Download of WindowsCloudNextGen failed from server http:∕∕dci.sophosupd.com.

Hello Florian Stöffelmayr 

Any traffic inspection from the update IP/URLs can cause issues with an install/update (due to checksums being altered, holding the update files for too long, etc).
 
It is not uncommon to see several devices on the same network update correctly and have others fail to update due to a firewall configuration, as each endpoint may be looking to a different IP/URL for its updates.
 
Your firewall rules need to be checked to include all of the locations listed in this article.

Please check carefully that the full list of IPs and Domains are white-listed and that no traffic from these locations are being scanned or otherwise held in any way by the firewall or other security appliance. For example, SonicWall or any other Firewall AV would need to have whitelisted Sophos locations/ports mentioned in the linked article above.
 
These actions can equally affect the update or install process.

Hello Florian Stöffelmayr 

Any traffic inspection from the update IP/URLs can cause issues with an install/update (due to checksums being altered, holding the update files for too long, etc).
 
It is not uncommon to see several devices on the same network update correctly and have others fail to update due to a firewall configuration, as each endpoint may be looking to a different IP/URL for its updates.
 
Your firewall rules need to be checked to include all of the locations listed in this article.

Please check carefully that the full list of IPs and Domains are white-listed and that no traffic from these locations are being scanned or otherwise held in any way by the firewall or other security appliance. For example, SonicWall or any other Firewall AV would need to have whitelisted Sophos locations/ports mentioned in the linked article above.
 
These actions can equally affect the update or install process.

Hello DianneY,

if I read the logs correctly all requests fail with a 404 returned from the CDN. Thus either the URL paths that AutoUpdate uses are corrupted, which seems unlikely, or there's some other issue but in any case the firewall can't be blamed - at least IMO. Should these files be publicly accessible or are they pinned to credentials (just asking because I checked what I get back from these URLs and it's a 404 as well).

Christian

Hello QC 

Thanks, you're right. Looking at the logs that Florian Stöffelmayr sent, the updating credential used (if you search for username in pastebin) do show that the license for it looks to be from an expired eval license (looking at an internal tool we use here), hence the 404 error.

 Florian Stöffelmayr you might need to contact Support for further assistance if you have purchased a license so that a valid updating credential is assigned.

Hello,

Thank you very much for your repies.

I find it quite intriguing that the missing licence is resulting to a 404 error ;-)

I will check that ASAP

Again, Thanks!

Hello flo,

intriguing
rather confusing than puzzling :).
Looks like an evaluation license is not immediately removed or disabled when it expires. AutoUpdate sees what it thinks is a valid subscription, the catalogs it uses are stale though and the files they are pointing to no longer exist.

Christian 

Yeah I contacted my boss who is in charge of licensing...

On the Central Admin License Details Page, License is expired:

And as you can See, Evaluation Licenses "Expiring 2999" in https://cloud.sophos.com/manage/partner/endpoint/licenses/over-usage,  and  https://cloud.sophos.com/manage/partner/endpoint/licenses/expired says "0 expired Licenses" though on the Central Admin interface it shows "License Expired"

That seems to be a bug in Sophos Central, should we report it?

Hello Florian Stöffelmayr 

It won't be a bug per se, but will be more of a licensing issue where an updating credential was assigned to some incorrect license. Customer Care should be able to address this licensing issue.

Regards,