Trend Micro install error -5011: setup rolls back before it completes

Fix it now

Trend Micro does not publish a meaning for -5011; what it publishes for a failed consumer install is “Installation Incomplete”, with leftover Trend Micro files named as the cause and a specific free tool as the fix. Run that tool before you touch anything else, because it is the documented answer and it takes five minutes.

sc query msiserver

1. Sign in with an account that has administrator rights.
2. Download and run the Trend Micro Remnant File Remover Tool, also called the Uninstall Tool, from Trend Micro’s own support page. It removes leftover Trend Micro files that block a new installation.
3. Restart the computer. Trend Micro is explicit that removal is not finished until the restart.
4. Remove any other antivirus or security suite with its vendor’s own removal tool, then restart again.
5. Copy the Trend Micro installer to a local folder, right-click it and choose Run as administrator. Do not run it from a network share.
6. Reinstall and confirm the application status shows Protected.

If Windows updates KB5014019 or KB5014697 are installed, Trend Micro’s documented secondary step is to remove them, restart, and retry the installation.

If setup completes and the console reports Protected, you are done. If not, the next section covers what setup is doing when it rolls back.

Why it happens

Installing a security suite means registering low-level components: a file-system filter driver so files can be checked as they are opened, services that start before you sign in, and registry keys ordinary accounts cannot write. Windows Installer performs those steps through custom actions and treats any failure as fatal, because a half-installed antivirus is worse than none. The rollback is that design working, not a bug.

Trend Micro’s published cause for a consumer install that fails this way is short: old or leftover Trend Micro files on the computer obstruct the new installation, typically because a previous version was not fully removed or an earlier attempt was interrupted. The published remedy is equally short – run the Remnant File Remover Tool, restart, reinstall. That sequence appears against the “Installation Incomplete” message and the error numbers Trend Micro does document for it, and it is the one to try first regardless of which number you saw.

The companion codes fill in mechanics rather than causes, and two of them are commonly misread. -2147024891 is the signed decimal form of 0x80070005, which is Win32 error 5, access denied – the installer was refused, by rights, by a lock or by another product’s self-protection. 1602 is ERROR_INSTALL_USEREXIT, which Microsoft publishes as the user cancelling installation, so seeing it usually means something dismissed a prompt rather than that a step failed. 1710 is not an error at all: Microsoft’s published text is the prompt offering to restore your computer to its previous state or continue the install later.

Full reference

The two Trend Micro tools, and which does what

The distinction matters when setup has already failed. The Diagnostic Toolkit’s Uninstall tab is the documented way to remove a product that is installed; the Remnant File Remover is the documented way to clear what is left when there is no working installation to uninstall. Reaching for the wrong one wastes an afternoon.

Reading the numbers that arrive with the rollback

1602 being a user cancellation is worth pausing on. On an unattended or scripted install it usually means a prompt appeared that nobody answered, rather than that a step failed.

Where Trend Micro’s documented numbers differ from yours

Trend Micro’s published “Installation Incomplete” article names #1603, #1604 and #1625, and its Uninstall Tool article names #1603 along with 3002 and 3003. If the number you are looking at is one of those, you are on the documented path and the remedy above is the vendor’s own. If it is -5011, you are outside what Trend Micro publishes, and the sensible approach is to run the documented remedy anyway – it addresses the cause Trend Micro names for failed installs generally – and to fall back on the Windows Installer evidence if it does not work.

Reading a rollback

1. Note the exact point setup reaches before it reverses. The same point every time means a specific step; a different point each time points at the download, the disk or the temp folder.
2. Check whether a dialog appeared and was dismissed, which is what 1602 records.
3. Look for an access-denied result, which narrows it to rights, a lock or self-protection.
4. Check free space and clear %TEMP% before repeating a large install.
5. Where the package is an MSI, capture a verbose log and read backwards from the rollback.

Approaches that waste an evening

• Turning the Windows firewall off. It does not block a local installation.
• Removing Microsoft Defender. Windows manages that itself and removing it by hand causes more problems than it solves.
• Installing over the top of another suite. Neither product will work and neither will uninstall.
• Deleting the previous product’s folders by hand. The files go, the services and driver registrations stay, and setup still refuses.
• Reinstalling Windows. It works, in the way that moving house cures a leaking tap.

Every code this article covers

Confirm the fix worked

1. Trend Micro appears in Settings, Apps, Installed apps with the version you intended.
2. The console reports the application status as Protected.
3. Windows Security, Virus and threat protection lists Trend Micro as the registered provider with no second suite alongside it.
4. A manual update and a quick scan both complete.
5. Restart and confirm the product starts on its own and still reports Protected.

Questions people ask about this