Endpoint Protection service does not start after a failed upgrade
Article ID: 212159
Updated On:
Products
Issue/Introduction
Upgrade of Symantec Endpoint Protection (SEP) agent failed on a system, after that SEP service does not start on it.
Following error is found in install log (C:\ProgramData\Symantec\Symantec Endpoint Protection\<version>\Data\Install\Logs\SIS_INST.log):
2026-06-01T03:48:32.240Z INFO I SIS CopyFile Action - C:\ProgramData\Symantec\Symantec Endpoint Protection\14.3.12167.10000.105\NonTransactedTemp\file1 -> C:\ProgramData\Symantec\Symantec Endpoint Protection\14.3.12167.10000.105\Data\Config\symresolver.dat2026-06-01T03:48:32.240Z INFO I SIS CopyFile: target is a file.2026-06-01T03:48:32.240Z DEBUG I SIS DeleteFileAction: target exists, using CopyFile action to save it to temp area: C:\ProgramData\Symantec\Symantec Endpoint Protection\14.3.12167.10000.105\Data\Config\symresolver.dat2026-06-01T03:48:32.240Z INFO I SIS CopyFile Action - C:\ProgramData\Symantec\Symantec Endpoint Protection\14.3.12167.10000.105\Data\Config\symresolver.dat -> C:\ProgramData\Symantec\Symantec Endpoint Protection\14.3.12167.10000.105\TransactedTemp\Folder1\file162026-06-01T03:48:32.240Z WARN I SIS openImpl Failed to create file. [\??\C:\ProgramData\Symantec\Symantec Endpoint Protection\14.3.12167.10000.105\Data\Config\symresolver.dat] Status: 0xC0000043 = A file cannot be opened because the share access flags are incompatible. . Retrying...
Resolution
This issue is primarily observed on legacy Windows OS clients.
Possible workarounds:
- If you run Windows OS upgrade (e.g. Windows 10 upgrade to later version) and SEP client upgrade at the same time, separate these upgrades.
- Once the issue happens, run the Cleanwipe tool to uninstall SEP client then install.
You may also need to install the required certificates as per below article if missing on the problematic system
The installer integrity check failed with error code 0x80070057 when attempting to install the Endpoint Protection client
Feedback
