Agent uninstall results in a 1603 error code

Products

• Data Loss Prevention Endpoint Discover
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention
• Data Loss Prevention Core Package
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Plus Suite

Issue/Introduction

Windows Installer removed the product. Product Name: AgentInstall-x64. Product Version: 16.1.00100.60108. Product Language: 1033. Manufacturer: Symantec Corp.. Removal success or error status: 1603.

Environment

Windows

Cause

This is caused by corrupted .EAD files (sto.ead, ks.ead)
These files are responsible for storing the uninstall password, and when showing as zero byte files, that means we cannot perform the uninstallation.

 

You should also see the following error in the uninstall.log...

ERROR: Failed to read UninstallPassword, check if Keystore database is in correct state.

CustomAction CheckUninstallPassword returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

Action ended 14:13:19: CheckUninstallPassword. Return value 3.

 

Resolution

This can be resolved by copying the "sto.ead" and "ks.ead" files from a known good working agent that is using the same package, or a package created by the same Enforce Server. Once you have the valid files in place with a known password you should be able to uninstall DLP Normally.