[Resolved] McAfee endpoint security update failed, Why?

McAfee product installation or upgrade fails, updates with nnnnxdat.exe or V3_nnnndat.exe packages fail, or fields do not populate (due to missing root certificates)

ENVIRONMENT

• McAfee Active Response (MAR) 2.x
• McAfee Agent (MA) 5.x
• McAfee Application and Change Control (MACC) 8.x
• McAfee Data Exchange Layer (DXL) 6.x, 5.x
• McAfee Data Loss Prevention Endpoint (DLP Endpoint) 11.x
• McAfee Endpoint Intelligence Agent (EIA) 2.x
• McAfee Endpoint Security (ENS) Firewall 10.x
• McAfee ENS Platform (Common) 10.x
• McAfee ENS Threat Prevention 10.x
• McAfee ENS Web Control 10.x
• McAfee Host Intrusion Prevention (Host IPS) 8.0
• McAfee Threat Intelligence Exchange Module (TIEm) for VirusScan Enterprise 1.x
• McAfee VirusScan Enterprise (VSE) 8.8

PROBLEM

In case of failure of any of the products that is listed on the environment section, above.

There is a possibility that a failure may occur during the installation or upgradation process of the endpoint security program. The failure might pose a threat to the health of the installation or upgradation process of your endpoint security program’s modules.

The following errors have been reported.

!> Error – SysCore install failed: 255
<= leave custom action Install_SysCore()
CustomAction Install_SysCore returned actual error code 1603 (Note: This code might not be 100% accurate if translation happened inside sandbox)
Fin de la acción 12:28:11: InstallExecute. Return value 3.
MSI (s) (98:70) [12:28:11:908]: Note: 1: 2265 2:  3: -2147287035

McAfee Endpoint Security Upgrade Failed

>> Installing SysCore: “C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\x64\mfehidin.exe” -i VSE88P9 -q -mfetrust_killbit –oastrust_off -l “C:\Users\asmith\AppData\Local\Temp\McAfeeLogs\vse8.8.0.core_install_060517_163652.log” -etl “C:\Users\asmith\AppData\Local\Temp\McAfeeLogs\vse8.8.0.core_install_060517_163652.etl” -x vse.xml OAS ELAM AAC DiskFilter firecore_driver EmailScan ScriptScan
!> Error – SysCore install failed: 255
<= leave custom action Install_SysCore()
CustomAction Install_SysCore returned actual error code 1603 (Note: This code might not be 100% accurate if translation happened inside sandbox.)
Action ended 16:37:58: InstallExecute. Return value 3.
 

VSE vse8.8.0.core_install_xxxxxx_xxxxxx.log:

parseCertificate: CertAddSerializedElementToStore failed 80070005

Or:

[16:36:53:578] – StartStopMFeServices: stopping
[16:36:53:578] – StartStopAllMMSServices: start=false
[16:36:53:594] – StartStopAllMMSServices: ERROR! MmsControlCreate failed with -2146869243
[16:36:53:594] – StartStopAllMMSServices: exit=0

How to Solve McAfee Endpoint Security Errors

[11:04:49:893] – ERROR! Signature check failed
[11:04:49:893] – ValidateDocument: return=0
[11:04:49:893] – ERROR! While validating document

[11:04:49:893] – StartHIP: policy disable 0 service stopped 0

[11:04:49:893] – Returning 4294967295
 

ENS McAfee_Common_VScore_Install_date/time.log:

AAC is not installed. Err=-2146869243
ERROR! Failed to create AAC Control. Err=-2146869243
StartStopAllMMSServices: ERROR! MmsControlCreate failed with -2146869243

ENS McAfee_MfeEpAac_date/time.log:
 

VerifyParentEntryPointIsMcAfeeSigned: VerifyProcess PID[2340] LastErr 0x80096005 The time stamp signature or certificate could not be verified or is malformed.
LastErr 0x80096005 The time stamp signature or certificate could not be verified or is malformed.

ENS McAfee_Common_Bootstrapper_date/time.log:

Running application to gain installer exclusion failed: 2148098053
Gain installer exclusion through mfeEpAAC MFEPROTECT failed
Trying to gain installer exclusion now by mfeEpAAC protected with MFEINSTALL
Extracting MfeEpAac.exe: C:\Windows\TEMP\MfeEpAac.exe
Extraction successful
This is a 64-bit system
“C:\Windows\TEMP\MfeEpAac.exe” -add -rootlocation “C:\Program Files\McAfee\Endpoint Security” -rootlocation “C:\Program Files (x86)\McAfee\Endpoint Security” -folder “C:\ProgramData\McAfee\Endpoint Security”
PROCESS return code: 3221225506
Running application to gain installer exclusion failed: 3221225506

NOTE: Error codes 0x80096005 and -2146869243 translate to: TRUST_E_TIME_STAMP – Could not verify the time stamp or it is malformed. The error might be due to failure in validating certificate information.

How to install Endpoint Security for Mac 

PROBLEM

Failure in installation of A VSE 8.8 patch. The rollback mechanism also crashes. This failure leads to corrupted installation of VSE within the system and puts an end to the mechanism of McAfee Validation Trust Protection Service. In addition to that, the VSE OnAccessScanner is left in a disabled state.

The text in VSE installation logs present in the C:\Windows\Temp\McAfeeLogs are as follows:

VSE88_Patch_xxxxxx_xxxxxx.log:

>> Installing SysCore: “C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\x64\mfehidin.exe” -i VSE88P7 -q -mfetrust_killbit -l “C:\Windows\TEMP\McAfeeLogs\vse8.8.0.core_install_041416_090556.log” -etl “C:\Windows\TEMP\McAfeeLogs\vse8.8.0.core_install_041416_090556.etl” -x vse.xml OAS ELAM AAC DiskFilter firecore_driver EmailScan ScriptScan
!> Error – SysCore install failed: 255
<= leave custom action  Install_SysCore_Patch()
CustomAction Install_SysCore_Patch returned actual error code 1603 (Note: This code might not be 100% accurate if translation happened inside sandbox.)
MSI (s) (DC:14) [09:06:35:968]: User policy value ‘DisableRollback’ is 0
MSI (s) (DC:14) [09:06:35:968]: Machine policy value ‘DisableRollback’ is 0

vse8.8.0.core_install_xxxxxx_xxxxxx.log:

[10:06:12:062] – GetAccessAndDeleteFile: FileDelete(C:\Program Files (x86)\Common Files\McAfee\SystemCore\mcvssnmp.dll) failed with error 5
[10:06:12:062] – GetAccessAndDeleteFile: FileDelete(C:\Program Files (x86)\Common Files\McAfee\SystemCore\mcvssnmp.dll.a5a7.deleteme) failed with error 2

[10:06:20:859] – Install error: un-winding install

[10:06:22:452] – ERROR! Failed to create AAC Control. Err=-2146762486

[10:06:22:500] – Returning 4294967295

Problem

A failure in A VSE 8.8 patch management extension upgrade declares further mentioned message in the Orion.log (\Program Files(x86)\McAfee\ePolicy Orchestrator\Server\Conf\Orion):

BUILD FAILED
D:\PROGRA~1\McAfee\EPOLIC~1\server\extensions\installed\VIRUSCAN8800\8.8.0.448\install.xml:78: com.mcafee.orion.core.cmd.
CommandException: APPolicyMigrateCommand: Failed to create AP config

The major reason for the occurrence of this problem is a certification validation error while creating the APConfig object. The product failed to validate the required DLL certificate. Hence, it is unable to create the APConfig object for updating the policy.

PROBLEM

Once you upgrade the extensions for VSE 8.8 patch, the data in fields for Categories and Rules is nil in the VSE Access Protection policies.

PROBLEM

Once you upgrade the extensions for VSE 8.8 patch, the data in fields for Rules is nil in the VSE Access Protection policies.

PROBLEM

In case one or multiple root certificates are missing, update that utilizes the nnnnxdat.exe (V2) or V3_nnnndat.exe (V3) package fails.

PROBLEM

The core installation log has reported the following error:

Warning: Certificate <CERTIFICATE_NAME> – not found in Root

The errors in the product core installation log are similar to the below mentioned examples:

NOTE: In the core installation log, the title of certificate may tend to differ.

MACC mac_mpt.log

[09:14:16:612] – Total 1 Warning Value present
[09:14:16:612] – Code [0x60001100] : A required certificate couldn’t be located in certificate store.
[09:14:16:612] – Total 1 Error Value present
[09:14:16:612] – Code [0x20005011] : Internal error has occurred during installation.
[09:14:16:612] – Warning: Certificate UTN-USERFirst-Object – not found in Root.
[09:14:16:628] – Warning: Certificate GlobalSign Root CA – R1 – not found in Root.
[09:14:16:628] – Exit code will be 4294967295

VSE VSEInst_<date_time>.log

[10:39:15:420] – Warning: Certificate UTN-USERFirst-Object – not found in Root.
[10:39:15:420] – RecordActionCode: Action Result 1 Category 1 Message 16 (Final 0x60001100).
[10:39:15:436] – Warning: Certificate GlobalSign Root CA – R1 – not found in Root.
[10:39:15:436] – LoadElamPplCerts: Ensure PPL certificates are loaded in the OS
[10:39:15:436] – StartStopMFeServices: stopping
[10:39:15:436] – StartStopAllMMSServicesExceptVTP: start=false
[10:39:15:436] – StartStopAllMMSServicesExceptVTP: ERROR! MmsControlCreate failed with -2146762486
[10:39:15:436] – StartStopAllMMSServicesExceptVTP: exit=0
[10:39:15:436] – ERROR: StartStopMfeServices: failed to stop services…
[10:39:15:436] – StartStopMFeServices: return=0
[10:39:15:436] – ERROR! while stopping services.

Cause

One or more than one of the below mentioned certificatesare missing:

• Root certificates:
  • AAA Certificate Services
  • AddTrust External CA Root
  • GlobalSign
  • GlobalSign Root CA
  • Microsoft Code Verification Root
  • USERTrust RSA Certification Authority
  • UTN-USERFirst-Object
  • Verisign Universal Root Certification Authority
  • Verisign Class 3 Public Primary Certification Authority – G5

• Intermediate Certification Authorities certificates:
  • AddTrust External CA Root
  • COMODO RSA Code Signing CA
  • GlobalSign
  • GlobalSign Root CA
  • GlobalSign CodeSigning CA – G3
  • GlobalSign CodeSigning CA – SHA256 – G3
  • McAfee Code Signing CA 2
  • McAfee OV SSL CA 2
  • USERTrust RSA Certification Authority
  • Verisign Class 3 Code Signing 2010 CA

The recent McAfee binaries have been tied and signed with up-to-date SHA-1 and SHA-256 certificates. In order to validate the digital signatures, the root certificates are required. These certifications are not distributed by Microsoft. For McAfee activation get in touch with our professional experts.

There are various reasons for root certificates getting missed. The reasons may include following causes, but no necerssarily:

• An administrator ended up removing the certificate from the system.
• The connectivity to an online network is missing from the system. It is highly required for performing a Root Auto-update (An automated root updating).
• The root certificate update is prevented by a group policy that is working effectively:
• The value in registry

HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\DisableRootAutoUpdate is set to 1.

• The registry key HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots exist.

Solution

The certificates required to validate the digital signature should be imported. The product is successfully installed or updated once you install the certificates.

• The missing root certificates must be installed in the physical Third-Party Trusted Root Certification Authorities supply. (AAA Certificate Services, AddTrust External CA Root, GlobalSign, GlobalSign Root CA, Microsoft Code Verification Root, USERTrust RSA Certification Authority, UTN-USERFirst-Object, Verisign Class 3 Public Primary Certification Authority – G5, and Verisign Universal Root Certification Authority)
• The missing Intermediate Certification Authorities Certificates must be installed in the physical Intermediate Certification Authorities store. (AddTrust External CA Root, COMODO RSA Code Signing CA, GlobalSign, GlobalSign CodeSigning CA – G3, GlobalSign CodeSigning CA – SHA256 – G3, GlobalSign Root CA, McAfee Code Signing CA 2, McAfee OV SSL CA 2, USERTrust RSA Certification Authority (2028), and Verisign Class 3 Code Signing 2010 CA)

OPTION 1: The certificate can be installed with the help of Active Directory group policy

It is highly recommended by McAfee to install the ertificates using Active Directory group policy in case of wide deployment. If you need to know how you can deploy changes in the registry with the help of group policy, you must read the following article by Microsoft: https://technet.microsoft.com/en-us/library/cc753092(v=ws.11).aspx.

The registry change must be deployed for Computer policy instead of User policy. If you wish to learn about detailed instructions on how a certificate can be added using group policy, please check out KB92948.

OPTION 2: The certificate can be installed directly into the system.

In case you have only one or only a few systems, you may try following the further mentioned files for installing the certificates directly on the system. Or, you can try installing the certificates in seclusion by utilizing a suitable managerial deployment methodology.

To begin with installing the certificates:

• Download the following file: USERFirst_and_VeriSign_and_Comodo_and_GlobalSign_and_USERTrust.bat.txt and rename it to USERFirst_and_VeriSign_and_Comodo_and_GlobalSign_and_USERTrust.bat. Then, finally run it.
• Download the file: USERFirst_and_VeriSign_and_Comodo_and_GlobalSign_and_USERTrust.reg.txt and rename it to USERFirst_and_VeriSign_and_Comodo_and_GlobalSign_and_USERTrust.reg. Then, finally run it.

SOLUTION

Addressal of problem that hinders the automated updating of root certificates on the system.

The management of root certificate stores are allowed by Microsoft. Although, there are various group policy objects and automated updates. If you require to know more about this issue, please visit: https://technet.microsoft.com/en-us/library/cc749331(v=ws.10).aspx. The administration of certificate storage does not come under the Technical Support level.

In case the group policy hinders the root certificate update, please try using the below mentioned solution:

CAUTION:

In this article, you get to learn about information regarding opening or modifying the registry.

• This particular information is considered for System Administrators. The modifications in registry cannot be reversed and they may cause a complete failure in the system if it is conducted wrongly.
• It his highly recommended by the Technical Support Experts to back up the data in registry and carefully understand the entire registry process prior to proceeding with the registry modifications. If you want more details on this, please refer to: https://support.microsoft.com/kb/256986.
• Running a REG file which does not possess any confirmation as an authentic registry import file should be strictly avoided.
• Change the value of registry for:

HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\DisableRootAutoUpdate from 1 to 0

NOTE: In case you are creating this change with the use of group policy for wide-level deployment, the Group Policy Object (GPO) for this purpose is at: Computer Configuration, Administrative Templates, System, Internet Communication Management, Internet Communication settings, Turn off Automatic Root Certificates Update. Change Turn off Automatic Root Certificates Update from Enabled to Disabled.

1. Press Windows+R, type regedit, and click OK.
   1. Navigate to HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\DisableRootAutoUpdate.
   1. Change the value from 1 to 0.
   1. Exit the registry editor.

• If present, remove the registry key ProtectedRoots, which is at HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots:
  • Press Windows+R, type regedit, and click OK.
  • Navigate to HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root.
  • Right-click ProtectedRoots, click Export, and choose a location in which to save a backup copy.
  • Right-click ProtectedRoots, click Delete, and click Yes when prompted.
  • Exit the registry editor.

Quick links: McAfee Refund / McAfee.com/setup / McAfee.com/activate / Reinstall McAfee /

Lucy John McAfee

Lucy John McAfee, is a technical expert, She loves to write and discuss about new technologies and cyber security, She is also the chief blog editor at McAfee Support Number. She is a regular blogger who keeps a tab on the latest updates in the Security and technology arena. She has visited United Kingdom, United States (USA), Canada, Australia.
You can reach her at Mail | Facebook | Twitter | Instagram | LinkedIn | Youtube

www.mcafeesupportnumber.co.uk