During the installation or upgrade of Symantec Endpoint Protection (SEP) client or Symantec Endpoint Protection Manager (SEPM), you see the message, "Symantec Endpoint Protection has detected that there are pending system changes that require a reboot. Please reboot the system and rerun the installation."
In the SEP_Inst.log (located in %TEMP% or in %Windir%\temp) log you may see the following:
(NOT MIGRATIONPENDINGREBOOT) OR SISFAILED=1
The registry value PendingfileRenameOperations in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\ contains information about files that the operating system has marked to replace on reboot.
You should reboot the computer to clear the information in this registry key. However, if this message persists after a reboot, follow the steps below to resolve this issue:
Note: You should back up the registry before making any changes. See the link under References for more information.
- Open the Windows Registry (regedit.exe).
- Search for the value PendingFileRenameOperations in:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager
- Search for the key RebootRequired in:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\
- Search for PendingFileRenameOperations in:
Installation should now proceed and succeed.
For new installations, you may also need to remove the following registry key:
- 32 bit operating systems: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec_Installer
- 64 bit operating systems: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec_Installer
Executable images and DLLs are memory-mapped when they are used, which makes it impossible to update core system files after Windows finishes booting. The MoveFileEx Windows API has an option to specify that a file move be delayed until the next boot.
Any Service Packs or hot fixes that update in-use, memory-mapped files install replacement files into a temporary location on the computer, and use MoveFileEx to have them replace files that are otherwise in use. When used with that option, MoveFileEx simply records commands in the PendingFileRenameOperations and PendingFileRenameOperations2 values under the registry key HKLM\SYSTEM\CurrentControlSet\Control\Session Manager. These registry values are of type MULTI_SZ, where each operation is specified in pairs of file names: the first file name is the source location, and the second is the target location. Delete operations use an empty string as their target path.
The PendingFileRenameOperations key stores the names of files to be renamed when the system restarts. The key consists of pairs of file names. The file specified in the first item of the pair is renamed to match the second item of the pair. The system adds this entry to the registry when a user or program tries to rename a file that is in use. The file names are stored in the value of this entry until the system restarts and they are renamed. This entry is not created by the operating system.
To prevent this message from appearing in the future, you should immediately restart the server after installing any application or driver when it prompts for a restart.