> Source: [sk180772](https://support.checkpoint.com/results/sk/sk180772)

# sk180772 - Client upgrade fails with "Error 26810 Failed to stop services (TracSrvWrapper)" 

| Property | Value |
|----------|-------|
| Solution ID | sk180772 |
| Date Created | 2023-03-24 |
| Last Modified | 2023-03-28 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Windows |

## Symptoms

- * Upgrade from E86.60 to E87.10 using automatic deployment/software deployment rules fails with "*Error 26810 Failed to stop services (TracSrvWrapper)*".
* VPN gets disconnected after a failed upgrade, and each machine needs to be manually reconnected.
* Installer requests InstHelper to stop services in *msi_log.txt*   

  ` MSI (s)Invoking remote custom action. `  
  `
  DLL: C:\WINDOWS\Installer\MSI62BA.tmp, Entrypoint: StopAllServices
  StopAllServices StopAllServices started.`  
  `
  StopAllServices Done waiting for Services to stop, result 0, unstopped services: TracSrvWrapper`  

  InstHelper sends request to TracSrvWrapper to stop in InstHelper.log  

  `
  p:023164 InstHelper.exe: Got a message# 69 stopServices. bVsutilLoaded=1 `  
  `
  p:023164 InstHelper.exe StopServices: GetServiceProcessHandle-> TracSrvWrapper`  
  `
  p:023164 InstHelper.exe StopServices: StopServiceTask::QueryServiceStopped TracSrvWrapper, result: 1, stopped 0, dwProcessId: 30332`  
  `
  p:023164 InstHelper.exe StopServices: AppendStopServiceTaskToTasks<- TracSrvWrapper task created and added. `  
  ` `   
  TracSrvWrapper gets signal to stop in trac.log  

  `
  [TracService] service_ctrl_ex: Scheduling stop_from_os callback`  
  `
  `   
  Logs about client crash are pinted also in *EventLog-Application.stdOut.txt*

## Cause

Client failure happens when the service stops enforcing SCV policy and tries to end WindowsSecurityMonitor check:  
The *WindowsSecurityMonitor* log (WscScvDebug.txt from the Endpoint Connect installation directory) shows:  

`
[xx][TR_SCVCOMPLIANCEENG] TrScvComplianceEng::UnloadScvPolicy - inside`  
`
[xx][TR_SCVCOMPLIANCEENG] TrScvComplianceEng::UnloadScvPolicy - Removing the old Policy`  
`
[xx][TR_SCVPOLICY] TrScvPolicy::StopScvPlugins: inside...`  
`
[xx] Exception code: C0000005 ACCESS_VIOLATION READ`  
`
[xx] Fault address: 737E3BDA 01:00002BDA C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\WindowsSecurityMonitor.dll`  
`
[xx] Registers:`  
`
[xx] EAX:04620518 EBX:0300EF38 ECX:733C1000 EDX:737ECF88 ESI:01AEF188 EDI:01AEF188`  
`
[xx] CS:EIP:0023:737E3BDA `  
`
[xx] SS:ESP:002B:01BFEAFC EBP:01BFEB28`  
`
[xx] DS:002B ES:002B FS:0053 GS:002B`  
`
[xx] Flags:00010206`  
`
[xx] Call stack:`  
`
[xx] Address Frame Logical addr Module`  
`
[xx] 737E3BDA 01BFEB28 00000001:00002BDA C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\WindowsSecurityMonitor.dll (98.6.1039.0)`  
`
[xx] 737E79C6 01BFEB7C 00000001:000069C6 C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\WindowsSecurityMonitor.dll (98.6.1039.0)`  
`
[xx] 00154712 01C06C70 00000001:00133712 C:\Program Files (x86)\CheckPoint\Endpoint Security\ `  

<br />

Direct root cause of the issue can be unloading this DLL from the Endpoint Connect service: C:\\Windows\\SysWOW64\\wbem\\fastprox.dll.   
WindowsSecurityMonitor depends on this DLL, so its unloading causes WindowsSecurityMonitor (and service as well) to crash and, subsequently, the upgrade to fail.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue - improved Endpoint Security Client package.
A Support Engineer will make sure the Endpoint Security Client is compatible with your environment before providing it.  
For faster resolution and verification, collect the [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk90445) file from the Endpoint Security Client involved in the case.  

**Related documentation**   

* [sk170419 - How to resolve most popular Endpoint Security Client installation errors](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170419)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content