Symantec EndPoint Protection 11 MR3 client fails to install on SBS2003

Just attempted to upgrade one of the Small Business Server 2003 Premium servers from Symantec Client Security (SCS) or was that Symantec AntiVirus (SAV), well v10.2 anyway. Old version System Center Console (SCC) came off ok, rebooted and the new Symantec EndPoint Manager (SEPM) went on without error. However the newly packaged client for the server - AntiVirus and AntiSpyware modules only - wouldn't install. It got most of the way there and then suddenly rolled back without an error. There was a simple error event id 11708 from msiinstaller, operation failed.

Sounded just like some problems discussed on Experts Exchange and the Symantec forums. There was a whole thread dedicated to people opening support cases and requesting EndPoint Cleanwipe. So I did the same and within 20 minutes had a copy off Symantec ftp. It didn't fix the problem but wasted a couple of hours trashing the SEPM install as well as the previous Mail Security for Exchange. So after reinstalling both I was back to square one. Twelve hours later, Symantec tech support popped up having gotten around to reading the install log. Turns out there was an old Alert Management Server installed. It wouldn't remove from Add/Remote Programs or via CleanWipe.

The Microsoft Windows Installer Cleanup tool went all Chuck Norris on it and saved the day. One reboot later and a successful client install :-)

Symantec AntiVirus 10.x license expired at client

Got an SBS2003 network with around 20 clients on. I installed the new licence at the server but one of the clients refused to cooperate and just appeared in the Symantec System Center Console with a license expired and refused to deploy the new one even though there were unallocated seats. The error I was getting was 0x80004005 - helpful yeah!

Turned out the Windows Firewall was getting in the way. Disabling it fixed the problem temporarily so the licence would install but there was no client management available. All the tools like view event log failed. I found Symantec doc 2004070817071248 which talked about using port 2967 for client communications. Using the Group Policy Management in the server management console let me add a firewall port exception to enable this for all PCs on the network.

I updated the Windows Firewall policy under Computer Configuration > Administrative templates > Network > Network Connections > Windows Firewall > Domain profile
and edited the Define Port Exceptions to include this line:
2967:TCP:*:Enabled:Symantec AntiVirus Management - Port