SEP Uninstallation fails with error UnprotectAMPPLService returned actual error code 1603
Article ID: 416577
Updated On:
Products
Issue/Introduction
When attempting to uninstall SEP from a system the uninstall fails and rolls back before completing.
The MSI uninstall log contains the following errors:
INFO Initializing am-ppl ipc client.
INFO Failed to send GUID_AMPPL_Unregister command. %!HRESULT!
INFO Failed to unregister AMPPL::Firewall hr: 0x80070005
INFO Sending GUID_AMPPL_StopService command.
INFO Initializing am-ppl ipc client.
INFO Failed to send GUID_AMPPL_StopService command
INFO Failed to unprotect and stop AMPPL service, aborting! 0x80070005
CustomAction UnprotectAMPPLService returned actual error code 1603
Cause
This happens due to delays when stopping the SepMasterService, which leads to the service being forcibly stopped before it is able to stop other protected services.
The protected services cannot be stopped by MSIExec (Windows Installer) due to their protection and this leads to the uninstall failure
The delay in stopping SepMasterService may be caused by the presence of an Application Control Exception that is configured for an unreachable network drive, when processing the exception, getting information about the network share takes too long and causes the timeout.
Resolution
Removing any Application Control exception for network shares resolves the issue.
The behavior will be addressed and resolved in SEP 14.4
Feedback
