Server AV: Error 1920, service McShield failed to start (when installing VirusScan Enterprise 8.7i)

03/26/2020 4 People found this article helpful 43,768 Views

Description

A notice has been issued for SonicWall Enforced Client's (McAfee and Kaspersky). Please see Notice: End of Support for SonicWall Enforced Client for more information.

Resolution

Problem 1

You see the following error when installing VirusScan Enterprise (VSE) 8.7i:

Error 1920, service McShield failed to start

Problem 2

The following Error is reported in the VSEInst.log:

MSI (s) (7C:2C) [09:45:48:788]: Executing op: ProgressTotal(Total=16,Type=1,ByteEquivalent=1300000)
MSI (s) (7C:2C) [09:45:48:788]: Executing op: ServiceControl(,Name=McAfeeEngineService,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:50:163]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:50:772]: Executing op: ServiceControl(,Name=McAfeeFramework,Action=1,Wait=0,)
MSI (s) (7C:2C) [09:45:50:772]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:51:272]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:51:772]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:52:272]: Executing op: ServiceControl(,Name=McShield,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:47:43:241]: Product: McAfee VirusScan Enterprise -- Error 1920.Service McAfee McShield (McShield) failed to start. Verify that you have sufficient privileges to start system services.
Error 1920.Service McAfee McShield (McShield) failed to start. Verify that you have sufficient privileges to start system services.
MSI (s) (7C:2C) [09:47:43:241]: User policy value 'DisableRollback' is 0
MSI (s) (7C:2C) [09:47:43:241]: Machine policy value 'DisableRollback' is 0

Problem 3

The following errors are recorded in the Windows Application Event Log:

Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 11920
Date: 10/10/2008
Time: 15:46:14
User: NT AUTHORITYSYSTEM
Computer: ABCDE1
Description:
Product: McAfee VirusScan Enterprise -- Error 1920.Service McAfee McShield (McShield) failed to start. Verify that you have sufficient privileges to start system services.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 31 34 37 42 43 45 30 {147BCE0
0008: 33 2d 43 30 46 31 2d 34 3-C0F1-4
0010: 43 39 46 2d 38 31 35 37 C9F-8157
0018: 2d 36 41 38 39 42 36 44 -6A89B6D
0020: 32 44 39 37 33 7d 2D973}

Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5004
Date: 24/04/2009
Time: 05:50:37
User: NT AUTHORITYSYSTEM
Computer: ABCDE1
Description:Could not contact filter driver
Error=0x7d1: The specified driver is invalid
Product: McAfee VirusScan Enterprise

Solution 1

Apply Patch 1 (or later) for VirusScan Enterprise 8.7i.

Solution 2

If you have Symantec Software Virtualization and Streaming installed (possibly as part of Altiris), use the 8.7i installation package that includes Patch 2.

Workaround

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986
Do not run a .REG file that is not confirmed to be a genuine registry import file.

If the previous solutions do not resolve the issue, then you are experiencing them same symptom for reasons unknown at this time to McAfee. The issue should be investigated but you can also try the following workaround:

Modify the registry path to the core driver during the installation.

Start the VirusScan Enterprise 8.7i installation locally.
During installation, wait for the 1920 error to occur.

IMPORTANT: Do not dismiss the 1920 error dialog box.
Click Start, Run, type regedit, and click OK.
Navigate to and expand the following key:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices
In the left pane, scroll down and select the sub-key: mfeapfk.
In the right pane, right-click ImagePath and select Modify.
In the Value Data field, modify the contents to state the full path.

Example:

Existing ImagePath: system32driversmfeapfk.sys
Modify ImagePath to include: c:windowssystem32driversmfeapfk.sys
Repeat the previous steps for the following two McAfee keys.

IMPORTANT: Do not make this change for any other McAfee drivers:
- mfeavfk.sys
- mfebopk.sys
Close the registry editor.
Dismiss the error and reattempt the installation.

Excerpt: https://kc.mcafee.com/corporate/index?page=content&id=KB59863&actp=search&searchid=1271264401802

Not Finding Your Answers?

ASK THE COMMUNITY

Was This Article Helpful?

YES NO

Capture Cloud Platform

Federal

Partner Portal

Support Portal

Capture Cloud Platform

Federal

Partner Portal

Support Portal

Server AV: Error 1920, service McShield failed to start (when installing VirusScan Enterprise 8.7i)

Description

Resolution

Problem 2

Problem 3

Solution 1

Solution 2

Related Articles

Categories

Not Finding Your Answers?

Was This Article Helpful?

Article Helpful Form

Article Not Helpful Form

Stay In Touch

Existing ImagePath:	system32driversmfeapfk.sys
Modify ImagePath to include:	c:windowssystem32driversmfeapfk.sys