Installation of Symantec Endpoint Protection (SEP) for Mac fails with the following error or any other nonspecific failure:

Symantec Endpoint Protection Installer quit unexpectedly.

Symantec Endpoint Protection Installer quit unexpectedly.

• SEP 14 and later.
• Mac OS X 10.8 and later.

The causes for this error are myriad and must be investigated by obtaining system logs from the Mac client.  These are some possible causes:

• Remnants from a previous install.
• The Mac OS version was upgraded and SEP was moved to the /Incompatible Software directory.
• Incompatibility with a 3rd Party application or remnants of a 3rd Party application.
• File system issues.
• User account issues.

SEP install issues can be investigated by analyzing Mac OS system logs.  The best way to parse these logs is to search for "symantec".  The following logs will show install activity:

• system.log
• install.log

If those logs do not contain any data, then the installer may be crashing prior to generating any logs.  In that case, the system may log the activity in a Crash report.  

To access the above logs and crash reports:

• Launch the Console application (Finder > Go > Utilities > Console).

System.log:

• Select system.log from the left pane.  
• Enter "symantec" in the Search field in the upper right to locate Symantec processes.
• To obtain a copy of the file, Control-click system.log and select "Reveal in Finder".

Install.log:

• Select /var/log from the left.
• Select install.log from the middle pane.
• Enter "symantec" in the Search field in the upper right.  This should locate the beginning of the install process and the log can then be read top down.
• To obtain a copy of the file, Control-click install.log and select "Reveal in Finder".

Crash Report:

• The crash reports can also be accessed directly from /Library/Logs/Diagnostic Reports/ or via Console as outlined below.
• Select User Reports on the left.  (Installs should run under user; Symantec processes that run under System will generate crash reports under System Reports.)
• Crash reports have a .crash file extension, and they are named by Application and date.  For example, "Symantec Endpoint Protection Installer_2017-01-01-xxxxxx_Directory.crash".
• Select the crash report in the middle pane to view data in Console.
• To obtain a copy of the report, Control-click the report and select "Reveal in Finder".
• The crash reports can also be accessed directly from /Library/Logs/Diagnostic Reports/.