All modules disabled after upgrade 6.3 to 7.1

[Sander de Cocq 0]

Hello,

I had a W10 client that I could not upgrade through the SMC from 6.3 to 7 Endpoint Security. Manual installation of the package failed because the processes could not be stopped. I disabled the services, and the installation proceeded, and the client reported correct version in SMC. However, all modules are disabled, and cannot be enabled from the gui on the client (not blocked by policy, it enabling/disabling is possible on all other clients). Can you help me sort this out?

ESET Management Agent 7.0.577.0	Up-to-date version
ESET Endpoint Security 7.1.2053.0	Up-to-date version

Regards,

Sander

[Marcos 5,074]

Please collect logs with ESET Log Collector from the client and upload the generated archive here.

[Sander de Cocq 0]

Log files collected

ees_logs (1).zip

[Marcos 5,074]

Run the following command as an administrator and then reboot the machine:

sc delete epfwwfpr

 

If you would like to prevent pausing protection or uninstalling ESET by unauthorized persons, set up password protection. Also I'd recommend enabling detection of potentially unsafe applications to prevent applications capable of disabling or removing antivirus from running. Also enabling SSL/TLS filtering will protect you from malware on https websites and will also enable you to control access to https websites (e.g. by Web Control categories or by directly blocking specific https urls).

[Sander de Cocq 0]

Thank you. After the reboot, the scanner is running, however the firewall, anti-phishing and email scanning modules are not running and cannot be enabled in the GUI.

Attached are new log files.

 

ees_logs-2.zip

[Marcos 5,074]

In the last logs epfwwpr is still running.

1, Run cmd as an administrator.
2, Enter: sc delete epfwwfpr
3, Enter sc query epfwwfpr

If everything went alright, you should get:

C:\>sc query epfwwfpr
[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.

[Sander de Cocq 0]

Yeah, the service is not deleted, we can't do it with the command line or directly in the registry (HKLM/system/currentcontrolset/services). We're going to try booting in Safe Mode and deleting from registry next, unless you have other suggestions.

 

[Sander de Cocq 0]

Deleting the service from registry in safe mode did the trick, case closed. Thank you for your assistance.