in correct state.

CustomAction CheckUninstallPassword returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

Action ended 14:13:19: CheckUninstallPassword. Return value 3.

This corruption may be caused by missing AV/Security application exclusions. See DLP Endpoint Agents with Antivirus Protection

Resolution

1. Copy the "sto.ead" and "ks.ead" files from a known good working agent that is using the same package.
2. Reattempt the uninstall