Remote AV upgrade failing

[j-gray 35]

Trying to upgrade Windows systems and getting the errors below. I haven't run into permissions issues before, so I'm not sure what has changed. Seems like this may be limited to Win10 clients at this point. Otherwise this is a basic task that we've been using for a while without issues until now.

From trace.log:

Error: CSystemConnectorModule [Thread 129c]: SoftwareInstallation: MsiInstallProduct: Received error with text: Service 'ESET Service' (ekrn) could not be stopped.  Verify that you have sufficient privileges to stop system services.
Error: CSystemConnectorModule [Thread 129c]: SoftwareInstallation: Installation failed with: (0x643), Fatal error during installation (0x643), Service 'ESET Service' (ekrn) could not be stopped.  Verify that you have sufficient privileges to stop system services., see software-install.log for more information located at: C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\

 

From software-install.log:

Product: ESET Endpoint Antivirus -- Error 1921. Service 'ESET Service' (ekrn) could not be stopped.  Verify that you have sufficient privileges to stop system services.

[j-gray 35]

Based on other threads, this appears very similar to the issue with Windows 10 + Windows Defender + ESET.

However, I have 'Turn off Windows Defender' in Group Policy, so I'm not sure what the issue is.

In ESET policy I have self-defense turned off. Yet the RA and AV service are grayed out on 'stop' and 'restart' when I look under Computer Management.

Any thoughts?

[tomha 3]

Similar problem here.

I tried an upgrade task from EAV 6.5 to 6.6 via ERA on a Win10Pro(1703) machine. The task failed several times with error 1921.

Then i tried to do the upgrade manually, which failed due to eset service could not be stopped. After the manual installation EAV 6.5 was crippled(not showing up in APPS and Features anymore, left over in the context menu, eset service running, no GUI). I did a manual uninstall of EAV with the uninstall tool in SafeMode. After that i could install EAV 6.6 via ERA.

Strange!

 

[j-gray 35]

ESET Support; this seems to be a common issue.  Is there a recommended fix that will work across an enterprise (meaning something that does not require sitting at each workstation, booting into safe mode, and manually running an uninstall tool).

Appreciate any suggestions.