Support on SonicWall Products, Services and Solutions
Error 1920, service McShield failed to start
Browse Knowledgebase by Category
Server AV: Error 1920, service McShield failed to start (when installing VirusScan Enterprise 8.7i)
03/26/2020 
4 
9534
DESCRIPTION:
Server AV: Error 1920, service McShield failed to start (when installing VirusScan Enterprise 8.7i)
A notice has been issued for SonicWall Enforced Client's (McAfee and Kaspersky). Please see Notice: End of Support for SonicWall Enforced Client for more information.
RESOLUTION:
Problem 1
You see the following error when installing VirusScan Enterprise (VSE) 8.7i:
Problem 2
The following Error is reported in the VSEInst.log:
MSI (s) (7C:2C) [09:45:48:788]: Executing op: ProgressTotal(Total=16,Type=1,ByteEquivalent=1300000)
MSI (s) (7C:2C) [09:45:48:788]: Executing op: ServiceControl(,Name=McAfeeEngineService,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:50:163]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:50:772]: Executing op: ServiceControl(,Name=McAfeeFramework,Action=1,Wait=0,)
MSI (s) (7C:2C) [09:45:50:772]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:51:272]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:51:772]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:52:272]: Executing op: ServiceControl(,Name=McShield,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:47:43:241]: Product: McAfee VirusScan Enterprise -- Error 1920.Service McAfee McShield (McShield) failed to start. Verify that you have sufficient privileges to start system services.Error 1920.Service McAfee McShield (McShield) failed to start. Verify that you have sufficient privileges to start system services.
MSI (s) (7C:2C) [09:47:43:241]: User policy value 'DisableRollback' is 0
MSI (s) (7C:2C) [09:47:43:241]: Machine policy value 'DisableRollback' is 0
Problem 3
The following errors are recorded in the Windows Application Event Log:
Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 11920
Date: 10/10/2008
Time: 15:46:14
User: NT AUTHORITYSYSTEM
Computer: ABCDE1
Description:
Product: McAfee VirusScan Enterprise -- Error 1920.Service McAfee McShield (McShield) failed to start. Verify that you have sufficient privileges to start system services.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 31 34 37 42 43 45 30 {147BCE0
0008: 33 2d 43 30 46 31 2d 34 3-C0F1-4
0010: 43 39 46 2d 38 31 35 37 C9F-8157
0018: 2d 36 41 38 39 42 36 44 -6A89B6D
0020: 32 44 39 37 33 7d 2D973}
Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5004
Date: 24/04/2009
Time: 05:50:37
User: NT AUTHORITYSYSTEM
Computer: ABCDE1
Description:Could not contact filter driver
Error=0x7d1: The specified driver is invalid
Product: McAfee VirusScan Enterprise
Solution 1
Apply Patch 1 (or later) for VirusScan Enterprise 8.7i.
Solution 2
If you have Symantec Software Virtualization and Streaming installed (possibly as part of Altiris), use the 8.7i installation package that includes Patch 2.
Workaround
CAUTION: This article contains information about opening or modifying the registry.
- The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
- Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986
- Do not run a .REG file that is not confirmed to be a genuine registry import file.
Modify the registry path to the core driver during the installation.
- Start the VirusScan Enterprise 8.7i installation locally.
- During installation, wait for the 1920 error to occur.
IMPORTANT: Do not dismiss the 1920 error dialog box.
- Click Start, Run, type regedit, and click OK.
- Navigate to and expand the following key:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices
- In the left pane, scroll down and select the sub-key: mfeapfk.
- In the right pane, right-click ImagePath and select Modify.
- In the Value Data field, modify the contents to state the full path.
Example:
Existing ImagePath: system32driversmfeapfk.sys Modify ImagePath to include: c:windowssystem32driversmfeapfk.sys
- Repeat the previous steps for the following two McAfee keys.
IMPORTANT: Do not make this change for any other McAfee drivers:- mfeavfk.sys
- mfebopk.sys
- Close the registry editor.
- Dismiss the error and reattempt the installation.
Excerpt: https://kc.mcafee.com/corporate/index?page=content&id=KB59863&actp=search&searchid=1271264401802
