Fails to execute Host Integrity check on ARM Processor systems. Error Type: 0x00200001, Error Code: 0xFFFFFFFF

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection (SEP) client fails to execute Host Integrity check on ARM Processor systems.

Security Log shows: Fail to execute Host Integrity check. Error Type: 0x00200001, Error Code: 0xFFFFFFFF

WPP log: 

[04/28/2026-14:15:50.108] SepManagementClient : 1420 : 2420 : TRACE_DEBUG : TRACE_LEVEL_INFORMATION : SEP::CWPPLog::TraceFunc : WPPLog_cpp50 :HI: Fail to execute HI (2097153) -> HI Script exit abnormally, Exit Code: 4294967295
[04/28/2026-14:15:50.110] SepManagementClient : 1420 : 2420 : TRACE_DEBUG : TRACE_LEVEL_INFORMATION : SEP::CWPPLog::TraceFunc : WPPLog_cpp50 :HI: CFailExeHIHandler::IncreaseFailedTime report EXE_HI_FAIL.
[04/28/2026-14:15:50.112] SepManagementClient : 1420 : 2524 : TRACE_DEBUG : TRACE_LEVEL_INFORMATION : SEP::CWPPLog::TraceFunc : WPPLog_cpp50 :Received command ID [18]!
[04/28/2026-14:15:50.112] SepManagementClient : 1420 : 2420 : TRACE_DEBUG : TRACE_LEVEL_INFORMATION : SEP::CWPPLog::TraceFunc : WPPLog_cpp50 :HI: Host Integrity check failed.  Reason : 108
[04/28/2026-14:15:50.112] SepManagementClient : 1420 : 2420 : TRACE_DEBUG : TRACE_LEVEL_INFORMATION : SEP::CWPPLog::TraceFunc : WPPLog_cpp50 :HI: HI result is updated. Result: 1 , Reason: 108 , Description: Fail to execute Host Integrity check , Timestamp: 13421830550

Environment

SEP 14.3 RU10
Windows 11 (ARM 64 Processor)

Cause

Windows 11 ARM changed the x64-emulation behavior. When a native ARM64 process (cscript.exe) is spawned from an x64-emulated parent process chain (ccSvcHst.exe (x64) ->sghi.dll (x64) -> CreateProcess[AsUser]), the new ARM64 process can no longer load native ARM64 COM DLLs (SSHelperArm64.dll). 

Resolution

The fix will be available in SEP 14.5 version.

There are no known workarounds for now.