> Source: [sk182681](https://support.checkpoint.com/results/sk/sk182681)

# sk182681 - Endpoint Security Client upgrade or uninstall fails when the Firewall is not running

| Property | Value |
|----------|-------|
| Solution ID | sk182681 |
| Date Created | 2024-09-23 |
| Last Modified | 2025-06-24 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | E89.X, E88.X |
| OS | Windows |

## Symptoms

- * The Endpoint Security Client upgrade fails with the error: "Error 1923: Service Check Point Endpoint Security Network Protection (vsmon) could not be installed".
* The Endpoint Security Client uninstall fails with the error: "Error 1922: Service Check Point Endpoint Security Network Protection (vsmon) could not be deleted".
* The Firewall is in a `NOT RUNNING` state.

## Cause

This issue occurs because the Firewall service (`vsmon`) detects an error in the firewall driver (`vsdatant`). The Firewall service cannot operate without this driver, so the service stops.  

During an Endpoint Security Client upgrade or uninstall, the installer requests the Firewall service to perform cleanup tasks. However, because the Firewall service is stopped, no cleanup tasks are performed. As a result, the installer cannot update or remove the Endpoint Security Client.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content