Norton install error 8504 104: setup fails part way through every attempt

Fix it now

Error 8504,104 is Norton’s installer giving up part way through and rolling back what it had done. Norton does not publish what the code means, so work the installer failure itself: clear whatever is still holding the drivers setup needs, then install from a fresh package.

fltmc filters
DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow

1. Restart first and let any pending Windows update finish. Setup fails immediately while another installation holds the Windows Installer.
2. Remove any other security suite with that vendor’s own removal tool, not only the entry under ms-settings:appsfeatures, then restart again.
3. In the fltmc filters output, look for filter drivers belonging to a product you have already uninstalled. Anything still listed means the removal did not finish.
4. Download the Norton 360 Remover from norton.com/nortonremover and choose the remove and reinstall option. This is the tool Norton ships now, in place of the older Remove and Reinstall utility.
5. Check free disk space and the system clock before you retry, because both break setup in ways that look like something else.

DISM runs before the file checker, not after. The checker repairs files from the component store, so the store has to be sound first.

If Norton installs and reports protection on, you are finished. If it rolls back again, the next section covers what setup is being refused.

Why it happens

Installing a security suite is not a matter of copying files. Setup registers a file system filter driver, a network driver and several services, then asks Windows to load them. Any one of those requests can be refused, and when one is, the installer unwinds everything it has done and reports a failure. That rollback is why you are left with nothing installed rather than a half-working product.

Be clear about what the number tells you, because that decides where the time goes. Norton does not publish a meaning for 8504,104, 8504,105, 8505,104 or 8506,421. A Norton solution page is still indexed under the 8504,104 title, but the live article there is generic guidance on removing a non-Norton security product and defines no code. So take the reading the behaviour supports: setup could not complete a required step and rolled back. Which step, only Norton can say.

The Windows Installer numbers that sometimes appear alongside are the opposite case: documented, and worth reading properly. 1500 means another installation is in progress and has to finish first, and the return code a caller actually receives for that is 1618, held by a mutex only one install sequence can own. 1628 is a different problem, an invalid or unknown table, pointing at a malformed package or transform rather than a busy machine. One says wait; the other says get a different package.

Full reference

What the code family does and does not tell you

Two numbers separated by a comma looks like it should decompose into a component and a reason, and plenty of pages will tell you it does. Norton publishes nothing that supports any particular reading of either half. Treat the whole thing as an identifier to quote to Norton support, and treat the behaviour on the machine as the evidence you actually have. The practical consequence is that time spent decoding the number is time not spent on the filter driver list, which is where the answer usually is.

The Windows Installer numbers that travel with it

Reading the filter driver list

fltmc is the filter manager’s own command line tool, and fltmc filters enumerates what is currently loaded. The output has four columns: Filter Name, Num Instances, Altitude and Frame. The name is what identifies the vendor, and a filter that belongs to a product no longer installed is a removal that did not complete. Legacy filter drivers show as Legacy in the Frame column rather than a number, which distinguishes older products from ones using the filter manager properly.

How Windows handles a second antivirus

On Windows client, Microsoft Defender Antivirus moves to disabled mode by itself once a non-Microsoft antivirus registers, or to passive mode if the device is onboarded to Defender for Endpoint. On Windows Server it does not do this automatically and has to be handled deliberately. There is one exception worth knowing, because it produces exactly the conflict this article describes: if the Windows Security Center service is disabled, Defender cannot detect the other product at all and stays active, so both try to provide real-time protection. Microsoft states plainly that this is unsupported.

The practical reading is that you do not need to fight Defender before installing Norton on a client machine. You need to make sure the previous third-party product has actually gone, drivers included, and that the Security Center service has not been disabled by some earlier piece of tinkering.

What removing and reinstalling costs you

The Norton 360 Remover offers two options: remove the current version and reinstall the latest automatically, or remove only. Either way the local configuration goes with the product, so firewall rules, scan schedules and exclusions you have customised are worth noting down first. The subscription is not local; Norton states that uninstalling the application does not cancel it. Sign back in afterwards and the entitlement reattaches.

When it still fails

• Check whether other installers fail too. If they do, this is a Windows servicing problem wearing a Norton error number.
• Confirm the account you are installing from is a genuine administrator, not a standard account being elevated by a prompt someone else answers.
• On a managed device, driver installation and downloads are commonly restricted at the gateway. That is a conversation with whoever manages the device, not a setting to change locally.
• Collect the installer’s own logs and open a case with Norton. For a code with no published meaning, the vendor’s logs are the only route to a specific answer.

Every code this article covers

Confirm the fix worked

1. The Norton app opens and reports protection as on.
2. Windows Security, then Settings, then Manage providers shows Norton as the antivirus and no second product.
3. fltmc filters shows Norton’s drivers loaded and no leftovers from a removed product.
4. LiveUpdate completes without error.
5. The installed apps list shows one Norton entry and no orphaned remnants of a previous version.

Questions people ask about this