NAV 8.0 MSI Install 5

[albinotoad]

Symantec Antivirus Corprate Editon 8.0 with Windows 2000 SP3

I've having a little difficulty using Intellimirror, attempting to roll out NAV Client via group policy. Have made the MSI package with the Packager, then adding the MSI package into the Group Policy, Software installation, adding as an assigned package. The following message is encountered. "Add Operation Failed. Unable to extract deploymnet information from that package. Run Validation on the package to ensure the package is correct"

Any ideas? This did work in verison 7.6 (Before Packager was required)

Review the Installer log shows:

SI (s) (98:20): Doing action: DisallowAdvertisedInstall
Action start 15:04:49: DisallowAdvertisedInstall.
This setup cannot be run in advertised mode.
MSI (s) (98:20): Product: Symantec AntiVirus Client -- This setup cannot be run in advertised mode.

Action ended 15:04:49: DisallowAdvertisedInstall. Return value 3.

Any ideas?

 

[Adamkjaer]

I have the same problem. I have tried the Symantec Support without luck. Please e-mail me at awksygeforsikring.dk if you got a solution to this problem !

Adam Kaer

 

[Adamkjaer]

sorry wrong e-amil address. My e-mail is awk@sygeforsikring.dk. Thanx.

 

[albinotoad]

This was a copy of my last attempt to get Symantec involved. I basically gave up this cause. After speaking with their support staff and dealing with their support groups, basically, since distributing the software with MSI package via Active directory Group Policy is using 3rd party software, it's not supported. They did however recommend using .zap files. Ever try that? It is as unacceptable as the rest of the installation methods. I did however leave several suggestions with them.


-------

The product is Symantec Antivirus Enterprise Edition 8.5.

I'm requesting that Intellimirror support be re-added for this version. I find it ironic that you use MSI packages with the Symantec Packager but don't support Microsoft's main method of transporting these packages, intellimirror via group policy. This was supported in 7.5 and 7.6 and is listed in the current product manual (8.5). However, there is a post in on your support documentation that states that this is not a supported method. (Not that I'm really asking for help on setting it up but on making it available as an option) After examining the code for the MSI packages that packager creates, support for this is purposely turned off with in the code itself. (I can provide examples if needed) After review the support groups, there seems to be quite a few people confused by this change in policy and that this roll out technique was very widely used. The following is a summery of a discussion about this issue. The complete original post doesn't exist in its entirety due to your retention policy of such items.

 

[Adamkjaer]

Never heard of .zap files ? Du you have some info on that ? I totally aggree with you in that i is unacceptable suddenly not to support MSI distribution with AD. I've tried the support as well without any luck. I Can add that distributing MSI Packages via AD software policies has been supported since v. 7.0? in corporate edition.

 

[Whisper111]

Hi

I would like an answere from ALBINOTOAD.
You mentioned that Symantec has a version 8.5. Is that verified???
And you could provide examples of the code that is purposley turned off with in the code itself on version 8.0.
I would be very glad if you could do that within this week.
Because we have a important meeting with Symantec next week were we will discuss this problem with them.

 

[albinotoad]

About the version, sorry that is enterprise version 8.5, the NT client is version 8.001.425. If you look above at my original post, at the example from the MSI installer log, you can see where I first suspected something was amiss. Let me see if I can dig up my research on this issue, after I e-mailed it to Symantec, I’m not sure I kept a record because a response was not really expected.

Basically, a flag is set in the MSI package itself (DisallowAdvertisedInstall) that doesn’t allow advertised mode. This was what was meant by ‘in the code itself’. However, toggling this flag still didn’t allow the MSI to install correctly but did allow it to be used in Microsoft Activity Directory Group policy as an advertised application.

I guess what upset me the most is that this is supposed to be a transport method, that may not be supported by Symantec Support but, that is suppose to WORK. This method is documented in the manual and did work with pervious versions. But according to what I’ve found, Symantec should have known that it was impossible for this transport method to work and it should have been stated as such.

Running a medium sized organization, finding this little surprise at the last minute, greatly increased the man-hours needed to roll out and maintain licensing for this product. And I'm sorry to say that this will also affect our renewal of contracts with this company, as we need a more automatable solution.

 

[albinotoad]

I was unable to find a lot of information about .zap files themselves other than a few examples. However since they do not support the publishing type within Active Direcoty needed this was also rejected.

A few examples can be found at:

http://www.snow.no/attachments/Implementing Snow Distribution in AD through ZAP files.doc

http://appdeploy.com/tips/zap.shtml

http://support.microsoft.com/defaul...port/kb/articles/Q231/7/47.ASP&NoWebContent=1

Hope this is helpful.

 

[Whisper111]

Thanks anyway Albinotoad

I have the same feeling about the future of Symantec in our company. We have spend a lot of man hours trying to solve this problem without luck.
Im already looking on other products before our renewal of the contract next year. We have about 5000 clients so we are depended of an automated distribution of clients.
Im really sorry for this, because for three years ago we saw Symantec to be one of the leading companys of Antivirus for big companys. But they have lost it now because of this most irritating little thing.
Thanks for the answere.

Sweden

 

[Gambit23]

Hi, Iam Fernando from Argentina, and the 3r party MSI generators, like InstallShiel ?? any test this ???

TNX !!

Sorry for my english... ;-)

 

[albinotoad]

Per the above thread, I did use InstallShield to rip into the original MSI, that is how I found the FLAG (DisallowAdvertisedInstall) was set.

Did I attempt to create/recreate a new MSI using IntstallShield? No, that might open me up to a libel suit :}

But then again, I'm just a poor network admin and not a programer.

 

[Bugbear0001]

I have a workaround for getting SAV8.x to install on a locked down machine. I too have wrestled with the Symantec help desk staff and I can conclude that they are EFFING USELESS...so don't think that you are the only one to struggle with this.

The guts of the solution is to use a little executable called PSEXEC.EXE. This allows you to run processes on a machine using a different username - similar to 'RunAs' except that you can provide a password as well.

PSEXEC comes with a suite of other useful tools (this is not an ad!!) but you'll have to find out where to get them from yourself.

What I did was scripted the running of the SAV8.0 MSI install using psexec with an administrative user. If you use the msi silent install switches, this method works fine. Admittedly, this workaround is a bit of a hack, however I could find no way of getting the msi install to run under a W2K system user.

 

[ReddLefty]

I had no troubles packaging SAV v8.0 with the shareware version of WinInstall LE v3.0.

Here are two things I had to do:

1) Take Before Snapshot
2) When prompted with the Before snapshot exlusions, remove the Uninstall string from HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Uninstall
2) Install a fully managed version to start
3) DO NOT REBOOT!
4) Immediately take an After Snapshot

It's very important NOT to modify the MSI package therafter as it will change the GUID number and it will cause problems... not even to change the icon.

I eventually stopped using it and just ran the installation from the SAV server. I run a batch file that I launch on every new computer. I didn't want to install the entire Sofware Update Services from Microsoft, so I batch file in the patches, along with a couple of other required things.

Hope this works out.



"In space, nobody can hear you click..."

 

[Gambit23]

Hi !! and work with GPO ??? i need deploy this for Active Directory.... the script method is old and work fine.

You test in AD ???

Regards !!!

Fernando

 

[ReddLefty]

Yup, I had it assigned but machine based, not user based.



"In space, nobody can hear you click..."

 

[elazar]

I got Symantec 8 and 8.1 to install over Active Directory's Managed Software Installations. The first thing you need to do is get the Symantec MSI file, usually when you install it it copies this MSI file to your Temp folder under you user profile i.e. if you user name was jsmith so the path would be C:\Documents and Settings\jsmith\local settings\temp. Copy this file to some directory or on your desktop. Or if you have Symantec Packager installed, create an MSI with it, and set the options that you want. It is preferable to use Symantec Packager. Step 2, download an MSI editor such as the Orca database editor, which is packaged with the MSI SDK (this is what I used) it is located on Microsofts site (

http://download.microsoft.com/download/platformsdk/wininst/1.1/WIN98/EN-US/IntelSDK.msi)

Step 3, once you have installed the editor, open it and locate the Symantec MSI file, and open that.

Step 4, Once you have opened the database, locate the table called 'AdvtExecuteSequence', in that table delete the entry 'DisallowAdvertisedInstall'. Now save the MSI.

Step 5, You will need to locate the GRC.DAT file. This is the configuration file that Symantec reads its settings from, including the license key(if you don't include this file, the install will work, but Symantec will not load Realtime Protection because it is missing the license key) If you have Symantec System Center installed and configured, this file is located in either c:\program files\sav\groups\the group name. If you dont have it configured, but you do have the server edition of Symantec AV running on a server, this file is located under c:\program files\nav. If you have neither, look for it on the cd, though I am not sure if it is on there. If its not there then install the server version of symantec av and get if from there.

Step 5, Move the Symantec MSI, and the GRC.DAT file to the same folder/directory.

Step 6, The symantec MSI requires Installshields Script engine version 7.x(ISScript.msi). This can be downloaded from installshields site (

http://support.installshield.com/kb/files/Q108158/IsScript7.zip)

Step 7, Copy the ISScript MSI to the same folder as the Symantec MSI

Step 8, Go into Group Policy, and create the deployment package for ISScript.MSI and the Symantec MSI. Make sure that you create the ISScript package first. You must deploy the ISScript file otherwise symantec AV will not install.

Step 9, Test it!

Step 10, Get yourself a beer

If you have any problems with this feel free to e-mail me at ebroad@dps-usa.com

Elazar

 

[jlb0001]

EVERYONE who reads this post and finds Symantec's action (or lack of action) on this issue appalling, please let them know using their feedback page:

http://www.symantec.com/feedback/

Talking Points:

- I am considering switching if AD GPO is not supported in the next version.

- Active Directory using GPO is the "modern" method for rolling out software packages throughout an organization.

- Full support for Active Directory (including AD browsing) is imperative.

- Dropping AD support is a critical mistake that is not going unrecognized.

- Panda Software has committed to incorporating this mechanism in their next version.

 

[elazar]

Hey Everyone,
Forgot 2 things about deploying Symantec AV with active directory. Number 1, since my method is a "crack" Symantec may/will not deploy correctly for the following reasons. When a program installs itself via AD, it copies its install files onto the local machine where the application is being installed. This is not so with Symantec AV even if you have modified the package like I have shown above. It attempts to extract the files in the directory that the MSI is located in. So, the system(NT Authority\SYSTEM) would have to have full permission on the shared folder where the Symantec AV MSI is located. Number 2, since this is how the installer behaves, you unfortunately cannot have 2 machines installing at the same time, because the files that the installer needs to extract already exist, causing it to fail. If anyone can find a way around this, please let me know. I hope this helps those who have been having some problems with my method.

Thanks,
Elazar

 

[albinotoad]

Wow, Hats off to Elazar! Nice bit of work. I glad someone is a crazied enough about this issue as I am/was, to dig that deep. Good Luck.

P.S. I send a feedback e-mail to Symantec once amonth on this issue :}

 

[whopissedonmyfries]

You guys are amazing. I'm so glad I found this thread, it's saved from from a lot of possible hair pulling. I'm trying to put a plan together, and I noticed two possible fixes on this thread

ReddLefty (IS/IT--Manageme) Jul 17, 2003
I had no troubles packaging SAV v8.0 with the shareware version of WinInstall LE v3.0.

and the biggie

elazar (IS/IT--Manageme) Aug 13, 2003
I got Symantec 8 and 8.1 to install over Active Directory's Managed Software Installations.


I wonder if anyone else has successfully tried either of these? Elazar's is so well documented, I think I'll try it.

Thanks guys.