This is a list of the most commonly used MSI commands for Symantec Endpoint Protection (SEP) and Symantec Network Access Control (SNAC).
Default is C:\Program Files\Symantec\Symantec Endpoint Protection (32-bit) or C:\Program Files (x86)\Symantec\Symantec Endpoint Protection (64-bit)
Note: On SEP products prior to version 12.1.671.4971, use:
1 - On (default)
0 - Off
Setaid.ini is primarily used in installations exported from the Symantec Endpoint Protection Manager. Setaid.ini values always take precedence. The installation uses the following settings:
Note: This setting pertains to maintain existing settings in the package creation tab.
For more information on which features these values represent and their dependencies, see "Symantec Endpoint Protection client features" linked in the Related Articles section.
For more information on what these features represent and their dependencies, see "SEP 11.x Features" below.
Note: These properties apply to unmanaged clients only.
Allows an administrator of a non-managed network to configure the WindowsSecurityCenterControl value.
Allows an administrator of a non-managed network to configure the AntiVirusDisableNotify value for Windows Security Center.
Allows an administrator of a non-managed network to configure the FirewallDisableNotify value for Windows Security Center.
Allows an administrator of a non-managed network to configure the number of days used to determine if threat definitions are up to date for Windows Security Center.
To add new features:
Note: When adding new features using
For instructions on how to silently remove Symantec Endpoint Protection, see Related Articles.
When run from the setup.exe stub, Symantec Endpoint Protection (SEP), Symantec Network Access Control (SNAC), and Symantec Endpoint Protection Manager (SEPM) automatically create installer logs to the %TEMP% folder (e.g. C:\Documents and Settings\USERNAME\Local Settings\Temp) named either SEP_INST.LOG, SNAC_INST.LOG or SEPM_INST.LOG respectively.
When the installers are run from either the Client Deployment Wizard (SEP 12.1.x), the Push Deployment Wizard or when upgrades are deployed to client groups from the SEPM, the installer logs are automatically created in the %WINDIR%\temp folder (e.g. C:\WINDOWS\temp).
These installer logs are vital in determining which installer failures are installed.
Please have these logs available when contacting Symantec Support.
Note: Localized operating systems may have slightly different folders for the log files. You can determine what these paths actually are by following the below steps:
Important consideration when selecting features
As documented in our installation guide, we have a number of dependencies when it comes to the selection of features in the SEP client installation. Specifically: "COHMain and DCMain require two parents. COHMain is Proactive Threat Scan and requires PTPMain and SAVMain. DCMain, which is Application and Device Control, requires PTPMain and ITPMain."
The MSI installer will not compensate for these dependencies, and any lacking feature not only will result in a broken installation, but MSIEXEC will not return any fault condition on the missing components.
The diagram below shows the various dependencies: