SEP to SES Upgrade: Client File Remnants Visible Before Reboot

Products

• Endpoint Security Complete
• Endpoint Protection

Issue/Introduction

After a successful upgrade from On Prem SEP 14.3 RU6 to SES cloud v14.3 RU9 and before a system reboot, remnants of the previous version of client are still visible in the following directories, unexpectedly: 

• C:\Program Files\Symantec\Symantec Endpoint Protection
• C:\ProgramData\Symantec\Symantec Endpoint Protection

Environment

Symantec Endpoint Protection (SEP) 14.3x and later
Symantec Endpoint Security (SES) 14.3x and later

Cause

 

Resolution

We are aware of this behavior and SEP is working as designed. 

For more technical details see the below:

In this scenario, the behavior is a side effect of using MoveFileEx with the MOVEFILE_DELAY_UNTIL_REBOOT flag, as documented here: https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-movefileexa.
This occurs because the client is unable to remove files that are currently in use and cannot be unloaded dynamically. 

Please note that the installer does not require a reboot in this situation. We have determined that it is safe to use the system despite some files being locked or in use. Furthermore, our testing has proven that no interoperability issues are encountered when running these files alongside the upgraded SEP version.

Additional Information

CRE-23717