Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 14 subscribers
  • Views 8191 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failed to install ntp64: general error - Windows 10

CapMReynolds

Hello!

We have been seeing the Failed to install ntp64: general error in a lot of our machines since around November.   Most of the computers affected were new machines we imaged with SCCM.  I see that this error was common with Windows 7 due to an update and I was wondering if that is the case here.  I believe all machines should be Windows 10 build version 2004.

Is there a fix, or do I need to reinstall?  The last time I tried to uninstall it didn't, and then I was locked out of Tamper Protection and it was showing it was still on, even though I turned it off...

Thank you in advance!

James



This thread was automatically locked due to age.
  • 0

    Could you link an install log from a client?  If AutoUpdate keeps retrying evert hour to install, which it should be, there will probably be quite a few under \windows\temp\

    E.g.
    Sophos Network Threat Protection Install Log 20210203 150932.txt

    Thanks.

  • 0 in reply to Sophos User930

    I will put a log file when I am on site on Monday.  Thanks!

  • 0 in reply to Sophos User930

    I did not get a chance to see these machines this past week but its on my radar for Monday.

    I suspect that the issue was due to a permissions issue we had while we were imaging so it affected the install of Sophos and prevented the components from installing.  We have fixed our SCCM which in turn has installed Sophos without further issue.

  • 0 in reply to CapMReynolds

    OK, well any issues, feel free to submit any logs.

  • 0 in reply to Sophos User930

    I will, all of the computers with this message are laptops so those users are all remote and none are online ><  I should get at least one of the users on Monday.

  • 0 in reply to Sophos User930

    Since I can't upload the text file, here is the log:

    ProductSetup::ProductSetup: Begin product setup
    ProductSetup::InstUninstEntry: Begin install
    setup::TamperProtectionControl::TamperProtectionControl: Disabled tamper protection for component NTP
    setup::TamperProtectionControl::TamperProtectionControl: Disabled tamper protection for service Sophos Network Threat Protection
    setup::TamperProtectionControl::TamperProtectionControl: Disabled tamper protection for service sntp
    ProductSetup::InstUninstEntry: Show gui: false
    ProductSetup::InstUninstEntry: Existing product code: {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
    ProductSetup::InstUninstEntry: Install from: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64
    ProductSetup::InstUninstEntry: Install to: <default>
    === Verbose logging started: 2/14/2021 18:01:45 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\su-setup32.exe ===
    MSI (c) (F4:F0) [18:01:45:457]: Cloaking enabled.
    MSI (c) (F4:F0) [18:01:45:457]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (F4:F0) [18:01:45:473]: End dialog not enabled
    MSI (c) (F4:F0) [18:01:45:473]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
    MSI (c) (F4:F0) [18:01:45:473]: Package we're running from ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
    MSI (c) (F4:F0) [18:01:45:473]: Machine policy value 'DisableUserInstalls' is 0
    MSI (c) (F4:F0) [18:01:45:473]: APPCOMPAT: Compatibility mode property overrides found.
    MSI (c) (F4:F0) [18:01:45:473]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'.
    MSI (c) (F4:F0) [18:01:45:473]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (F4:F0) [18:01:45:488]: MSCOREE not loaded loading copy from system32
    MSI (c) (F4:F0) [18:01:45:488]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'.
    MSI (c) (F4:F0) [18:01:45:488]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (F4:F0) [18:01:45:488]: Transforms are not secure.
    MSI (c) (F4:F0) [18:01:45:488]: Note: 1: 2205 2: 3: Control
    MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos Network Threat Protection Install Log 20210214 180145.txt'.
    MSI (c) (F4:F0) [18:01:45:488]: No Command Line.
    MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{BDBDC64C-EB88-4135-BD3F-FE19CA9893E3}'.
    MSI (c) (F4:F0) [18:01:45:488]: Product Code passed to Engine.Initialize: '(none)'
    MSI (c) (F4:F0) [18:01:45:488]: Product Code from property table before transforms: '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'
    MSI (c) (F4:F0) [18:01:45:488]: Product Code from property table after transforms: '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'
    MSI (c) (F4:F0) [18:01:45:488]: Product not registered: beginning first-time install
    MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (c) (F4:F0) [18:01:45:488]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
    MSI (c) (F4:F0) [18:01:45:488]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (c) (F4:F0) [18:01:45:488]: User policy value 'SearchOrder' is 'nmu'
    MSI (c) (F4:F0) [18:01:45:488]: Adding new sources is allowed.
    MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (c) (F4:F0) [18:01:45:488]: Package name extracted from package path: 'Sophos Network Threat Protection.msi'
    MSI (c) (F4:F0) [18:01:45:488]: Package to be registered: 'Sophos Network Threat Protection.msi'
    MSI (c) (F4:F0) [18:01:45:488]: Note: 1: 2262 2: AdminProperties 3: -2147287038
    MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (c) (F4:F0) [18:01:45:488]: TRANSFORMS property is now:
    MSI (c) (F4:F0) [18:01:45:488]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'.
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (c) (F4:F0) [18:01:45:488]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
    MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (c) (F4:F0) [18:01:45:504]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    MSI (c) (F4:F0) [18:01:45:504]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
    MSI (c) (F4:F0) [18:01:45:519]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
    MSI (c) (F4:F0) [18:01:45:519]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (c) (F4:F0) [18:01:45:519]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'PBC-COM'.
    MSI (c) (F4:F0) [18:01:45:519]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'COMPHX'.
    MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi'.
    MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi'.
    MSI (c) (F4:F0) [18:01:45:519]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (c) (F4:F0) [18:01:45:519]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
    MSI (c) (F4:F0) [18:01:45:519]: EEUI - Disabling MsiEmbeddedUI in quiet mode
    === Logging started: 2/14/2021 18:01:45 ===
    MSI (c) (F4:F0) [18:01:45:519]: Machine policy value 'DisableRollback' is 0
    MSI (c) (F4:F0) [18:01:45:519]: User policy value 'DisableRollback' is 0
    MSI (c) (F4:F0) [18:01:45:519]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    MSI (c) (F4:F0) [18:01:45:519]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (c) (F4:F0) [18:01:45:519]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
    MSI (c) (F4:F0) [18:01:45:519]: Creating MSIHANDLE (1) of type 790537 for thread 5616
    MSI (c) (F4:F0) [18:01:45:519]: MsiOpenPackageEx is returning 0
    MSI (c) (F4:F0) [18:01:45:519]: Closing MSIHANDLE (1) of type 790537 for thread 5616
    === Verbose logging stopped: 2/14/2021 18:01:45 ===

    setup::MsiInstaller::install: New version: {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}, version: 1.11.194.0
    === Verbose logging started: 2/14/2021 18:01:45 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\su-setup32.exe ===
    MSI (c) (F4:F0) [18:01:45:551]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\WINDOWS\Installer\4978e5.msi' against software restriction policy
    MSI (c) (F4:F0) [18:01:45:551]: SOFTWARE RESTRICTION POLICY: C:\WINDOWS\Installer\4978e5.msi has a digital signature
    MSI (c) (F4:F0) [18:01:45:551]: SOFTWARE RESTRICTION POLICY: C:\WINDOWS\Installer\4978e5.msi is permitted to run because the user token authorizes execution (system or service token).
    MSI (c) (F4:F0) [18:01:45:551]: Cloaking enabled.
    MSI (c) (F4:F0) [18:01:45:551]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (F4:F0) [18:01:45:551]: End dialog not enabled
    MSI (c) (F4:F0) [18:01:45:551]: Original package ==> C:\WINDOWS\Installer\4978e5.msi
    MSI (c) (F4:F0) [18:01:45:551]: Package we're running from ==> C:\WINDOWS\Installer\4978e5.msi
    MSI (c) (F4:F0) [18:01:45:551]: APPCOMPAT: Uninstall Flags override found.
    MSI (c) (F4:F0) [18:01:45:551]: APPCOMPAT: Uninstall VersionNT override found.
    MSI (c) (F4:F0) [18:01:45:551]: APPCOMPAT: Uninstall ServicePackLevel override found.
    MSI (c) (F4:F0) [18:01:45:551]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
    MSI (c) (F4:F0) [18:01:45:551]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (F4:F0) [18:01:45:566]: MSCOREE not loaded loading copy from system32
    MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'DisablePatch' is 0
    MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'AllowLockdownPatch' is 0
    MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'DisableLUAPatching' is 0
    MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'DisableFlyWeightPatching' is 0
    MSI (c) (F4:F0) [18:01:45:566]: Enabling baseline caching for this transaction since all active patches are MSI 3.0 style MSPs or at least one MSI 3.0 minor update patch is active
    MSI (c) (F4:F0) [18:01:45:566]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
    MSI (c) (F4:F0) [18:01:45:566]: APPCOMPAT: no matching ProductCode found in database.
    MSI (c) (F4:F0) [18:01:45:566]: Transforms are not secure.
    MSI (c) (F4:F0) [18:01:45:566]: Note: 1: 2205 2: 3: Control
    MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos Network Threat Protection Install Log 20210214 180145.txt'.
    MSI (c) (F4:F0) [18:01:45:566]: No Command Line.
    MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{0B95A4E2-4953-4CE7-B8F7-53BB197E234A}'.
    MSI (c) (F4:F0) [18:01:45:566]: Product Code passed to Engine.Initialize: '(none)'
    MSI (c) (F4:F0) [18:01:45:566]: Product Code from property table before transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
    MSI (c) (F4:F0) [18:01:45:566]: Product Code from property table after transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
    MSI (c) (F4:F0) [18:01:45:566]: Product registered: entering maintenance mode
    MSI (c) (F4:F0) [18:01:45:566]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
    MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding ProductState property. Its value is '5'.
    MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'.
    MSI (c) (F4:F0) [18:01:45:566]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
    MSI (c) (F4:F0) [18:01:45:566]: Package name retrieved from configuration data: 'Sophos Network Threat Protection.msi'
    MSI (c) (F4:F0) [18:01:45:566]: Note: 1: 2262 2: AdminProperties 3: -2147287038
    MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'DisableMsi' is 0
    MSI (c) (F4:F0) [18:01:45:566]: Machine policy value 'AlwaysInstallElevated' is 0
    MSI (c) (F4:F0) [18:01:45:566]: User policy value 'AlwaysInstallElevated' is 0
    MSI (c) (F4:F0) [18:01:45:566]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is admin assigned: LocalSystem owns the publish key.
    MSI (c) (F4:F0) [18:01:45:566]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is managed.
    MSI (c) (F4:F0) [18:01:45:566]: Running product '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}' with elevated privileges: Product is assigned.
    MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (c) (F4:F0) [18:01:45:566]: TRANSFORMS property is now:
    MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding PRODUCTLANGUAGE property. Its value is '1033'.
    MSI (c) (F4:F0) [18:01:45:566]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'.
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (c) (F4:F0) [18:01:45:566]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    MSI (c) (F4:F0) [18:01:45:566]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
    MSI (c) (F4:F0) [18:01:45:582]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
    MSI (c) (F4:F0) [18:01:45:582]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (c) (F4:F0) [18:01:45:582]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'PBC-COM'.
    MSI (c) (F4:F0) [18:01:45:582]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'COMPHX'.
    MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding Installed property. Its value is '00:00:00'.
    MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\WINDOWS\Installer\4978e5.msi'.
    MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\WINDOWS\Installer\4978e5.msi'.
    MSI (c) (F4:F0) [18:01:45:582]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (c) (F4:F0) [18:01:45:582]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
    MSI (c) (F4:F0) [18:01:45:582]: EEUI - Disabling MsiEmbeddedUI in quiet mode
    === Logging started: 2/14/2021 18:01:45 ===
    MSI (c) (F4:F0) [18:01:45:582]: Note: 1: 2205 2: 3: PatchPackage
    MSI (c) (F4:F0) [18:01:45:582]: Machine policy value 'DisableRollback' is 0
    MSI (c) (F4:F0) [18:01:45:582]: User policy value 'DisableRollback' is 0
    MSI (c) (F4:F0) [18:01:45:582]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    MSI (c) (F4:F0) [18:01:45:582]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (c) (F4:F0) [18:01:45:582]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
    MSI (c) (F4:F0) [18:01:45:582]: Creating MSIHANDLE (2) of type 790537 for thread 5616
    MSI (c) (F4:F0) [18:01:45:582]: MsiOpenPackageEx is returning 0
    MSI (c) (F4:F0) [18:01:45:582]: MsiOpenPackage is returning 0
    MSI (c) (F4:F0) [18:01:45:582]: Closing MSIHANDLE (2) of type 790537 for thread 5616
    === Verbose logging stopped: 2/14/2021 18:01:45 ===

    setup::MsiInstaller::install: Installed version: {4B1F9009-CD85-43C0-BCBD-D491908D5A52}, version: 1.9.2235.0
    setup::MsiInstaller::install: Removing IPS rules registry values because the product code or version is different
    setup::MsiInstaller::install: Performing major upgrade
    setup::MsiInstaller::cleanInstall: Running clean install
    setup::MsiInstaller::installOrUpgrade: Executing: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi INSTALLDIR="" REBOOT=ReallySuppress INSTALLINGVERSION="1.11.194.0" ARPSYSTEMCOMPONENT=1
    setup::MsiInstaller::tryRunMsi: Running MSI command, attempt (1 of 10)
    === Verbose logging started: 2/14/2021 18:01:45 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\su-setup32.exe ===
    MSI (c) (F4:3C) [18:01:45:676]: Resetting cached policy values
    MSI (c) (F4:3C) [18:01:45:676]: Machine policy value 'Debug' is 0
    MSI (c) (F4:3C) [18:01:45:676]: ******* RunEngine:
    ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
    ******* Action:
    ******* CommandLine: **********
    MSI (c) (F4:3C) [18:01:45:676]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (F4:3C) [18:01:45:676]: Grabbed execution mutex.
    MSI (c) (F4:3C) [18:01:45:676]: Cloaking enabled.
    MSI (c) (F4:3C) [18:01:45:676]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (F4:3C) [18:01:45:676]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (20:DC) [18:01:45:676]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
    MSI (s) (20:DC) [18:01:45:676]: Grabbed execution mutex.
    MSI (s) (20:00) [18:01:45:691]: Resetting cached policy values
    MSI (s) (20:00) [18:01:45:691]: Machine policy value 'Debug' is 0
    MSI (s) (20:00) [18:01:45:691]: ******* RunEngine:
    ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
    ******* Action:
    ******* CommandLine: **********
    MSI (s) (20:00) [18:01:45:691]: Machine policy value 'DisableUserInstalls' is 0
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 00006109C80000000100000000F01FEC
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 00006109C80000000100000000F01FEC
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 00006109C80090400100000000F01FEC
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 00006109C80090400100000000F01FEC
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 00006109E70000000100000000F01FEC
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 00006109E70000000100000000F01FEC
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 1A9098E3DF554C64F80C06343133A12A
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 1A9098E3DF554C64F80C06343133A12A
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 30E9055DEC34B074CB47440033875276
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 30E9055DEC34B074CB47440033875276
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 44DB0475D85BA123FA0CD6D35465DDC6
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 44DB0475D85BA123FA0CD6D35465DDC6
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 51DDCFE42A4298D4484A58D7B16FF88A
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 51DDCFE42A4298D4484A58D7B16FF88A
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 5C793CEDE7B8FEA47894C96DDD001D0C
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 5C793CEDE7B8FEA47894C96DDD001D0C
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 61A5A901E90E28B47A481D87F011096D
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 61A5A901E90E28B47A481D87F011096D
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 68AB67CA7DA73301B744CAF070E41400
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 68AB67CA7DA73301B744CAF070E41400
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 71DCBBF1304249742B8A3ADADDB3A08F
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 71DCBBF1304249742B8A3ADADDB3A08F
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 7B31A6F17A59782499A4C68EC265845E
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 7B31A6F17A59782499A4C68EC265845E
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 810B660DB8445C04094352B9CB4C3915
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 810B660DB8445C04094352B9CB4C3915
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 8520DAD7C5154DD39846DB1714990E7F
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 8520DAD7C5154DD39846DB1714990E7F
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 89A6161325839E94DB6D771ABA5875A1
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 89A6161325839E94DB6D771ABA5875A1
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 96F071321C0420729100000010000000
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 96F071321C0420729100000010000000
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: 99E80CA9B0328e74791254777B1F42AE
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: 99E80CA9B0328e74791254777B1F42AE
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: A49D3069829097449B5C9CDB74DE89F0
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: A49D3069829097449B5C9CDB74DE89F0
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: AAB6F137689A4A549863C7A3AAAA67B0
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: AAB6F137689A4A549863C7A3AAAA67B0
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: AD8F0D823DBB4454492E8DBEA63BB91F
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: AD8F0D823DBB4454492E8DBEA63BB91F
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: C21BB7D84586FD646AD78FD277D8578C
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: C21BB7D84586FD646AD78FD277D8578C
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: C94587080FFC5C84B977B64AA84176D3
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: C94587080FFC5C84B977B64AA84176D3
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: CAFC5ACA99E946747ADAFAC53FAF51FB
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: CAFC5ACA99E946747ADAFAC53FAF51FB
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: D2821382915801943B93322048A0EB3F
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: D2821382915801943B93322048A0EB3F
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: DCDEC83B99B45A244A039364FFAC22A9
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: DCDEC83B99B45A244A039364FFAC22A9
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: DFDFBE4C55C0F5E39A913E5C949420A4
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: DFDFBE4C55C0F5E39A913E5C949420A4
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: F40B9456628EA0E4C8F38358040F5814
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: F40B9456628EA0E4C8F38358040F5814
    MSI (s) (20:00) [18:01:45:691]: Setting cached product context: machine assigned for product: FED6F71CC43D57B4791E8D012604B8A4
    MSI (s) (20:00) [18:01:45:691]: Using cached product context: machine assigned for product: FED6F71CC43D57B4791E8D012604B8A4
    MSI (s) (20:00) [18:01:45:691]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (20:00) [18:01:45:691]: SRSetRestorePoint skipped for this transaction.
    MSI (s) (20:00) [18:01:45:691]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
    MSI (s) (20:00) [18:01:45:691]: File will have security applied from OpCode.
    MSI (s) (20:00) [18:01:45:691]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi' against software restriction policy
    MSI (s) (20:00) [18:01:45:707]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi has a digital signature
    MSI (s) (20:00) [18:01:45:707]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi is permitted to run because the user token authorizes execution (system or service token).
    MSI (s) (20:00) [18:01:45:707]: Creating MSIHANDLE (1) of type 790542 for thread 8960
    MSI (s) (20:00) [18:01:45:707]: MSCOREE not loaded loading copy from system32
    MSI (s) (20:00) [18:01:45:707]: End dialog not enabled
    MSI (s) (20:00) [18:01:45:707]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
    MSI (s) (20:00) [18:01:45:707]: Package we're running from ==> C:\WINDOWS\Installer\5e8d70f4.msi
    MSI (s) (20:00) [18:01:45:707]: APPCOMPAT: Compatibility mode property overrides found.
    MSI (s) (20:00) [18:01:45:707]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'.
    MSI (s) (20:00) [18:01:45:707]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (20:00) [18:01:45:723]: Machine policy value 'TransformsSecure' is 0
    MSI (s) (20:00) [18:01:45:723]: User policy value 'TransformsAtSource' is 0
    MSI (s) (20:00) [18:01:45:723]: Machine policy value 'DisablePatch' is 0
    MSI (s) (20:00) [18:01:45:723]: Machine policy value 'AllowLockdownPatch' is 0
    MSI (s) (20:00) [18:01:45:723]: Machine policy value 'DisableLUAPatching' is 0
    MSI (s) (20:00) [18:01:45:723]: Machine policy value 'DisableFlyWeightPatching' is 0
    MSI (s) (20:00) [18:01:45:723]: Enabling baseline caching for this transaction since all active patches are MSI 3.0 style MSPs or at least one MSI 3.0 minor update patch is active
    MSI (s) (20:00) [18:01:45:723]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'.
    MSI (s) (20:00) [18:01:45:723]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (20:00) [18:01:45:723]: Transforms are not secure.
    MSI (s) (20:00) [18:01:45:723]: Note: 1: 2205 2: 3: Control
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos Network Threat Protection Install Log 20210214 180145.txt'.
    MSI (s) (20:00) [18:01:45:723]: Command Line: INSTALLDIR= REBOOT=ReallySuppress INSTALLINGVERSION=1.11.194.0 ARPSYSTEMCOMPONENT=1 CURRENTDIRECTORY=C:\WINDOWS\system32 CLIENTUILEVEL=3 MSICLIENTUSESEXTERNALUI=1 CLIENTPROCESSID=1012
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{BDBDC64C-EB88-4135-BD3F-FE19CA9893E3}'.
    MSI (s) (20:00) [18:01:45:723]: Product Code passed to Engine.Initialize: ''
    MSI (s) (20:00) [18:01:45:723]: Product Code from property table before transforms: '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'
    MSI (s) (20:00) [18:01:45:723]: Product Code from property table after transforms: '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'
    MSI (s) (20:00) [18:01:45:723]: Product not registered: beginning first-time install
    MSI (s) (20:00) [18:01:45:723]: Product {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA} is not managed.
    MSI (s) (20:00) [18:01:45:723]: MSI_LUA: Credential prompt not required, user is an admin
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (s) (20:00) [18:01:45:723]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (s) (20:00) [18:01:45:723]: User policy value 'SearchOrder' is 'nmu'
    MSI (s) (20:00) [18:01:45:723]: Adding new sources is allowed.
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (s) (20:00) [18:01:45:723]: Package name extracted from package path: 'Sophos Network Threat Protection.msi'
    MSI (s) (20:00) [18:01:45:723]: Package to be registered: 'Sophos Network Threat Protection.msi'
    MSI (s) (20:00) [18:01:45:723]: Note: 1: 2262 2: AdminProperties 3: -2147287038
    MSI (s) (20:00) [18:01:45:723]: Machine policy value 'DisableMsi' is 0
    MSI (s) (20:00) [18:01:45:723]: Machine policy value 'AlwaysInstallElevated' is 0
    MSI (s) (20:00) [18:01:45:723]: User policy value 'AlwaysInstallElevated' is 0
    MSI (s) (20:00) [18:01:45:723]: Product installation will be elevated because user is admin and product is being installed per-machine.
    MSI (s) (20:00) [18:01:45:723]: Running product '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}' with elevated privileges: Product is assigned.
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding REBOOT property. Its value is 'ReallySuppress'.
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding INSTALLINGVERSION property. Its value is '1.11.194.0'.
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding ARPSYSTEMCOMPONENT property. Its value is '1'.
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\WINDOWS\system32'.
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding MSICLIENTUSESEXTERNALUI property. Its value is '1'.
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '1012'.
    MSI (s) (20:00) [18:01:45:723]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
    MSI (s) (20:00) [18:01:45:723]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (s) (20:00) [18:01:45:723]: TRANSFORMS property is now:
    MSI (s) (20:00) [18:01:45:723]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'.
    MSI (s) (20:00) [18:01:45:723]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
    MSI (s) (20:00) [18:01:45:723]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
    MSI (s) (20:00) [18:01:45:723]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (s) (20:00) [18:01:45:723]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (s) (20:00) [18:01:45:738]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    MSI (s) (20:00) [18:01:45:738]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
    MSI (s) (20:00) [18:01:45:754]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (s) (20:00) [18:01:45:754]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'PBC-COM'.
    MSI (s) (20:00) [18:01:45:754]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'COMPHX'.
    MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\WINDOWS\Installer\5e8d70f4.msi'.
    MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi'.
    MSI (s) (20:00) [18:01:45:754]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (s) (20:00) [18:01:45:754]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
    MSI (s) (20:00) [18:01:45:754]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
    MSI (s) (20:00) [18:01:45:754]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (20:00) [18:01:45:754]: Machine policy value 'DisableRollback' is 0
    MSI (s) (20:00) [18:01:45:754]: User policy value 'DisableRollback' is 0
    MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    === Logging started: 2/14/2021 18:01:45 ===
    MSI (s) (20:00) [18:01:45:754]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (20:00) [18:01:45:754]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
    MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
    MSI (s) (20:00) [18:01:45:754]: Doing action: INSTALL
    MSI (s) (20:00) [18:01:45:754]: Note: 1: 2205 2: 3: ActionText
    Action start 18:01:45: INSTALL.
    MSI (s) (20:00) [18:01:45:754]: Running ExecuteSequence
    MSI (s) (20:00) [18:01:45:754]: Doing action: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C
    MSI (s) (20:00) [18:01:45:754]: Note: 1: 2205 2: 3: ActionText
    MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C property. Its value is 'C:\WINDOWS\system32\'.
    Action start 18:01:45: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C.
    MSI (s) (20:00) [18:01:45:754]: Doing action: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA
    MSI (s) (20:00) [18:01:45:754]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:45: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C. Return value 1.
    MSI (s) (20:00) [18:01:45:754]: PROPERTY CHANGE: Adding SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA property. Its value is 'C:\WINDOWS\SysWOW64\'.
    Action start 18:01:45: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA.
    MSI (s) (20:00) [18:01:45:754]: Doing action: FindRelatedProducts
    MSI (s) (20:00) [18:01:45:754]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:45: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA. Return value 1.
    MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    Action start 18:01:45: FindRelatedProducts.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding WIX_UPGRADE_DETECTED property. Its value is '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding MIGRATE property. Its value is '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
    MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:00) [18:01:45:769]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:00) [18:01:45:769]: Doing action: AppSearch
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:45: FindRelatedProducts. Return value 1.
    Action start 18:01:45: AppSearch.
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2262 2: Signature 3: -2147287038
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding INSTALLTYPE_IS_CENTRAL property. Its value is '#1'.
    MSI (s) (20:00) [18:01:45:769]: Doing action: LaunchConditions
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:45: AppSearch. Return value 1.
    Action start 18:01:45: LaunchConditions.
    MSI (s) (20:00) [18:01:45:769]: Doing action: ValidateProductID
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:45: LaunchConditions. Return value 1.
    Action start 18:01:45: ValidateProductID.
    MSI (s) (20:00) [18:01:45:769]: Skipping action: TamperProtectionCheckRemove (condition is false)
    MSI (s) (20:00) [18:01:45:769]: Doing action: CostInitialize
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:45: ValidateProductID. Return value 1.
    MSI (s) (20:00) [18:01:45:769]: Machine policy value 'MaxPatchCacheSize' is 10
    MSI (s) (20:00) [18:01:45:769]: Baseline: Sorting baselines for {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}.
    MSI (s) (20:00) [18:01:45:769]: Baseline: New baseline 1.11.194 from transaction.
    MSI (s) (20:00) [18:01:45:769]: Baseline: Sorted order Native: Order 0.
    MSI (s) (20:00) [18:01:45:769]: Baseline Data Table:
    MSI (s) (20:00) [18:01:45:769]: ProductCode: {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA} Version: 1.11.194 Attributes: 0 PatchId: Native BaselineId: -2147483648 Order: 0
    MSI (s) (20:00) [18:01:45:769]: Baseline File Table:
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'C:\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'.
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Patch
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: MsiPatchHeaders
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: __MsiPatchFileList
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId`
    MSI (s) (20:00) [18:01:45:769]: Delta compression fallback method for this product transaction is 'MSI 2.0 legacy obsolescence'
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Patch
    Action start 18:01:45: CostInitialize.
    MSI (s) (20:00) [18:01:45:769]: Doing action: FileCost
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:45: CostInitialize. Return value 1.
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: MsiAssembly
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Class
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Extension
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: TypeLib
    Action start 18:01:45: FileCost.
    MSI (s) (20:00) [18:01:45:769]: Doing action: CostFinalize
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:45: FileCost. Return value 1.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'.
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Patch
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: Condition
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'C:\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 property. Its value is 'C:\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SophosAppData property. Its value is 'C:\ProgramData\Sophos\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding HeartbeatData property. Its value is 'C:\ProgramData\Sophos\Heartbeat\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding HeartbeatPersist property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Persist\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding HeartbeatLogs property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Logs\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding HeartbeatConfig property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Config\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding ProductData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SnortData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding Logs property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding Config property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding Status property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding Sophos property. Its value is 'C:\Program Files\Sophos\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding plugins property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SnortConfDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SnortPreProcDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SnortDynModulesDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\'.
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding SophosNTPLWFDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\'.
    MSI (s) (20:00) [18:01:45:769]: Target path resolution complete. Dumping Directory table...
    MSI (s) (20:00) [18:01:45:769]: Note: target paths subject to change (via custom actions or browsing)
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: TARGETDIR , Object: C:\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: WindowsFolder , Object: C:\WINDOWS\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: System64Folder , Object: C:\WINDOWS\system32\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C , Object: C:\WINDOWS\system32\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SystemFolder , Object: C:\WINDOWS\SysWOW64\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA , Object: C:\WINDOWS\SysWOW64\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: CommonAppDataFolder , Object: C:\ProgramData\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SophosAppData , Object: C:\ProgramData\Sophos\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: HeartbeatData , Object: C:\ProgramData\Sophos\Heartbeat\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: HeartbeatPersist , Object: C:\ProgramData\Sophos\Heartbeat\Persist\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: HeartbeatLogs , Object: C:\ProgramData\Sophos\Heartbeat\Logs\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: HeartbeatConfig , Object: C:\ProgramData\Sophos\Heartbeat\Config\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: ProductData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SnortData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: Logs , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: Config , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: Status , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: ProgramFiles64Folder , Object: C:\Program Files\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: Sophos , Object: C:\Program Files\Sophos\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: INSTALLDIR , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: plugins , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SnortConfDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SnortPreProcDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SnortDynModulesDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\
    MSI (s) (20:00) [18:01:45:769]: Dir (target): Key: SophosNTPLWFDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\
    MSI (s) (20:00) [18:01:45:769]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'.
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2205 2: 3: MsiAssembly
    MSI (s) (20:00) [18:01:45:769]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?
    MSI (s) (20:00) [18:01:45:769]: Disallowing installation of component: {14E8634F-8AEA-4CD1-AC48-BEBFDA18523A} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:785]: Disallowing installation of component: {570C624B-D57C-4CD1-9013-1B80C800093B} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:785]: Disallowing installation of component: {E5B92048-5859-4AF1-AEAD-B97EBF00B087} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:785]: Disallowing installation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:785]: Disallowing installation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:785]: Disallowing installation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:801]: Disallowing installation of component: {4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1} since the keyfile exists and the component is marked to never overwrite existing installations
    Action start 18:01:45: CostFinalize.
    MSI (s) (20:00) [18:01:45:801]: Doing action: MigrateFeatureStates
    MSI (s) (20:00) [18:01:45:801]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:45: CostFinalize. Return value 1.
    MSI (s) (20:00) [18:01:45:801]: Migrating feature settings from product(s) '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
    MSI (s) (20:00) [18:01:45:816]: MigrateFeatureStates: based on existing product, setting feature 'AllComponents' to 'Local' state.
    MSI (s) (20:00) [18:01:45:816]: Disallowing installation of component: {4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1} since the keyfile exists and the component is marked to never overwrite existing installations
    MSI (s) (20:00) [18:01:45:832]: Disallowing installation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:832]: Disallowing installation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:832]: Disallowing installation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:832]: Disallowing installation of component: {E5B92048-5859-4AF1-AEAD-B97EBF00B087} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:832]: Disallowing installation of component: {570C624B-D57C-4CD1-9013-1B80C800093B} since the same component with higher versioned keyfile exists
    MSI (s) (20:00) [18:01:45:847]: Disallowing installation of component: {14E8634F-8AEA-4CD1-AC48-BEBFDA18523A} since the same component with higher versioned keyfile exists
    Action start 18:01:45: MigrateFeatureStates.
    MSI (s) (20:00) [18:01:45:847]: Doing action: InstallValidate
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:45: MigrateFeatureStates. Return value 1.
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: Dialog
    MSI (s) (20:00) [18:01:45:847]: Feature: AllComponents; Installed: Absent; Request: Local; Action: Local
    MSI (s) (20:00) [18:01:45:847]: Component: InstallationFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: ProductDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: ConfigDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: StatusFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: LogsDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: SnortDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatProductDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatConfigFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatLogsFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatPersistFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: Driver; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: LWF; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: navl.dll; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: integrity.dat; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: ProductInformation; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: ServiceInstallWin8Plus; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: ServiceInstallWin7Only; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: ServiceCommon; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: NTPAdapter; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: Heartbeat.dll; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatRegistry; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: HeartbeatNativeRegistry; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: Heartbeat.xml; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: Notice.txt; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: HealthApi; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: HbtAdapter; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: SspInterface; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: Telemetry.exe; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: TelemetryRegistry; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: RemoveObsoleteAutoUpdateRegistration; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: ScfDat; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: SofDat; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: SnortExe; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: SnortDynModules; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: SnortDynPreProc; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: SnortConf; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: SnortDefaultRules; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_40D84364EA842FA136B8FD13DDC0D56B; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_39878D1E6847FC98DBBF4DBC681E5084; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_915D4DE5AC2958F4E9E11A531B9EA835; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_9E6863D5DA03BD69631F202C92D19A60; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_71A947406F71D3B309E337B64A7F7832; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_E78A19C76D60702926ABE2296C875F1E; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_4C8A5B3AC90DB17E9DA4ED49BAD39538; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_8ECE5DB0F042F762611EBFD2289574C7; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_CEECECE51D82B086879DBF78B65862E7; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_7CF78A9132C1A81C68F7ABC5FDF24E2A; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_DA1F2B183C5BCE4FD603A6EC3B54243A; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_28A5FAF0643E13309FAFC807839EC90D; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_B661BE2CDE2C76B03E876B04E7FB2B12; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_3893BC5956C7BE355DDE9E37446A6D03; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_EBDC9486A0E1230D5EC092D7E8CBB4BC; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_1C9216A348BA2BDC09A1060BA5F72823; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_7ADD905B2E5619CCA9D17EEC5053A4A6; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_14CC9F77B2DFDC9FD42754DAA16F7D2C; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_52DCF994F3D451DE25E6C6175FA8A569; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_3D360AE2084BA5DD98F03E35FC2A4426; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_16CE291FE9D32F0D2F408BCBC247D190; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_8AF263AEF732721ECE1F45C4D699210A; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_9AF859CEDF9D329E2E6CD220D4A89A0C; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_B688306A458B84E28816F8D6778A34E1; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_A3F6487E5CC9E500FA56EEAB3F26C1C8; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_7AEC367EBDB5BF4C39E3667551695B48; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_E7E3239C29419031F40F31EABB9C5C5A; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_D089A4389D1A4310245EFD436E285512; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_13CF16406E509062B6836D9F815D988F; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_0C0C9CFE97F0C684A8B464A70B0DB6D3; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_3AE2E2073BC5F8F5B9E80E6F52F9EE7C; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_BF934AA7F81A8CB8E376BAB607CA930F; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_B52FC07FFE74FDCB8247ACBE7F11134A; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_13497740688A2F012E248B466BEDADA8; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_12A8AFCDF13801350D980FEC432E08AB; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_B4FFE1991E42464048BC746529DD8726; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_B1BC50FE23021C628A3A572821D40D62; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_0EBC8368A1140301A827EFC762022373; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_2E9EA86FD6182A7FC5F64866BE3922CB; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_5BF7215406895F158FD7F8CD49117FB7; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_C76CDD15946ADD012F33BACEBF54EBBD; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_F36646D6066C98ADFB776FB7983F5D92; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_D6ED6891FB6E750E41BCBFA158FE52AB; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_E04EEE8DCDEFB517011CE58E0BB9CD09; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_CC76C1F8918257084D13AF2045641E6E; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: cmp64_792D7E761DFC7E91E500387604E2A68D; Installed: Absent; Request: Local; Action: Local; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: C_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Null; Client State: Unknown
    MSI (s) (20:00) [18:01:45:847]: Component: __ServiceCommon65; Installed: Null; Request: Local; Action: Local; Client State: Null
    MSI (s) (20:00) [18:01:45:847]: Component: __TelemetryRegistry65; Installed: Null; Request: Local; Action: Local; Client State: Null
    MSI (s) (20:00) [18:01:45:847]: Component: __ProductInformation65; Installed: Null; Request: Local; Action: Local; Client State: Null
    MSI (s) (20:00) [18:01:45:847]: Component: __HeartbeatRegistry65; Installed: Null; Request: Local; Action: Local; Client State: Null
    MSI (s) (20:00) [18:01:45:847]: Component: __HeartbeatNativeRegistry65; Installed: Null; Request: Local; Action: Local; Client State: Null
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: BindImage
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: ProgId
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: PublishComponent
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: SelfReg
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: Extension
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: Font
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: Shortcut
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: Class
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: TypeLib
    Action start 18:01:45: InstallValidate.
    MSI (s) (20:00) [18:01:45:847]: Note: 1: 2205 2: 3: _RemoveFilePath
    MSI (s) (20:00) [18:01:46:207]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'.
    MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: BindImage
    MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: ProgId
    MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: PublishComponent
    MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: SelfReg
    MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: Extension
    MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: Font
    MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: Shortcut
    MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: Class
    MSI (s) (20:00) [18:01:46:207]: Note: 1: 2205 2: 3: TypeLib
    MSI (s) (20:00) [18:01:46:207]: Note: 1: 2727 2:
    MSI (s) (20:00) [18:01:47:019]: Note: 1: 2727 2:
    MSI (s) (20:00) [18:01:47:019]: Doing action: RemoveExistingProducts
    MSI (s) (20:00) [18:01:47:019]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: InstallValidate. Return value 1.
    Action start 18:01:47: RemoveExistingProducts.
    MSI (s) (20:4C) [18:01:47:035]: Resetting cached policy values
    MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'Debug' is 0
    MSI (s) (20:4C) [18:01:47:035]: ******* RunEngine:
    ******* Product: {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
    ******* Action:
    ******* CommandLine: **********
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: SRSetRestorePoint skipped for this transaction.
    MSI (s) (20:4C) [18:01:47:035]: Creating MSIHANDLE (2) of type 790542 for thread 8012
    MSI (s) (20:4C) [18:01:47:035]: End dialog not enabled
    MSI (s) (20:4C) [18:01:47:035]: Original package ==> C:\WINDOWS\Installer\4978e5.msi
    MSI (s) (20:4C) [18:01:47:035]: Package we're running from ==> C:\WINDOWS\Installer\4978e5.msi
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: Uninstall Flags override found.
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: Uninstall VersionNT override found.
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: Uninstall ServicePackLevel override found.
    MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
    MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'DisablePatch' is 0
    MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'AllowLockdownPatch' is 0
    MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'DisableLUAPatching' is 0
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'DisableFlyWeightPatching' is 0
    MSI (s) (20:4C) [18:01:47:035]: Enabling baseline caching for this transaction since all active patches are MSI 3.0 style MSPs or at least one MSI 3.0 minor update patch is active
    MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'.
    MSI (s) (20:4C) [18:01:47:035]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (20:4C) [18:01:47:035]: Transforms are not secure.
    MSI (s) (20:4C) [18:01:47:035]: Note: 1: 2205 2: 3: Control
    MSI (s) (20:4C) [18:01:47:035]: Command Line: UPGRADINGPRODUCTCODE={2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA} CLIENTPROCESSID=1012 CLIENTUILEVEL=3 MSICLIENTUSESEXTERNALUI=1 REMOVE=ALL
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{0B95A4E2-4953-4CE7-B8F7-53BB197E234A}'.
    MSI (s) (20:4C) [18:01:47:035]: Product Code passed to Engine.Initialize: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
    MSI (s) (20:4C) [18:01:47:035]: Product Code from property table before transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
    MSI (s) (20:4C) [18:01:47:035]: Product Code from property table after transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'
    MSI (s) (20:4C) [18:01:47:035]: Product registered: entering maintenance mode
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
    MSI (s) (20:4C) [18:01:47:035]: MSI_LUA: Nested installation UAC elevation tracks that of parent (is not elevated)
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is admin assigned: LocalSystem owns the publish key.
    MSI (s) (20:4C) [18:01:47:035]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is managed.
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: MSI_LUA: Credential prompt not required, user is an admin
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding ProductState property. Its value is '5'.
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'.
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Package name retrieved from configuration data: 'Sophos Network Threat Protection.msi'
    MSI (s) (20:4C) [18:01:47:035]: Note: 1: 2262 2: AdminProperties 3: -2147287038
    MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'DisableMsi' is 0
    MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'AlwaysInstallElevated' is 0
    MSI (s) (20:4C) [18:01:47:035]: User policy value 'AlwaysInstallElevated' is 0
    MSI (s) (20:4C) [18:01:47:035]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:035]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is admin assigned: LocalSystem owns the publish key.
    MSI (s) (20:4C) [18:01:47:035]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is managed.
    MSI (s) (20:4C) [18:01:47:035]: Running product '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}' with elevated privileges: Product is assigned.
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding UPGRADINGPRODUCTCODE property. Its value is '{2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}'.
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '1012'.
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding MSICLIENTUSESEXTERNALUI property. Its value is '1'.
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding REMOVE property. Its value is 'ALL'.
    MSI (s) (20:4C) [18:01:47:035]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
    MSI (s) (20:4C) [18:01:47:035]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (s) (20:4C) [18:01:47:035]: TRANSFORMS property is now:
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding PRODUCTLANGUAGE property. Its value is '1033'.
    MSI (s) (20:4C) [18:01:47:035]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'.
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (s) (20:4C) [18:01:47:035]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    MSI (s) (20:4C) [18:01:47:035]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
    MSI (s) (20:4C) [18:01:47:050]: MSI_LUA: Setting AdminUser property to 1 because the product is already installed managed and per-machine
    MSI (s) (20:4C) [18:01:47:050]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (s) (20:4C) [18:01:47:050]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'PBC-COM'.
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'COMPHX'.
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding Installed property. Its value is '00:00:00'.
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\WINDOWS\Installer\4978e5.msi'.
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\WINDOWS\Installer\4978e5.msi'.
    MSI (s) (20:4C) [18:01:47:050]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (s) (20:4C) [18:01:47:050]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI
    MSI (s) (20:4C) [18:01:47:050]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (20:4C) [18:01:47:050]: Machine policy value 'DisableRollback' is 0
    MSI (s) (20:4C) [18:01:47:050]: User policy value 'DisableRollback' is 0
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding Preselected property. Its value is '1'.
    MSI (s) (20:4C) [18:01:47:050]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
    MSI (s) (20:4C) [18:01:47:050]: Doing action: INSTALL
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
    Action start 18:01:47: INSTALL.
    MSI (s) (20:4C) [18:01:47:050]: Running ExecuteSequence
    MSI (s) (20:4C) [18:01:47:050]: Doing action: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C property. Its value is 'C:\WINDOWS\system32\'.
    Action start 18:01:47: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C.
    MSI (s) (20:4C) [18:01:47:050]: Doing action: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C. Return value 1.
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA property. Its value is 'C:\WINDOWS\SysWOW64\'.
    Action start 18:01:47: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA.
    MSI (s) (20:4C) [18:01:47:050]: Doing action: FindRelatedProducts
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA. Return value 1.
    MSI (s) (20:4C) [18:01:47:050]: Skipping FindRelatedProducts action: not run in maintenance mode
    Action start 18:01:47: FindRelatedProducts.
    MSI (s) (20:4C) [18:01:47:050]: Doing action: AppSearch
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: FindRelatedProducts. Return value 0.
    Action start 18:01:47: AppSearch.
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2262 2: Signature 3: -2147287038
    MSI (s) (20:4C) [18:01:47:050]: PROPERTY CHANGE: Adding INSTALLTYPE_IS_CENTRAL property. Its value is '#1'.
    MSI (s) (20:4C) [18:01:47:050]: Doing action: LaunchConditions
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: AppSearch. Return value 1.
    Action start 18:01:47: LaunchConditions.
    MSI (s) (20:4C) [18:01:47:050]: Doing action: ValidateProductID
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: LaunchConditions. Return value 1.
    Action start 18:01:47: ValidateProductID.
    MSI (s) (20:4C) [18:01:47:050]: Skipping action: TamperProtectionCheckRemove (condition is false)
    MSI (s) (20:4C) [18:01:47:050]: Doing action: CostInitialize
    MSI (s) (20:4C) [18:01:47:050]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: ValidateProductID. Return value 1.
    MSI (s) (20:4C) [18:01:47:066]: Machine policy value 'MaxPatchCacheSize' is 10
    MSI (s) (20:4C) [18:01:47:066]: Baseline: Sorting baselines for {4B1F9009-CD85-43C0-BCBD-D491908D5A52}.
    MSI (s) (20:4C) [18:01:47:066]: Baseline: New baseline 1.9.2235 from transaction.
    MSI (s) (20:4C) [18:01:47:066]: Baseline: Sorted order Native: Order 0.
    MSI (s) (20:4C) [18:01:47:066]: Baseline Data Table:
    MSI (s) (20:4C) [18:01:47:066]: ProductCode: {4B1F9009-CD85-43C0-BCBD-D491908D5A52} Version: 1.9.2235 Attributes: 0 PatchId: Native BaselineId: -2147483648 Order: 0
    MSI (s) (20:4C) [18:01:47:066]: Baseline File Table:
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'C:\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'.
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Patch
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: MsiPatchHeaders
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: __MsiPatchFileList
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId`
    MSI (s) (20:4C) [18:01:47:066]: Delta compression fallback method for this product transaction is 'MSI 2.0 legacy obsolescence'
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Patch
    Action start 18:01:47: CostInitialize.
    MSI (s) (20:4C) [18:01:47:066]: Doing action: FileCost
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: CostInitialize. Return value 1.
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: MsiAssembly
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Class
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Extension
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: TypeLib
    Action start 18:01:47: FileCost.
    MSI (s) (20:4C) [18:01:47:066]: Doing action: CostFinalize
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: FileCost. Return value 1.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'.
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: MsiAssembly
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding ProductData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding Config property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding Status property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding Logs property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SnortData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding HeartbeatData property. Its value is 'C:\ProgramData\Sophos\Heartbeat'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding HeartbeatConfig property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Config'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding HeartbeatLogs property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Logs'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding HeartbeatPersist property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Persist'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'C:'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA property. Its current value is 'C:\WINDOWS\SysWOW64\'. Its new value: 'C:\Windows\SysWOW64'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C property. Its current value is 'C:\WINDOWS\system32\'. Its new value: 'C:\Windows\system32'.
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Patch
    MSI (s) (20:4C) [18:01:47:066]: Note: 1: 2205 2: 3: Condition
    MSI (s) (20:4C) [18:01:47:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:066]: Machine policy value 'DisableUserInstalls' is 0
    MSI (s) (20:4C) [18:01:47:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying TARGETDIR property. Its current value is 'C:'. Its new value: 'C:\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C property. Its current value is 'C:\Windows\system32'. Its new value: 'C:\Windows\system32\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA property. Its current value is 'C:\Windows\SysWOW64'. Its new value: 'C:\Windows\SysWOW64\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 property. Its value is 'C:\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SophosAppData property. Its value is 'C:\ProgramData\Sophos\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying HeartbeatData property. Its current value is 'C:\ProgramData\Sophos\Heartbeat'. Its new value: 'C:\ProgramData\Sophos\Heartbeat\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying HeartbeatPersist property. Its current value is 'C:\ProgramData\Sophos\Heartbeat\Persist'. Its new value: 'C:\ProgramData\Sophos\Heartbeat\Persist\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying HeartbeatLogs property. Its current value is 'C:\ProgramData\Sophos\Heartbeat\Logs'. Its new value: 'C:\ProgramData\Sophos\Heartbeat\Logs\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying HeartbeatConfig property. Its current value is 'C:\ProgramData\Sophos\Heartbeat\Config'. Its new value: 'C:\ProgramData\Sophos\Heartbeat\Config\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying ProductData property. Its current value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection'. Its new value: 'C:\ProgramData\Sophos\Sophos Network Threat Protection\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying SnortData property. Its current value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS'. Its new value: 'C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying Logs property. Its current value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs'. Its new value: 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying Config property. Its current value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config'. Its new value: 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying Status property. Its current value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status'. Its new value: 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding Sophos property. Its value is 'C:\Program Files\Sophos\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Modifying INSTALLDIR property. Its current value is 'C:\Program Files\Sophos\Sophos Network Threat Protection'. Its new value: 'C:\Program Files\Sophos\Sophos Network Threat Protection\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SnortConfDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SnortPreProcDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SnortDynModulesDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding plugins property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\'.
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding SophosNTPLWFDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\'.
    MSI (s) (20:4C) [18:01:47:066]: Target path resolution complete. Dumping Directory table...
    MSI (s) (20:4C) [18:01:47:066]: Note: target paths subject to change (via custom actions or browsing)
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: TARGETDIR , Object: C:\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: WindowsFolder , Object: C:\WINDOWS\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: System64Folder , Object: C:\WINDOWS\system32\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C , Object: C:\Windows\system32\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SystemFolder , Object: C:\WINDOWS\SysWOW64\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA , Object: C:\Windows\SysWOW64\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: CommonAppDataFolder , Object: C:\ProgramData\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SophosAppData , Object: C:\ProgramData\Sophos\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: HeartbeatData , Object: C:\ProgramData\Sophos\Heartbeat\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: HeartbeatPersist , Object: C:\ProgramData\Sophos\Heartbeat\Persist\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: HeartbeatLogs , Object: C:\ProgramData\Sophos\Heartbeat\Logs\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: HeartbeatConfig , Object: C:\ProgramData\Sophos\Heartbeat\Config\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: ProductData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SnortData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: Logs , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: Config , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: Status , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: ProgramFiles64Folder , Object: C:\Program Files\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: Sophos , Object: C:\Program Files\Sophos\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: INSTALLDIR , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SnortConfDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SnortPreProcDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SnortDynModulesDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: plugins , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\
    MSI (s) (20:4C) [18:01:47:066]: Dir (target): Key: SophosNTPLWFDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\
    MSI (s) (20:4C) [18:01:47:066]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'.
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {14E8634F-8AEA-4CD1-AC48-BEBFDA18523A} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {14E8634F-8AEA-4CD1-AC48-BEBFDA18523A} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {570C624B-D57C-4CD1-9013-1B80C800093B} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {570C624B-D57C-4CD1-9013-1B80C800093B} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {E5B92048-5859-4AF1-AEAD-B97EBF00B087} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {E5B92048-5859-4AF1-AEAD-B97EBF00B087} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1} since another client exists
    MSI (s) (20:4C) [18:01:47:066]: Disallowing uninstallation of component: {4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1} since another client exists
    Action start 18:01:47: CostFinalize.
    MSI (s) (20:4C) [18:01:47:082]: Doing action: MigrateFeatureStates
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: CostFinalize. Return value 1.
    MSI (s) (20:4C) [18:01:47:082]: Skipping MigrateFeatureStates action: not run in maintenance mode
    Action start 18:01:47: MigrateFeatureStates.
    MSI (s) (20:4C) [18:01:47:082]: Doing action: InstallValidate
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:47: MigrateFeatureStates. Return value 0.
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: Dialog
    MSI (s) (20:4C) [18:01:47:082]: Feature: AllComponents; Installed: Local; Request: Absent; Action: Absent
    MSI (s) (20:4C) [18:01:47:082]: Component: InstallationFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: ProductDataFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: ConfigDataFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: StatusFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: LogsDataFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: SnortDataFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatProductDataFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatConfigFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatLogsFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatPersistFolder; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: Driver; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: LWF; Installed: Local; Request: Absent; Action: Null; Client State: Not Used
    MSI (s) (20:4C) [18:01:47:082]: Component: navl.dll; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: integrity.dat; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: ProductInformation; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: ServiceInstallWin8Plus; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: ServiceInstallWin7Only; Installed: Local; Request: Absent; Action: Null; Client State: Not Used
    MSI (s) (20:4C) [18:01:47:082]: Component: ServiceCommon; Installed: Local; Request: Absent; Action: Absent; Client State: Absent
    MSI (s) (20:4C) [18:01:47:082]: Component: NTPAdapter; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: Heartbeat.dll; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatRegistry; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: HeartbeatNativeRegistry; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: Heartbeat.xml; Installed: Local; Request: Absent; Action: Null; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: Notice.txt; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: HealthApi; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: HbtAdapter; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: SspInterface; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: Telemetry.exe; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: TelemetryRegistry; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: RemoveObsoleteAutoUpdateRegistration; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: ScfDat; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: SofDat; Installed: Local; Request: Absent; Action: Absent; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Local; Request: Absent; Action: Null; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Local; Request: Absent; Action: Null; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Local; Request: Absent; Action: Null; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Local; Request: Absent; Action: Null; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Local; Request: Absent; Action: Null; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: C_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Local; Request: Absent; Action: Null; Client State: Local
    MSI (s) (20:4C) [18:01:47:082]: Component: __ServiceCommon65; Installed: Null; Request: Absent; Action: Absent; Client State: Null
    MSI (s) (20:4C) [18:01:47:082]: Component: __TelemetryRegistry65; Installed: Null; Request: Absent; Action: Absent; Client State: Null
    MSI (s) (20:4C) [18:01:47:082]: Component: __ProductInformation65; Installed: Null; Request: Absent; Action: Absent; Client State: Null
    MSI (s) (20:4C) [18:01:47:082]: Component: __HeartbeatRegistry65; Installed: Null; Request: Absent; Action: Absent; Client State: Null
    MSI (s) (20:4C) [18:01:47:082]: Component: __HeartbeatNativeRegistry65; Installed: Null; Request: Absent; Action: Absent; Client State: Null
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: BindImage
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: ProgId
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: PublishComponent
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: SelfReg
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: Extension
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: Font
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: Shortcut
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: Class
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: TypeLib
    Action start 18:01:47: InstallValidate.
    MSI (s) (20:4C) [18:01:47:082]: Note: 1: 2205 2: 3: _RemoveFilePath
    MSI (s) (20:4C) [18:01:47:410]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'.
    MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: BindImage
    MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: ProgId
    MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: PublishComponent
    MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: SelfReg
    MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: Extension
    MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: Font
    MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: Shortcut
    MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: Class
    MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2205 2: 3: TypeLib
    MSI (s) (20:4C) [18:01:47:410]: Note: 1: 2727 2:
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2727 2:
    MSI (s) (20:4C) [18:01:48:066]: Doing action: RemoveExistingProducts
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: InstallValidate. Return value 1.
    MSI (s) (20:4C) [18:01:48:066]: Skipping RemoveExistingProducts action: current configuration is maintenance mode or an uninstall
    Action start 18:01:48: RemoveExistingProducts.
    MSI (s) (20:4C) [18:01:48:066]: Doing action: InstallInitialize
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: RemoveExistingProducts. Return value 0.
    MSI (s) (20:4C) [18:01:48:066]: Machine policy value 'AlwaysInstallElevated' is 0
    MSI (s) (20:4C) [18:01:48:066]: User policy value 'AlwaysInstallElevated' is 0
    MSI (s) (20:4C) [18:01:48:066]: BeginTransaction: Locking Server
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (20:4C) [18:01:48:066]: SRSetRestorePoint skipped for this transaction.
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (20:4C) [18:01:48:066]: Server not locked: locking for product {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
    MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
    Action start 18:01:48: InstallInitialize.
    MSI (s) (20:4C) [18:01:48:066]: PROPERTY CHANGE: Deleting ProductToBeRegistered property. Its current value is '1'.
    MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: Class
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2228 2: 3: Class 4: SELECT `CLSID` FROM `Class` WHERE `Icon_`=? AND `Class`.`Attributes`=1
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: Shortcut
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2228 2: 3: Shortcut 4: SELECT `Component`,`Shortcut`,`Target` FROM `Component`,`Shortcut` WHERE `Component`=`Component_` AND `Icon_`=? AND (`Component`.`Installed` <> 0 AND `Component`.`Action` <> 0)
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: Class
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2228 2: 3: Class 4: SELECT `Component`,`CLSID` FROM `Component`,`Class` WHERE `Component`=`Component_` AND `Icon_`=? AND (`Component`.`Installed` <> 0 AND `Component`.`Action` <> 0)
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: Extension
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2228 2: 3: Extension 4: SELECT `Component`,`Extension` FROM `Component`,`Extension`,`ProgId` WHERE `Component`.`Component`=`Extension`.`Component_` AND `ProgId`.`ProgId`=`Extension`.`ProgId_` AND `ProgId`.`Icon_`=? AND (`Component`.`Installed` <> 0 AND `Component`.`Action` <> 0)
    MSI (s) (20:4C) [18:01:48:066]: 'shield.ico' icon will be removed.
    MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:48:066]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:48:066]: Skipping action: CheckMaxNumFilters (condition is false)
    MSI (s) (20:4C) [18:01:48:066]: Doing action: ProcessComponents
    MSI (s) (20:4C) [18:01:48:066]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: InstallInitialize. Return value 1.
    Action start 18:01:48: ProcessComponents.
    MSI (s) (20:4C) [18:01:48:081]: Doing action: UnpublishFeatures
    MSI (s) (20:4C) [18:01:48:081]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: ProcessComponents. Return value 1.
    MSI (s) (20:4C) [18:01:48:081]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    Action start 18:01:48: UnpublishFeatures.
    MSI (s) (20:4C) [18:01:48:081]: Doing action: SchedSecureObjectsRollback_x64
    MSI (s) (20:4C) [18:01:48:081]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: UnpublishFeatures. Return value 1.
    MSI (s) (20:4C) [18:01:48:081]: Creating MSIHANDLE (3) of type 790542 for thread 8012
    MSI (s) (20:80) [18:01:48:081]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7A4C.tmp, Entrypoint: SchedSecureObjectsRollback
    MSI (s) (20:78) [18:01:48:081]: Generating random cookie.
    MSI (s) (20:78) [18:01:48:081]: Created Custom Action Server with PID 7860 (0x1EB4).
    MSI (s) (20:20) [18:01:48:113]: Running as a service.
    MSI (s) (20:20) [18:01:48:128]: Hello, I'm your 64bit Elevated Non-remapped custom action server.
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (4) of type 790541 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (5) of type 790540 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (6) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (7) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (7) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (8) of type 790540 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (9) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (10) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (11) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (11) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (9) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (10) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (8) of type 790540 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: PROPERTY CHANGE: Adding ExecSecureObjectsRollback_64 property. Its value is '**********'.
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (12) of type 790531 for thread 5044
    Action start 18:01:48: SchedSecureObjectsRollback_x64.
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (12) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Doing action: ExecSecureObjectsRollback_64
    MSI (s) (20!B4) [18:01:48:128]: Note: 1: 2205 2: 3: ActionText
    Action start 18:01:48: ExecSecureObjectsRollback_64.
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (6) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (13) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (14) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (14) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (15) of type 790540 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (16) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (17) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (18) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (18) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (16) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (17) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Closing MSIHANDLE (15) of type 790540 for thread 5044
    MSI (s) (20!B4) [18:01:48:128]: Creating MSIHANDLE (19) of type 790531 for thread 5044
    Action ended 18:01:48: ExecSecureObjectsRollback_64. Return value 1.
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (19) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Doing action: ExecSecureObjectsRollback_64
    MSI (s) (20!B4) [18:01:48:144]: Note: 1: 2205 2: 3: ActionText
    Action start 18:01:48: ExecSecureObjectsRollback_64.
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (13) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (20) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (21) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (21) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (22) of type 790540 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (23) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (24) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (25) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (25) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (23) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (24) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (22) of type 790540 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (26) of type 790531 for thread 5044
    Action ended 18:01:48: ExecSecureObjectsRollback_64. Return value 1.
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (26) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Doing action: ExecSecureObjectsRollback_64
    MSI (s) (20!B4) [18:01:48:144]: Note: 1: 2205 2: 3: ActionText
    Action start 18:01:48: ExecSecureObjectsRollback_64.
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (20) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (27) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (28) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (28) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (29) of type 790540 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (30) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (31) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (32) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (32) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (30) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (31) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (29) of type 790540 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Creating MSIHANDLE (33) of type 790531 for thread 5044
    Action ended 18:01:48: ExecSecureObjectsRollback_64. Return value 1.
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (33) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Doing action: ExecSecureObjectsRollback_64
    MSI (s) (20!B4) [18:01:48:144]: Note: 1: 2205 2: 3: ActionText
    Action start 18:01:48: ExecSecureObjectsRollback_64.
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (27) of type 790531 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (4) of type 790541 for thread 5044
    MSI (s) (20!B4) [18:01:48:144]: Closing MSIHANDLE (5) of type 790540 for thread 5044
    MSI (s) (20:80) [18:01:48:144]: Closing MSIHANDLE (3) of type 790542 for thread 8012
    Action ended 18:01:48: ExecSecureObjectsRollback_64. Return value 1.
    MSI (s) (20:4C) [18:01:48:144]: Doing action: SetUnregisterHbtManagementAdapterRollback
    MSI (s) (20:4C) [18:01:48:144]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: SchedSecureObjectsRollback_x64. Return value 1.
    MSI (s) (20:4C) [18:01:48:144]: PROPERTY CHANGE: Adding UnregisterHbtManagementAdapterRollback property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll'.
    Action start 18:01:48: SetUnregisterHbtManagementAdapterRollback.
    MSI (s) (20:4C) [18:01:48:144]: Doing action: UnregisterHbtManagementAdapterRollback
    MSI (s) (20:4C) [18:01:48:144]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: SetUnregisterHbtManagementAdapterRollback. Return value 1.
    Action start 18:01:48: UnregisterHbtManagementAdapterRollback.
    MSI (s) (20:4C) [18:01:48:159]: Doing action: UnregisterHbtManagementAdapter
    MSI (s) (20:4C) [18:01:48:159]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: UnregisterHbtManagementAdapterRollback. Return value 1.
    Action start 18:01:48: UnregisterHbtManagementAdapter.
    MSI (s) (20:4C) [18:01:48:175]: Doing action: SetUnregisterManagementAdapterRollback
    MSI (s) (20:4C) [18:01:48:175]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: UnregisterHbtManagementAdapter. Return value 1.
    MSI (s) (20:4C) [18:01:48:175]: PROPERTY CHANGE: Adding UnregisterManagementAdapterRollback property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll'.
    Action start 18:01:48: SetUnregisterManagementAdapterRollback.
    MSI (s) (20:4C) [18:01:48:175]: Doing action: UnregisterManagementAdapterRollback
    MSI (s) (20:4C) [18:01:48:175]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: SetUnregisterManagementAdapterRollback. Return value 1.
    Action start 18:01:48: UnregisterManagementAdapterRollback.
    MSI (s) (20:4C) [18:01:48:175]: Doing action: UnregisterManagementAdapter
    MSI (s) (20:4C) [18:01:48:175]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: UnregisterManagementAdapterRollback. Return value 1.
    Action start 18:01:48: UnregisterManagementAdapter.
    MSI (s) (20:4C) [18:01:48:191]: Doing action: StopServices
    MSI (s) (20:4C) [18:01:48:191]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: UnregisterManagementAdapter. Return value 1.
    Action start 18:01:48: StopServices.
    MSI (s) (20:4C) [18:01:48:191]: Doing action: UninstallSophosNTPLWF.Property
    MSI (s) (20:4C) [18:01:48:191]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: StopServices. Return value 1.
    MSI (s) (20:4C) [18:01:48:191]: PROPERTY CHANGE: Adding UninstallSophosNTPLWF property. Its value is '"C:\WINDOWS\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF'.
    Action start 18:01:48: UninstallSophosNTPLWF.Property.
    MSI (s) (20:4C) [18:01:48:191]: Doing action: UninstallSophosNTPLWF
    MSI (s) (20:4C) [18:01:48:191]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: UninstallSophosNTPLWF.Property. Return value 1.
    Action start 18:01:48: UninstallSophosNTPLWF.
    MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackRemoveTrustedPublisher.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackRemoveTrustedPublisher (condition is false)
    MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackUninstallSophosNTPLWF.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackUninstallSophosNTPLWF (condition is false)
    MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackAddTrustedPublisher.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:191]: Skipping action: RollbackAddTrustedPublisher (condition is false)
    MSI (s) (20:4C) [18:01:48:191]: Doing action: CleanUpSsspUserAccount.SetProperty
    MSI (s) (20:4C) [18:01:48:191]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: UninstallSophosNTPLWF. Return value 1.
    MSI (s) (20:4C) [18:01:48:191]: PROPERTY CHANGE: Adding CleanUpSsspUserAccount property. Its value is 'NT SERVICE\sntpservice'.
    Action start 18:01:48: CleanUpSsspUserAccount.SetProperty.
    MSI (s) (20:4C) [18:01:48:191]: Doing action: CleanUpSsspUserAccountRollback.SetProperty
    MSI (s) (20:4C) [18:01:48:191]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: CleanUpSsspUserAccount.SetProperty. Return value 1.
    MSI (s) (20:4C) [18:01:48:206]: PROPERTY CHANGE: Adding CleanUpSsspUserAccountRollback property. Its value is 'NT SERVICE\sntpservice'.
    Action start 18:01:48: CleanUpSsspUserAccountRollback.SetProperty.
    MSI (s) (20:4C) [18:01:48:206]: Doing action: CleanUpSsspUserAccountRollback
    MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: CleanUpSsspUserAccountRollback.SetProperty. Return value 1.
    Action start 18:01:48: CleanUpSsspUserAccountRollback.
    MSI (s) (20:4C) [18:01:48:206]: Doing action: CleanUpSsspUserAccount
    MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: CleanUpSsspUserAccountRollback. Return value 1.
    Action start 18:01:48: CleanUpSsspUserAccount.
    MSI (s) (20:4C) [18:01:48:206]: Doing action: RemoveSIPSSubmitterUserAccount.SetProperty
    MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: CleanUpSsspUserAccount. Return value 1.
    MSI (s) (20:4C) [18:01:48:206]: PROPERTY CHANGE: Adding RemoveSIPSSubmitterUserAccount property. Its value is 'NT SERVICE\SntpService'.
    Action start 18:01:48: RemoveSIPSSubmitterUserAccount.SetProperty.
    MSI (s) (20:4C) [18:01:48:206]: Doing action: RemoveSIPSSubmitterUserAccountRollback.SetProperty
    MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: RemoveSIPSSubmitterUserAccount.SetProperty. Return value 1.
    MSI (s) (20:4C) [18:01:48:206]: PROPERTY CHANGE: Adding RemoveSIPSSubmitterUserAccountRollback property. Its value is 'NT SERVICE\SntpService'.
    Action start 18:01:48: RemoveSIPSSubmitterUserAccountRollback.SetProperty.
    MSI (s) (20:4C) [18:01:48:206]: Doing action: RemoveSIPSSubmitterUserAccountRollback
    MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: RemoveSIPSSubmitterUserAccountRollback.SetProperty. Return value 1.
    Action start 18:01:48: RemoveSIPSSubmitterUserAccountRollback.
    MSI (s) (20:4C) [18:01:48:206]: Doing action: RemoveSIPSSubmitterUserAccount
    MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: RemoveSIPSSubmitterUserAccountRollback. Return value 1.
    Action start 18:01:48: RemoveSIPSSubmitterUserAccount.
    MSI (s) (20:4C) [18:01:48:206]: Doing action: SetUnregisterSntpEventManifest
    MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: RemoveSIPSSubmitterUserAccount. Return value 1.
    MSI (s) (20:4C) [18:01:48:206]: PROPERTY CHANGE: Adding UnregisterSntpEventManifest property. Its value is '"wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'.
    Action start 18:01:48: SetUnregisterSntpEventManifest.
    MSI (s) (20:4C) [18:01:48:206]: Doing action: SetUnregisterSntpEventManifestRollback
    MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: SetUnregisterSntpEventManifest. Return value 1.
    MSI (s) (20:4C) [18:01:48:206]: PROPERTY CHANGE: Adding UnregisterSntpEventManifestRollback property. Its value is '"wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'.
    Action start 18:01:48: SetUnregisterSntpEventManifestRollback.
    MSI (s) (20:4C) [18:01:48:206]: Doing action: UnregisterSntpEventManifestRollback
    MSI (s) (20:4C) [18:01:48:206]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: SetUnregisterSntpEventManifestRollback. Return value 1.
    Action start 18:01:48: UnregisterSntpEventManifestRollback.
    MSI (s) (20:4C) [18:01:48:222]: Doing action: UnregisterSntpEventManifest
    MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: UnregisterSntpEventManifestRollback. Return value 1.
    Action start 18:01:48: UnregisterSntpEventManifest.
    MSI (s) (20:4C) [18:01:48:222]: Doing action: DeleteServices
    MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: UnregisterSntpEventManifest. Return value 1.
    Action start 18:01:48: DeleteServices.
    MSI (s) (20:4C) [18:01:48:222]: Doing action: RemoveRegistryValues
    MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: DeleteServices. Return value 1.
    Action start 18:01:48: RemoveRegistryValues.
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveLogFiles.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveLogFiles (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemovePolicyFile.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemovePolicyFile (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveStatusFile.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveStatusFile (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveReloadTrigger.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveReloadTrigger (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveIpsFiles.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: RemoveIpsFiles (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Doing action: RemoveFiles
    MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: RemoveRegistryValues. Return value 1.
    Action start 18:01:48: RemoveFiles.
    MSI (s) (20:4C) [18:01:48:222]: Doing action: RemoveFolders
    MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: RemoveFiles. Return value 1.
    Action start 18:01:48: RemoveFolders.
    MSI (s) (20:4C) [18:01:48:222]: Doing action: CreateFolders
    MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: RemoveFolders. Return value 1.
    Action start 18:01:48: CreateFolders.
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: FixupProductDataFiles.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: FixupProductDataFiles (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: FixupHeartbeatDataFiles.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Skipping action: FixupHeartbeatDataFiles (condition is false)
    MSI (s) (20:4C) [18:01:48:222]: Doing action: InstallFiles
    MSI (s) (20:4C) [18:01:48:222]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: CreateFolders. Return value 1.
    MSI (s) (20:4C) [18:01:48:222]: The file represented by File table key 'Sntp.sys' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNTPLWF.sys' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'navl.dll' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'integrity.dat' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNtpServiceExeWin8Plus' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNtpServiceExeWin7Only' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'NTPAdapter.dll' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Heartbeat.dll' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Heartbeat.xml' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Notice.txt' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'HealthApi.dll' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'HbtAdapter.dll' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'BPAIF.dll' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNtpTelemetry.exe' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'scf.dat' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'sof.dat' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Sntp.inf' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Sntp.cat' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'Sntp.man' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNTPLWF.inf' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'SophosNTPLWF.cat' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: The file represented by File table key 'F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches
    MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2205 2: 3: Patch
    MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`
    MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2205 2: 3: MsiSFCBypass
    MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?
    MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2205 2: 3: MsiPatchHeaders
    MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?
    Action start 18:01:48: InstallFiles.
    MSI (s) (20:4C) [18:01:48:238]: Doing action: FixupDIFxAppRegistry
    MSI (s) (20:4C) [18:01:48:238]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: InstallFiles. Return value 1.
    MSI (s) (20:4C) [18:01:48:238]: Creating MSIHANDLE (34) of type 790542 for thread 8012
    MSI (s) (20:34) [18:01:48:238]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7AE9.tmp, Entrypoint: FixupDIFxAppRegistry
    MSI (s) (20!3C) [18:01:48:253]: Creating MSIHANDLE (35) of type 790541 for thread 9532
    MSI (s) (20!3C) [18:01:48:253]: Creating MSIHANDLE (36) of type 790531 for thread 9532
    Action start 18:01:48: FixupDIFxAppRegistry.
    MSI (s) (20!3C) [18:01:48:253]: Closing MSIHANDLE (36) of type 790531 for thread 9532
    MSI (s) (20!3C) [18:01:48:253]: Creating MSIHANDLE (37) of type 790531 for thread 9532
    FixupDIFxAppRegistry: FixupDIFxAppRegistry called
    MSI (s) (20!3C) [18:01:48:253]: Closing MSIHANDLE (37) of type 790531 for thread 9532
    MSI (s) (20!3C) [18:01:48:253]: Creating MSIHANDLE (38) of type 790531 for thread 9532
    FixupDIFxAppRegistry: Failed to open registry key, err: 2, key: SOFTWARE\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{76F354A6-97D5-4872-9781-2F2642A4F18A}
    MSI (s) (20!3C) [18:01:48:253]: Closing MSIHANDLE (38) of type 790531 for thread 9532
    MSI (s) (20!3C) [18:01:48:253]: Closing MSIHANDLE (35) of type 790541 for thread 9532
    MSI (s) (20:34) [18:01:48:253]: Closing MSIHANDLE (34) of type 790542 for thread 8012
    FixupDIFxAppRegistry: No registry key changes made
    MSI (s) (20:4C) [18:01:48:253]: Doing action: MsiProcessDrivers
    MSI (s) (20:4C) [18:01:48:253]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: FixupDIFxAppRegistry. Return value 1.
    MSI (s) (20:4C) [18:01:48:253]: Creating MSIHANDLE (39) of type 790542 for thread 8012
    MSI (s) (20:00) [18:01:48:253]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7AFA.tmp, Entrypoint: ProcessDriverPackages
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (40) of type 790531 for thread 9484
    Action start 18:01:48: MsiProcessDrivers.
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (40) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (41) of type 790541 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (42) of type 790540 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (43) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (44) of type 790531 for thread 9484
    DIFXAPP: ENTER: ProcessDriverPackages()
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (44) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (45) of type 790531 for thread 9484
    DIFXAPP: INFO: 'Component' is 'Driver'
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (45) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (46) of type 790541 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (47) of type 790540 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (48) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (48) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (47) of type 790540 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (46) of type 790541 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (49) of type 790531 for thread 9484
    DIFXAPP: INFO: Component state 0x3 -> 0x2
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (49) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (50) of type 790531 for thread 9484
    DIFXAPP: INFO: 'ComponentId' is {76F354A6-97D5-4872-9781-2F2642A4F18A}
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (50) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (51) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (52) of type 790531 for thread 9484
    DIFXAPP: INFO: 'Flags' is 21
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (52) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (53) of type 790531 for thread 9484
    DIFXAPP: INFO: component path is
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (53) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (54) of type 790531 for thread 9484
    DIFXAPP: INFO: user SID of user performing the install is 'S-1-5-18'.
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (54) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: PROPERTY CHANGE: Adding MsiUninstallDrivers property. Its value is '2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}21Sophos Network Threat ProtectionSophos Limited'.
    MSI (s) (20!0C) [18:01:48:269]: Doing action: MsiUninstallDrivers
    MSI (s) (20!0C) [18:01:48:269]: Note: 1: 2205 2: 3: ActionText
    DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{76F354A6-97D5-4872-9781-2F2642A4F18A} (User's SID: 'S-1-5-18') ...
    Action start 18:01:48: MsiUninstallDrivers.
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (51) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (43) of type 790531 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (42) of type 790540 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (41) of type 790541 for thread 9484
    MSI (s) (20!0C) [18:01:48:269]: Creating MSIHANDLE (55) of type 790531 for thread 9484
    Action ended 18:01:48: MsiUninstallDrivers. Return value 1.
    MSI (s) (20!0C) [18:01:48:269]: Closing MSIHANDLE (55) of type 790531 for thread 9484
    MSI (s) (20:00) [18:01:48:269]: Closing MSIHANDLE (39) of type 790542 for thread 8012
    DIFXAPP: RETURN: ProcessDriverPackages() 0 (0x0)
    MSI (s) (20:4C) [18:01:48:269]: Doing action: SetRegisterSntpEventManifestRollback
    MSI (s) (20:4C) [18:01:48:269]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: MsiProcessDrivers. Return value 1.
    MSI (s) (20:4C) [18:01:48:284]: PROPERTY CHANGE: Adding RegisterSntpEventManifestRollback property. Its value is '"wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'.
    Action start 18:01:48: SetRegisterSntpEventManifestRollback.
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterSntpEventManifestRollback (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Doing action: SetRegisterSntpEventManifest
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: SetRegisterSntpEventManifestRollback. Return value 1.
    MSI (s) (20:4C) [18:01:48:284]: PROPERTY CHANGE: Adding RegisterSntpEventManifest property. Its value is '"wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'.
    Action start 18:01:48: SetRegisterSntpEventManifest.
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterSntpEventManifest (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Doing action: WriteRegistryValues
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: SetRegisterSntpEventManifest. Return value 1.
    Action start 18:01:48: WriteRegistryValues.
    MSI (s) (20:4C) [18:01:48:284]: Doing action: InstallServices
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: WriteRegistryValues. Return value 1.
    Action start 18:01:48: InstallServices.
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddSIPSSubmitterUserAccount.SetProperty (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddSIPSSubmitterUserAccountRollback.SetProperty (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddSIPSSubmitterUserAccountRollback (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddSIPSSubmitterUserAccount (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: SchedSecureObjects_x64 (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: SchedServiceConfig (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: SetupSspUserAccount.SetProperty (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: SetupSspUserAccountRollback.SetProperty (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: SetupSspUserAccountRollback (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: SetupSspUserAccount (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Doing action: MsiConfigureServices
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: InstallServices. Return value 1.
    Action start 18:01:48: MsiConfigureServices.
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: MsiServiceConfigFailureActions
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2228 2: 3: MsiServiceConfigFailureActions 4: SELECT `Name`, `Event`, `ResetPeriod`, `RebootMessage`,`Command`, `Actions`, `DelayActions`, `Action` FROM `MsiServiceConfigFailureActions`, `Component` WHERE `Component_` = `Component` AND (`Action` = 0 OR `Action` = 1 OR `Action` = 3)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddTrustedPublisher.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddTrustedPublisherRollback.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddTrustedPublisherRollback (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: AddTrustedPublisher (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: InstallSophosNTPLWF.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: RollbackInstallSophosNTPLWF.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: RollbackInstallSophosNTPLWF (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: InstallSophosNTPLWF (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: RemoveTrustedPublisher.Property (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: RemoveTrustedPublisher (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Doing action: StartServices
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: MsiConfigureServices. Return value 1.
    Action start 18:01:48: StartServices.
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterHbtManagementAdapterRollback (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Doing action: SetRegisterHbtManagementAdapter
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: StartServices. Return value 1.
    MSI (s) (20:4C) [18:01:48:284]: PROPERTY CHANGE: Adding RegisterHbtManagementAdapter property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll'.
    Action start 18:01:48: SetRegisterHbtManagementAdapter.
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterHbtManagementAdapter (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterManagementAdapterRollback (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Doing action: SetRegisterManagementAdapter
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: SetRegisterHbtManagementAdapter. Return value 1.
    MSI (s) (20:4C) [18:01:48:284]: PROPERTY CHANGE: Adding RegisterManagementAdapter property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll'.
    Action start 18:01:48: SetRegisterManagementAdapter.
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: RegisterManagementAdapter (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Doing action: RegisterUser
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: SetRegisterManagementAdapter. Return value 1.
    Action start 18:01:48: RegisterUser.
    MSI (s) (20:4C) [18:01:48:284]: Doing action: RegisterProduct
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: RegisterUser. Return value 0.
    Action start 18:01:48: RegisterProduct.
    MSI (s) (20:4C) [18:01:48:284]: Doing action: PublishFeatures
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: RegisterProduct. Return value 1.
    Action start 18:01:48: PublishFeatures.
    MSI (s) (20:4C) [18:01:48:284]: Doing action: PublishProduct
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: PublishFeatures. Return value 1.
    MSI (s) (20:4C) [18:01:48:284]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:48:284]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    Action start 18:01:48: PublishProduct.
    MSI (s) (20:4C) [18:01:48:284]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:48:284]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:48:284]: Skipping action: WixFailWhenDeferred (condition is false)
    MSI (s) (20:4C) [18:01:48:284]: Doing action: InstallFinalize
    MSI (s) (20:4C) [18:01:48:284]: Note: 1: 2205 2: 3: ActionText
    Action ended 18:01:48: PublishProduct. Return value 1.
    MSI (s) (20:4C) [18:01:48:284]: Running Script: C:\WINDOWS\Installer\MSI7A3B.tmp
    MSI (s) (20:4C) [18:01:48:284]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'.
    MSI (s) (20:4C) [18:01:48:300]: Note: 1: 2265 2: 3: -2147287035
    MSI (s) (20:4C) [18:01:48:300]: Machine policy value 'DisableRollback' is 0
    MSI (s) (20:4C) [18:01:48:300]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:01:48:300]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:01:48:300]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
    MSI (s) (20:4C) [18:01:48:300]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1380880441,LangId=1033,Platform=589824,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
    Action start 18:01:48: InstallFinalize.
    MSI (s) (20:4C) [18:01:48:300]: Executing op: ProductInfo(ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductName=Sophos Network Threat Protection,PackageName=Sophos Network Threat Protection.msi,Language=1033,Version=17369275,Assignment=1,ObsoleteArg=0,ProductIcon=shield.ico,,PackageCode={0B95A4E2-4953-4CE7-B8F7-53BB197E234A},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)
    MSI (s) (20:4C) [18:01:48:300]: Executing op: DialogInfo(Type=0,Argument=1033)
    MSI (s) (20:4C) [18:01:48:300]: Executing op: DialogInfo(Type=1,Argument=Sophos Network Threat Protection)
    MSI (s) (20:4C) [18:01:48:300]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
    MSI (s) (20:4C) [18:01:48:300]: Executing op: SetBaseline(Baseline=0,)
    MSI (s) (20:4C) [18:01:48:300]: Executing op: SetBaseline(Baseline=1,)
    MSI (s) (20:4C) [18:01:48:300]: Executing op: ActionStart(Name=InstallInitialize,,)
    MSI (s) (20:4C) [18:01:48:300]: Executing op: ProductUnregister(UpgradeCode={A6CF693D-C171-4DF5-AE49-223B66F65A1A})
    MSI (s) (20:4C) [18:01:48:300]: Note: 1: 1402 2: UNKNOWN\Products\9009F1B458DC0C34CBDB4D1909D8A525\Transforms 3: 2
    MSI (s) (20:4C) [18:01:48:300]: Note: 1: 1402 2: UNKNOWN\Products\9009F1B458DC0C34CBDB4D1909D8A525\Transforms 3: 2
    MSI (s) (20:4C) [18:01:48:300]: Scheduling file 'C:\WINDOWS\Installer\4978e5.msi' for deletion during post-install cleanup (not post-reboot).
    MSI (s) (20:4C) [18:01:48:316]: Note: 1: 1402 2: UNKNOWN\Products\9009F1B458DC0C34CBDB4D1909D8A525\Usage 3: 2
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ProductCPDisplayInfoUnregister()
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ProductUnpublish(PackageKey={0B95A4E2-4953-4CE7-B8F7-53BB197E234A})
    MSI (s) (20:4C) [18:01:48:316]: Using cached product context: machine assigned for product: 9009F1B458DC0C34CBDB4D1909D8A525
    MSI (s) (20:4C) [18:01:48:316]: Executing op: UpgradeCodeUnpublish(UpgradeCode={A6CF693D-C171-4DF5-AE49-223B66F65A1A})
    MSI (s) (20:4C) [18:01:48:316]: Executing op: IconRemove(Icon=shield.ico,)
    MSI (s) (20:4C) [18:01:48:316]: Scheduling file 'C:\WINDOWS\Installer\{4B1F9009-CD85-43C0-BCBD-D491908D5A52}\shield.ico' for deletion during post-install cleanup (not post-reboot).
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ProductUnpublishClient(,,)
    MSI (s) (20:4C) [18:01:48:316]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525 3: 2
    MSI (s) (20:4C) [18:01:48:316]: Executing op: SourceListUnpublish(,)
    MSI (s) (20:4C) [18:01:48:316]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList 3: 2
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,)
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ProgressTotal(Total=38,Type=1,ByteEquivalent=24000)
    MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={07B90057-705F-44F2-8465-C2A4C77784E7},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={07B90057-705F-44F2-8465-C2A4C77784E7},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={E1E87C49-DD4A-4C77-8D42-3ACD20DBC536},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={E1E87C49-DD4A-4C77-8D42-3ACD20DBC536},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={4D81D62C-8373-45B8-ABF2-0C0D6ED2DE34},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={4D81D62C-8373-45B8-ABF2-0C0D6ED2DE34},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={74F91047-4C42-457F-B531-A83EF6EC85E2},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={74F91047-4C42-457F-B531-A83EF6EC85E2},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={F1B8B8D7-46D7-4CA9-B109-35931536EA8A},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={F1B8B8D7-46D7-4CA9-B109-35931536EA8A},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={270CF92A-C3C0-4385-B596-337555FE9560},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={270CF92A-C3C0-4385-B596-337555FE9560},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={8D83ACDA-6DCE-41F3-B5C1-7C01BD45026C},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={8D83ACDA-6DCE-41F3-B5C1-7C01BD45026C},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:316]: Executing op: UnregisterSharedComponentProvider(Component={14456086-9032-4E19-9F29-9F1F9DD21F4E},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:316]: Executing op: ComponentUnregister(ComponentId={14456086-9032-4E19-9F29-9F1F9DD21F4E},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={9DAD77F9-1B7B-4731-8A40-3EC32A42ACC7},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={9DAD77F9-1B7B-4731-8A40-3EC32A42ACC7},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={43CBB64E-B6FD-496B-8B4D-9D8842C8E5B2},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={43CBB64E-B6FD-496B-8B4D-9D8842C8E5B2},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={76F354A6-97D5-4872-9781-2F2642A4F18A},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={FC337C28-D909-4BF7-826A-F06F35C592F8},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={FC337C28-D909-4BF7-826A-F06F35C592F8},,BinaryType=1,PreviouslyPinned=1)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={355DC0F9-A6B5-4FCA-8121-00847E59A436},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={355DC0F9-A6B5-4FCA-8121-00847E59A436},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={173F7C99-1A05-4365-B40A-D4EE897D94DE},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={173F7C99-1A05-4365-B40A-D4EE897D94DE},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={38879DEA-36FA-41BE-ACF3-B084CB40689B},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={38879DEA-36FA-41BE-ACF3-B084CB40689B},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={8E48EE2F-1444-46BF-BCD4-B5F66A4AFF10},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={8E48EE2F-1444-46BF-BCD4-B5F66A4AFF10},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={B7D2E43B-E8A6-4483-9BF7-5195F70225EF},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={B7D2E43B-E8A6-4483-9BF7-5195F70225EF},,BinaryType=1,PreviouslyPinned=1)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={DF927ABB-6A5F-44F2-A430-137AAC79AA71},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={DF927ABB-6A5F-44F2-A430-137AAC79AA71},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={4E691ABE-115D-4721-9F9A-3547D17077C5},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={4E691ABE-115D-4721-9F9A-3547D17077C5},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={668853A5-00CE-412E-B21F-0721B6A8A0A9},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={668853A5-00CE-412E-B21F-0721B6A8A0A9},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={53CBCC30-891C-4EDC-9106-456F524A7547},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={53CBCC30-891C-4EDC-9106-456F524A7547},,BinaryType=0,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={B77F9317-494B-4351-897B-D7676F0A553D},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={B77F9317-494B-4351-897B-D7676F0A553D},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1},,BinaryType=1,PreviouslyPinned=1)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={D27928F9-1751-4CE1-817A-C94C9DDFA521},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={D27928F9-1751-4CE1-817A-C94C9DDFA521},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={1FCDB37D-595F-4837-919B-EC3B0753CEA3},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={1FCDB37D-595F-4837-919B-EC3B0753CEA3},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:331]: Executing op: UnregisterSharedComponentProvider(Component={BE16C094-CC09-4502-8856-ED495E915D2D},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:331]: Executing op: ComponentUnregister(ComponentId={BE16C094-CC09-4502-8856-ED495E915D2D},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={6EFE6551-BEDB-470F-9B98-4DD9D50BD010},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={6EFE6551-BEDB-470F-9B98-4DD9D50BD010},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={5FDACC4C-306D-434E-8DF0-F356318B9B39},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={5FDACC4C-306D-434E-8DF0-F356318B9B39},,BinaryType=0,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={1B63A9FF-509B-4CD9-BA54-256A7D62B724},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={1B63A9FF-509B-4CD9-BA54-256A7D62B724},,BinaryType=0,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={7C58F223-7247-466F-BFB7-7AFCF335E96D},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={7C58F223-7247-466F-BFB7-7AFCF335E96D},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={73F7BF07-5A6C-45CF-B42D-786698434BCA},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={73F7BF07-5A6C-45CF-B42D-786698434BCA},,BinaryType=1,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={0835C947-D6D2-4E52-AF14-0231D04E88EA},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={0835C947-D6D2-4E52-AF14-0231D04E88EA},,BinaryType=0,PreviouslyPinned=1)
    MSI (s) (20:4C) [18:01:48:347]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={74260D9F-D644-423B-B2D4-0291EA4BA8BE},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={74260D9F-D644-423B-B2D4-0291EA4BA8BE},,BinaryType=0,PreviouslyPinned=1)
    MSI (s) (20:4C) [18:01:48:347]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={63B83B20-1AB9-4F49-B0B2-4489724CA96C},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={63B83B20-1AB9-4F49-B0B2-4489724CA96C},,BinaryType=0,PreviouslyPinned=1)
    MSI (s) (20:4C) [18:01:48:347]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={E5B92048-5859-4AF1-AEAD-B97EBF00B087},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={E5B92048-5859-4AF1-AEAD-B97EBF00B087},,BinaryType=1,PreviouslyPinned=1)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={570C624B-D57C-4CD1-9013-1B80C800093B},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={570C624B-D57C-4CD1-9013-1B80C800093B},,BinaryType=1,PreviouslyPinned=1)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: UnregisterSharedComponentProvider(Component={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52})
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ComponentUnregister(ComponentId={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},,BinaryType=1,PreviouslyPinned=1)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ProgressTick()
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ActionStart(Name=UnpublishFeatures,Description=Unpublishing Product Features,Template=Feature: [1])
    MSI (s) (20:4C) [18:01:48:347]: Executing op: FeatureUnpublish(Feature=AllComponents,,Absent=2,Component=@p{P%*BW1=zd&z]$)mJsdaW[qjB%Y@U4ZzjvKD[5OsJv@s}cJ=1oT4'~aF~4CQXZM}~YD=K6f.8uiFmqd,Xcv8TA_@VbUBW=+!`T%nnV0vM_d9sEnaMsf]&GlD$QUD{d49sg^P!D(ceJiKkS)R0[+AZ!s1-[w=,A6.YbZ3{ss=JEohg_[p2i8w+l98ljZ?~=1vSw1@Rb4dZ7NP)4@?Ay3?02Rl`TRfq'zN,GK@vS'}KY[htxv%v05IXn_AO3,LR+RiW5?B,P*E21a9U[TiuMN_Upq)D26Y?%.9S)}_R4*WyYsY(gU,`eg=gKq@xBGEO(!Er)d%fi$=MA=~W3(2ru}Bhqp$+W1=1!z7OkB7ULd_*5ATP2r=0iFt=RAXOhfI)zHg2_y8x,@]-~5&T_DI6xBNcJEAusiiK'M1{=`Z{{cQL&_9mRpGI0qTe78f`d9~7Zy=A!C`^NHWEqA?u_ljl9e@6]gb@m*7n-F0p6-acr5?!O(=7Jl~_]RT$+fEcA3==X[i?MRDY2dmLeda@S=@3Gw]nbS$@ZL67bKoECp=)rPpn?oAJ(}f_mFWDe^9FoNyCexjS6Pt8m+6=Ld@rqk,J59'm.iy%{OBC6_=mqN0zSy_CKZL,?MY1.M==wExHp,N$jwf@_%sbe2Au(qh3f62HtpO'DMliL@9C'V[VqeV?fJ[7'H?Q~PAYa$-TR,SwJ+Skorl$F*@hZ~fPvko[S5W(}CCJ^c@h2e2Q1wj{6('3f)giZc@F=6^fRo9h6)
    MSI (s) (20:4C) [18:01:48:347]: Note: 1: 1402 2: UNKNOWN\Installer\Features\9009F1B458DC0C34CBDB4D1909D8A525 3: 2
    MSI (s) (20:4C) [18:01:48:347]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
    MSI (s) (20:4C) [18:01:48:347]: Executing op: CustomActionSchedule(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
    MSI (s) (20:4C) [18:01:48:363]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
    MSI (s) (20:4C) [18:01:48:363]: Executing op: CustomActionSchedule(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
    MSI (s) (20:4C) [18:01:48:363]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
    MSI (s) (20:4C) [18:01:48:363]: Executing op: CustomActionSchedule(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
    MSI (s) (20:4C) [18:01:48:363]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
    MSI (s) (20:4C) [18:01:48:363]: Executing op: CustomActionSchedule(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
    MSI (s) (20:4C) [18:01:48:363]: Executing op: ActionStart(Name=UnregisterHbtManagementAdapterRollback,,)
    MSI (s) (20:4C) [18:01:48:363]: Executing op: CustomActionSchedule(Action=UnregisterHbtManagementAdapterRollback,ActionType=1345,Source=BinaryData,Target=RegisterHbtManagementAdapter,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll)
    MSI (s) (20:4C) [18:01:48:363]: Executing op: ActionStart(Name=UnregisterHbtManagementAdapter,,)
    MSI (s) (20:4C) [18:01:48:378]: Executing op: CustomActionSchedule(Action=UnregisterHbtManagementAdapter,ActionType=1089,Source=BinaryData,Target=UnregisterHbtManagementAdapter,)
    MSI (s) (20:4C) [18:01:48:378]: Creating MSIHANDLE (56) of type 790536 for thread 8012
    MSI (s) (20:CC) [18:01:48:378]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7B78.tmp, Entrypoint: UnregisterHbtManagementAdapter
    MSI (s) (20!30) [18:01:48:378]: Creating MSIHANDLE (57) of type 790531 for thread 9776
    MSI (s) (20!30) [18:01:48:394]: Closing MSIHANDLE (57) of type 790531 for thread 9776
    MSI (s) (20!30) [18:01:48:394]: Creating MSIHANDLE (58) of type 790531 for thread 9776
    UnregisterManagementAdapter: UnregisterManagementAdapter called
    MSI (s) (20!30) [18:01:48:394]: Closing MSIHANDLE (58) of type 790531 for thread 9776
    MSI (s) (20!30) [18:01:48:394]: Creating MSIHANDLE (59) of type 790531 for thread 9776
    UnregisterManagementAdapter: Adapter = HBT
    MSI (s) (20!30) [18:01:48:394]: Closing MSIHANDLE (59) of type 790531 for thread 9776
    MSI (s) (20!30) [18:01:48:394]: Creating MSIHANDLE (60) of type 790531 for thread 9776
    UnregisterManagementAdapter: Management adapter successfully unregistered
    MSI (s) (20!30) [18:01:48:394]: Closing MSIHANDLE (60) of type 790531 for thread 9776
    MSI (s) (20!30) [18:01:48:394]: Creating MSIHANDLE (61) of type 790531 for thread 9776
    UnregisterManagementAdapter: Waiting for adapter to be unloaded
    MSI (s) (20!30) [18:01:48:394]: Closing MSIHANDLE (61) of type 790531 for thread 9776
    MSI (s) (20!30) [18:02:48:403]: Creating MSIHANDLE (62) of type 790531 for thread 9776
    UnregisterManagementAdapter: Adapter path=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll
    MSI (s) (20!30) [18:02:48:403]: Closing MSIHANDLE (62) of type 790531 for thread 9776
    MSI (s) (20:CC) [18:02:48:403]: Closing MSIHANDLE (56) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:48:403]: Executing op: ActionStart(Name=UnregisterManagementAdapterRollback,,)
    UnregisterManagementAdapter: Failed to unload the adapter - continuing.
    MSI (s) (20:4C) [18:02:48:403]: Executing op: CustomActionSchedule(Action=UnregisterManagementAdapterRollback,ActionType=1345,Source=BinaryData,Target=RegisterManagementAdapter,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll)
    MSI (s) (20:4C) [18:02:48:403]: Executing op: ActionStart(Name=UnregisterManagementAdapter,,)
    MSI (s) (20:4C) [18:02:48:403]: Executing op: CustomActionSchedule(Action=UnregisterManagementAdapter,ActionType=1089,Source=BinaryData,Target=UnregisterManagementAdapter,)
    MSI (s) (20:4C) [18:02:48:418]: Creating MSIHANDLE (63) of type 790536 for thread 8012
    MSI (s) (20:80) [18:02:48:418]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI65E9.tmp, Entrypoint: UnregisterManagementAdapter
    MSI (s) (20!84) [18:02:48:418]: Creating MSIHANDLE (64) of type 790531 for thread 4740
    MSI (s) (20!84) [18:02:48:418]: Closing MSIHANDLE (64) of type 790531 for thread 4740
    MSI (s) (20!84) [18:02:48:418]: Creating MSIHANDLE (65) of type 790531 for thread 4740
    UnregisterManagementAdapter: UnregisterManagementAdapter called
    MSI (s) (20!84) [18:02:48:418]: Closing MSIHANDLE (65) of type 790531 for thread 4740
    MSI (s) (20!84) [18:02:48:418]: Creating MSIHANDLE (66) of type 790531 for thread 4740
    UnregisterManagementAdapter: Adapter = NTP
    MSI (s) (20!84) [18:02:48:418]: Closing MSIHANDLE (66) of type 790531 for thread 4740
    MSI (s) (20!84) [18:02:48:418]: Creating MSIHANDLE (67) of type 790531 for thread 4740
    UnregisterManagementAdapter: Management adapter successfully unregistered
    MSI (s) (20!84) [18:02:48:434]: Closing MSIHANDLE (67) of type 790531 for thread 4740
    MSI (s) (20!84) [18:02:48:434]: Creating MSIHANDLE (68) of type 790531 for thread 4740
    UnregisterManagementAdapter: Waiting for adapter to be unloaded
    MSI (s) (20!84) [18:02:48:434]: Closing MSIHANDLE (68) of type 790531 for thread 4740
    MSI (s) (20!84) [18:02:48:449]: Creating MSIHANDLE (69) of type 790531 for thread 4740
    UnregisterManagementAdapter: Adapter path=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll
    MSI (s) (20!84) [18:02:48:449]: Closing MSIHANDLE (69) of type 790531 for thread 4740
    MSI (s) (20:80) [18:02:48:449]: Closing MSIHANDLE (63) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:48:449]: Executing op: ActionStart(Name=StopServices,Description=Stopping services,Template=Service: [1])
    UnregisterManagementAdapter: Management adapter has been unloaded.
    MSI (s) (20:4C) [18:02:48:449]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)
    MSI (s) (20:4C) [18:02:48:449]: Executing op: ServiceControl(,Name=SntpService,Action=2,Wait=1,)
    MSI (s) (20:4C) [18:02:49:481]: Executing op: ActionStart(Name=UninstallSophosNTPLWF,,)
    MSI (s) (20:4C) [18:02:49:481]: Executing op: CustomActionSchedule(Action=UninstallSophosNTPLWF,ActionType=1089,Source=BinaryData,Target=WixQuietExec64,CustomActionData="C:\WINDOWS\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF)
    MSI (s) (20:4C) [18:02:49:481]: Creating MSIHANDLE (70) of type 790536 for thread 8012
    MSI (s) (20:2C) [18:02:49:481]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI6A20.tmp, Entrypoint: WixQuietExec64
    MSI (s) (20:78) [18:02:49:481]: Generating random cookie.
    MSI (s) (20:78) [18:02:49:481]: Created Custom Action Server with PID 9668 (0x25C4).
    MSI (s) (20:20) [18:02:49:527]: Running as a service.
    MSI (s) (20:20) [18:02:49:527]: Hello, I'm your 32bit Elevated Non-remapped custom action server.
    MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (71) of type 790531 for thread 6252
    MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (71) of type 790531 for thread 6252
    MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (72) of type 790531 for thread 6252
    WixQuietExec64: Trying to uninstall SOPHOS_SOPHOSNTPLWF ...
    MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (72) of type 790531 for thread 6252
    MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (73) of type 790531 for thread 6252
    WixQuietExec64:

    MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (73) of type 790531 for thread 6252
    MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (74) of type 790531 for thread 6252
    WixQuietExec64: ... SOPHOS_SOPHOSNTPLWF is not installed.
    MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (74) of type 790531 for thread 6252
    MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (75) of type 790531 for thread 6252
    WixQuietExec64:

    MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (75) of type 790531 for thread 6252
    MSI (s) (20!6C) [18:02:50:199]: Creating MSIHANDLE (76) of type 790531 for thread 6252
    WixQuietExec64: ... done.
    MSI (s) (20!6C) [18:02:50:199]: Closing MSIHANDLE (76) of type 790531 for thread 6252
    MSI (s) (20:2C) [18:02:50:199]: Closing MSIHANDLE (70) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:50:199]: Executing op: ActionStart(Name=CleanUpSsspUserAccountRollback,,)
    WixQuietExec64:

    MSI (s) (20:4C) [18:02:50:199]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sntpservice)
    MSI (s) (20:4C) [18:02:50:199]: Executing op: ActionStart(Name=CleanUpSsspUserAccount,,)
    MSI (s) (20:4C) [18:02:50:199]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccount,ActionType=1025,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sntpservice)
    MSI (s) (20:4C) [18:02:50:199]: Creating MSIHANDLE (77) of type 790536 for thread 8012
    MSI (s) (20:10) [18:02:50:199]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI6CEF.tmp, Entrypoint: CleanUpSsspUserAccount
    MSI (s) (20!10) [18:02:50:214]: Creating MSIHANDLE (78) of type 790531 for thread 8464
    MSI (s) (20!10) [18:02:50:214]: Closing MSIHANDLE (78) of type 790531 for thread 8464
    MSI (s) (20:10) [18:02:50:214]: Closing MSIHANDLE (77) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:50:214]: Executing op: ActionStart(Name=RemoveSIPSSubmitterUserAccountRollback,,)
    CleanUpSsspUserAccount: Initialized.
    MSI (s) (20:4C) [18:02:50:214]: Executing op: CustomActionSchedule(Action=RemoveSIPSSubmitterUserAccountRollback,ActionType=1281,Source=BinaryData,Target=AddSIPSManagementUser,CustomActionData=NT SERVICE\SntpService)
    MSI (s) (20:4C) [18:02:50:214]: Executing op: ActionStart(Name=RemoveSIPSSubmitterUserAccount,,)
    MSI (s) (20:4C) [18:02:50:214]: Executing op: CustomActionSchedule(Action=RemoveSIPSSubmitterUserAccount,ActionType=1025,Source=BinaryData,Target=RemoveSIPSManagementUser,CustomActionData=NT SERVICE\SntpService)
    MSI (s) (20:4C) [18:02:50:214]: Creating MSIHANDLE (79) of type 790536 for thread 8012
    MSI (s) (20:74) [18:02:50:214]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI6D00.tmp, Entrypoint: RemoveSIPSManagementUser
    MSI (s) (20!1C) [18:02:50:214]: Creating MSIHANDLE (80) of type 790531 for thread 5404
    MSI (s) (20!1C) [18:02:50:214]: Closing MSIHANDLE (80) of type 790531 for thread 5404
    MSI (s) (20!1C) [18:02:50:230]: Creating MSIHANDLE (81) of type 790531 for thread 5404
    RemoveSIPSManagementUser Enter (290)
    MSI (s) (20!1C) [18:02:50:230]: Closing MSIHANDLE (81) of type 790531 for thread 5404
    MSI (s) (20:74) [18:02:50:230]: Closing MSIHANDLE (79) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:50:230]: Executing op: ActionStart(Name=UnregisterSntpEventManifestRollback,,)
    RemoveSIPSManagementUser Exit (338)
    MSI (s) (20:4C) [18:02:50:230]: Executing op: CustomActionSchedule(Action=UnregisterSntpEventManifestRollback,ActionType=3393,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man")
    MSI (s) (20:4C) [18:02:50:230]: Executing op: ActionStart(Name=UnregisterSntpEventManifest,,)
    MSI (s) (20:4C) [18:02:50:230]: Executing op: CustomActionSchedule(Action=UnregisterSntpEventManifest,ActionType=3137,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man")
    MSI (s) (20:4C) [18:02:50:230]: Creating MSIHANDLE (82) of type 790536 for thread 8012
    MSI (s) (20:AC) [18:02:50:230]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI6D11.tmp, Entrypoint: WixQuietExec
    MSI (s) (20:AC) [18:02:50:371]: Closing MSIHANDLE (82) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:50:371]: Executing op: ActionStart(Name=DeleteServices,Description=Deleting services,Template=Service: [1])
    MSI (s) (20:4C) [18:02:50:371]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: ServiceControl(,Name=SntpService,Action=8,Wait=1,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2])
    MSI (s) (20:4C) [18:02:50:371]: Executing op: ProgressTotal(Total=15,Type=1,ByteEquivalent=13200)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat\Status,,BinaryType=0,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,,BinaryType=0,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Telemetry\Plugins\NTP,,BinaryType=0,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(Name=Path,Value=[INSTALLDIR]SophosNtpTelemetry.exe,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(Name=Cmd,Value=SophosNtpTelemetry.exe,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Application,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(Name=ProductCode,Value=[ProductCode],)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(Name=ProductVersion,Value=[ProductVersion],)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(Name=Path,Value=[INSTALLDIR],)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\Heartbeat,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\MTD,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegRemoveValue(,Value=service,)
    MSI (s) (20:4C) [18:02:50:371]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService 3: 2
    MSI (s) (20:4C) [18:02:50:371]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: ActionStart(Name=RemoveFiles,Description=Removing files,Template=File: [1], Directory: [9])
    MSI (s) (20:4C) [18:02:50:371]: Executing op: ProgressTotal(Total=16,Type=1,ByteEquivalent=175000)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\)
    MSI (s) (20:4C) [18:02:50:371]: Executing op: FileRemove(,FileName=Sntp.sys,,ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A})
    MSI (s) (20:4C) [18:02:50:371]: Verifying accessibility of file: Sntp.sys
    MSI (s) (20:4C) [18:02:50:386]: Executing op: FileRemove(,FileName=navl.dll,,ComponentId={355DC0F9-A6B5-4FCA-8121-00847E59A436})
    MSI (s) (20:4C) [18:02:50:386]: Verifying accessibility of file: navl.dll
    MSI (s) (20:4C) [18:02:50:589]: Executing op: FileRemove(,FileName=integrity.dat,,ComponentId={173F7C99-1A05-4365-B40A-D4EE897D94DE})
    MSI (s) (20:4C) [18:02:50:589]: Verifying accessibility of file: integrity.dat
    MSI (s) (20:4C) [18:02:50:589]: Executing op: FileRemove(,FileName=SophosNtpService.exe,,ComponentId={8E48EE2F-1444-46BF-BCD4-B5F66A4AFF10})
    MSI (s) (20:4C) [18:02:50:605]: Verifying accessibility of file: SophosNtpService.exe
    MSI (s) (20:4C) [18:02:50:699]: Executing op: FileRemove(,FileName=NTPAdapter.dll,,ComponentId={4E691ABE-115D-4721-9F9A-3547D17077C5})
    MSI (s) (20:4C) [18:02:50:699]: Verifying accessibility of file: NTPAdapter.dll
    MSI (s) (20:4C) [18:02:50:714]: Executing op: FileRemove(,FileName=Heartbeat.dll,,ComponentId={668853A5-00CE-412E-B21F-0721B6A8A0A9})
    MSI (s) (20:4C) [18:02:50:730]: Verifying accessibility of file: Heartbeat.dll
    MSI (s) (20:4C) [18:02:50:839]: Executing op: FileRemove(,FileName=Notice.txt,,ComponentId={D27928F9-1751-4CE1-817A-C94C9DDFA521})
    MSI (s) (20:4C) [18:02:50:839]: Verifying accessibility of file: Notice.txt
    MSI (s) (20:4C) [18:02:50:839]: Executing op: FileRemove(,FileName=HealthApi.dll,,ComponentId={1FCDB37D-595F-4837-919B-EC3B0753CEA3})
    MSI (s) (20:4C) [18:02:50:855]: Verifying accessibility of file: HealthApi.dll
    MSI (s) (20:4C) [18:02:50:855]: Executing op: FileRemove(,FileName=HbtAdapter.dll,,ComponentId={BE16C094-CC09-4502-8856-ED495E915D2D})
    MSI (s) (20:4C) [18:02:50:855]: Verifying accessibility of file: HbtAdapter.dll
    MSI (s) (20:4C) [18:02:50:933]: Executing op: FileRemove(,FileName=BPAIF.dll,,ComponentId={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C})
    MSI (s) (20:4C) [18:02:50:933]: Verifying accessibility of file: BPAIF.dll
    MSI (s) (20:4C) [18:02:50:949]: Executing op: FileRemove(,FileName=SophosNtpTelemetry.exe,,ComponentId={6EFE6551-BEDB-470F-9B98-4DD9D50BD010})
    MSI (s) (20:4C) [18:02:50:949]: Verifying accessibility of file: SophosNtpTelemetry.exe
    MSI (s) (20:4C) [18:02:50:964]: Executing op: FileRemove(,FileName=scf.dat,,ComponentId={7C58F223-7247-466F-BFB7-7AFCF335E96D})
    MSI (s) (20:4C) [18:02:50:980]: Verifying accessibility of file: scf.dat
    MSI (s) (20:4C) [18:02:50:980]: Executing op: FileRemove(,FileName=sof.dat,,ComponentId={73F7BF07-5A6C-45CF-B42D-786698434BCA})
    MSI (s) (20:4C) [18:02:50:980]: Verifying accessibility of file: sof.dat
    MSI (s) (20:4C) [18:02:50:980]: Executing op: FileRemove(,FileName=Sntp.inf,,ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A})
    MSI (s) (20:4C) [18:02:50:980]: Verifying accessibility of file: Sntp.inf
    MSI (s) (20:4C) [18:02:50:980]: Executing op: FileRemove(,FileName=Sntp.cat,,ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A})
    MSI (s) (20:4C) [18:02:50:980]: Verifying accessibility of file: Sntp.cat
    MSI (s) (20:4C) [18:02:50:980]: Executing op: FileRemove(,FileName=Sntp.man,,ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A})
    MSI (s) (20:4C) [18:02:50:980]: Verifying accessibility of file: Sntp.man
    MSI (s) (20:4C) [18:02:50:996]: Executing op: ActionStart(Name=RemoveFolders,Description=Removing folders,Template=Folder: [1])
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\Config\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\Logs\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:50:996]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\Persist\,Foreign=0)
    MSI (s) (20:4C) [18:02:50:996]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:011]: Executing op: FolderRemove(Folder=C:\,Foreign=0)
    MSI (s) (20:4C) [18:02:51:011]: Executing op: ActionStart(Name=MsiUninstallDrivers,,)
    MSI (s) (20:4C) [18:02:51:011]: Executing op: CustomActionSchedule(Action=MsiUninstallDrivers,ActionType=3073,Source=BinaryData,Target=UninstallDriverPackages,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}21Sophos Network Threat ProtectionSophos Limited)
    MSI (s) (20:4C) [18:02:51:011]: Creating MSIHANDLE (83) of type 790536 for thread 8012
    MSI (s) (20:8C) [18:02:51:011]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI701F.tmp, Entrypoint: UninstallDriverPackages
    MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (84) of type 790531 for thread 2632
    MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (84) of type 790531 for thread 2632
    MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (85) of type 790531 for thread 2632
    DIFXAPP: UninstallDriverPackages()
    MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (85) of type 790531 for thread 2632
    MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (86) of type 790531 for thread 2632
    DIFXAPP: 'CustomActionData' property 'DIFxApp Version' is 2.1.
    MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (86) of type 790531 for thread 2632
    MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (87) of type 790531 for thread 2632
    DIFXAPP: 'CustomActionData' property 'UI Level' is 2.
    MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (87) of type 790531 for thread 2632
    MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (88) of type 790531 for thread 2632
    DIFXAPP: 'CustomActionData' property 'componentId' is {76F354A6-97D5-4872-9781-2F2642A4F18A}.
    MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (88) of type 790531 for thread 2632
    MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (89) of type 790531 for thread 2632
    DIFXAPP: 'CustomActionData' property 'flags' is 0x15.
    MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (89) of type 790531 for thread 2632
    MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (90) of type 790531 for thread 2632
    DIFXAPP: 'CustomActionData' property 'ProductName' is Sophos Network Threat Protection.
    MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (90) of type 790531 for thread 2632
    MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (91) of type 790531 for thread 2632
    DIFXAPP: 'CustomActionData' property 'ManufacturerName' is Sophos Limited.
    MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (91) of type 790531 for thread 2632
    MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (92) of type 790531 for thread 2632
    DIFXAPP: ERROR 0x2 encountered while opening persistent-info key for component '{76F354A6-97D5-4872-9781-2F2642A4F18A}'
    MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (92) of type 790531 for thread 2632
    MSI (s) (20!48) [18:02:51:027]: Creating MSIHANDLE (93) of type 790531 for thread 2632
    DIFXAPP: UninstallDriverPackages failed with error 0x2
    MSI (s) (20!48) [18:02:51:027]: Closing MSIHANDLE (93) of type 790531 for thread 2632
    DIFXAPP: RETURN: UninstallDriverPackages() 2 (0x2)
    MSI (s) (20:8C) [18:02:51:027]: Closing MSIHANDLE (83) of type 790536 for thread 8012
    CustomAction MsiUninstallDrivers returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
    MSI (s) (20:4C) [18:02:51:027]: Note: 1: 2265 2: 3: -2147287035
    MSI (s) (20:4C) [18:02:51:027]: User policy value 'DisableRollback' is 0
    MSI (s) (20:4C) [18:02:51:027]: Machine policy value 'DisableRollback' is 0
    MSI (s) (20:4C) [18:02:51:027]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:042]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1380880441,LangId=1033,Platform=589824,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: DialogInfo(Type=0,Argument=1033)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: DialogInfo(Type=1,Argument=Sophos Network Threat Protection)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70f8.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70f9.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70fa.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70fb.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70fc.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70fd.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70fe.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d70ff.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7100.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7101.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7102.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7103.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7104.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7105.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7106.rbf)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: RegisterBackupFile(File=C:\Config.Msi\5e8d7107.rbf)
    Action ended 18:02:51: InstallFinalize. Return value 3.
    MSI (s) (20:4C) [18:02:51:042]: Executing op: ActionStart(Name=MsiUninstallDrivers,,)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: ProductInfo(ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductName=Sophos Network Threat Protection,PackageName=Sophos Network Threat Protection.msi,Language=1033,Version=17369275,Assignment=1,ObsoleteArg=0,ProductIcon=shield.ico,,PackageCode={0B95A4E2-4953-4CE7-B8F7-53BB197E234A},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: ActionStart(Name=RemoveFolders,Description=Removing folders,Template=Folder: [1])
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\Persist\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\Logs\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\Config\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:042]: Error in rollback skipped. Return: 3
    Info 1926.Could not set file security for file 'C:\Program Files\Sophos\'. Error: 0. Verify that you have sufficient privileges to modify the security permissions for this file.
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: ActionStart(Name=RemoveFiles,Description=Removing files,Template=File: [1], Directory: [9])
    MSI (s) (20:4C) [18:02:51:042]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\)
    MSI (s) (20:4C) [18:02:51:042]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7107.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man,Attributes=32800,FileSize=17080,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:042]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:042]: Verifying accessibility of file: 5e8d7107.rbf
    MSI (s) (20:4C) [18:02:51:058]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:058]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7106.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.cat,Attributes=32800,FileSize=19854,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:058]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.cat; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:058]: Verifying accessibility of file: 5e8d7106.rbf
    MSI (s) (20:4C) [18:02:51:058]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:058]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7105.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf,Attributes=32800,FileSize=1825,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:058]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:058]: Verifying accessibility of file: 5e8d7105.rbf
    MSI (s) (20:4C) [18:02:51:058]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:058]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7104.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat,Attributes=32800,FileSize=2916,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:058]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:058]: Verifying accessibility of file: 5e8d7104.rbf
    MSI (s) (20:4C) [18:02:51:058]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:058]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7103.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat,Attributes=32800,FileSize=2884,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:058]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:058]: Verifying accessibility of file: 5e8d7103.rbf
    MSI (s) (20:4C) [18:02:51:058]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:058]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7102.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe,Attributes=32800,FileSize=454080,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:058]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:058]: Verifying accessibility of file: 5e8d7102.rbf
    MSI (s) (20:4C) [18:02:51:089]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:089]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7101.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll,Attributes=32800,FileSize=312728,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:089]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:089]: Verifying accessibility of file: 5e8d7101.rbf
    MSI (s) (20:4C) [18:02:51:089]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:089]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d7100.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll,Attributes=32800,FileSize=2641728,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:089]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:089]: Verifying accessibility of file: 5e8d7100.rbf
    MSI (s) (20:4C) [18:02:51:121]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:121]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70ff.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll,Attributes=32800,FileSize=323088,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:121]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:121]: Verifying accessibility of file: 5e8d70ff.rbf
    MSI (s) (20:4C) [18:02:51:136]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:136]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70fe.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt,Attributes=32800,FileSize=32245,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:136]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:136]: Verifying accessibility of file: 5e8d70fe.rbf
    MSI (s) (20:4C) [18:02:51:136]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:136]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70fd.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll,Attributes=32800,FileSize=6026256,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:136]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:136]: Verifying accessibility of file: 5e8d70fd.rbf
    MSI (s) (20:4C) [18:02:51:214]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:214]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70fc.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll,Attributes=32800,FileSize=1100816,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:214]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:214]: Verifying accessibility of file: 5e8d70fc.rbf
    MSI (s) (20:4C) [18:02:51:230]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:230]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70fb.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe,Attributes=32800,FileSize=4927592,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:230]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:230]: Verifying accessibility of file: 5e8d70fb.rbf
    MSI (s) (20:4C) [18:02:51:277]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:277]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70fa.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat,Attributes=32800,FileSize=4086,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:277]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:277]: Verifying accessibility of file: 5e8d70fa.rbf
    MSI (s) (20:4C) [18:02:51:292]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:292]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70f9.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll,Attributes=32800,FileSize=10420880,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:292]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:292]: Verifying accessibility of file: 5e8d70f9.rbf
    MSI (s) (20:4C) [18:02:51:402]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:402]: Executing op: FileCopy(SourceName=C:\Config.Msi\5e8d70f8.rbf,,DestName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys,Attributes=32800,FileSize=227152,PerTick=0,,VerifyMedia=0,ElevateFlags=3,,,,,,,InstallMode=4194308,,,,,,,)
    MSI (s) (20:4C) [18:02:51:402]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys; To be installed; Won't patch; No existing file
    MSI (s) (20:4C) [18:02:51:402]: Verifying accessibility of file: 5e8d70f8.rbf
    MSI (s) (20:4C) [18:02:51:402]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:51:402]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2])
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegRemoveKey()
    MSI (s) (20:4C) [18:02:51:402]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService 3: 2
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\MTD,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\Heartbeat,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Application,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegAddValue(Name=Path,Value=C:\Program Files\Sophos\Sophos Network Threat Protection\,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegAddValue(Name=ProductVersion,Value=1.9.2235.0,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegAddValue(Name=ProductCode,Value={4B1F9009-CD85-43C0-BCBD-D491908D5A52},)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Telemetry\Plugins\NTP,SecurityDescriptor=BinaryData,BinaryType=0,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegAddValue(Name=Cmd,Value=SophosNtpTelemetry.exe,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegAddValue(Name=Path,Value=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,SecurityDescriptor=BinaryData,BinaryType=0,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat\Status,SecurityDescriptor=BinaryData,BinaryType=0,,)
    MSI (s) (20:4C) [18:02:51:402]: Executing op: ActionStart(Name=DeleteServices,Description=Deleting services,Template=Service: [1])
    MSI (s) (20:4C) [18:02:51:402]: Executing op: ServiceInstall(Name=SntpService,DisplayName=Sophos Network Threat Protection,ImagePath="C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe",ServiceType=16,StartType=2,ErrorControl=1,,Dependencies=bfe[~]rpcss[~]sntp[~][~],TagId=0,StartName=NT AUTHORITY\LocalService,Password=**********,Description=Protects the computer against network-based threats.,SecurityDescriptor=BinaryData,)
    MSI (s) (20:4C) [18:02:51:417]: Executing op: ActionStart(Name=UnregisterSntpEventManifest,,)
    MSI (s) (20:4C) [18:02:51:417]: Executing op: ActionStart(Name=UnregisterSntpEventManifestRollback,,)
    MSI (s) (20:4C) [18:02:51:417]: Executing op: CustomActionRollback(Action=UnregisterSntpEventManifestRollback,ActionType=3393,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man")
    MSI (s) (20:4C) [18:02:51:417]: Creating MSIHANDLE (94) of type 790536 for thread 8012
    MSI (s) (20:9C) [18:02:51:417]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI71B6.tmp, Entrypoint: WixQuietExec
    MSI (s) (20:9C) [18:02:51:589]: Closing MSIHANDLE (94) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:51:589]: Executing op: ActionStart(Name=RemoveSIPSSubmitterUserAccount,,)
    MSI (s) (20:4C) [18:02:51:589]: Executing op: ActionStart(Name=RemoveSIPSSubmitterUserAccountRollback,,)
    MSI (s) (20:4C) [18:02:51:589]: Executing op: CustomActionRollback(Action=RemoveSIPSSubmitterUserAccountRollback,ActionType=1281,Source=BinaryData,Target=AddSIPSManagementUser,CustomActionData=NT SERVICE\SntpService)
    MSI (s) (20:4C) [18:02:51:605]: Creating MSIHANDLE (95) of type 790536 for thread 8012
    MSI (s) (20:DC) [18:02:51:605]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7263.tmp, Entrypoint: AddSIPSManagementUser
    MSI (s) (20!14) [18:02:51:605]: Creating MSIHANDLE (96) of type 790531 for thread 1044
    MSI (s) (20!14) [18:02:51:605]: Closing MSIHANDLE (96) of type 790531 for thread 1044
    MSI (s) (20!14) [18:02:51:605]: Creating MSIHANDLE (97) of type 790531 for thread 1044
    AddSIPSManagementUser Enter (234)
    MSI (s) (20!14) [18:02:51:605]: Closing MSIHANDLE (97) of type 790531 for thread 1044
    MSI (s) (20:DC) [18:02:51:605]: Closing MSIHANDLE (95) of type 790536 for thread 8012
    AddSIPSManagementUser Exit (283)
    MSI (s) (20:4C) [18:02:51:605]: Executing op: ActionStart(Name=CleanUpSsspUserAccount,,)
    MSI (s) (20:4C) [18:02:51:605]: Executing op: ActionStart(Name=CleanUpSsspUserAccountRollback,,)
    MSI (s) (20:4C) [18:02:51:605]: Executing op: CustomActionRollback(Action=CleanUpSsspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sntpservice)
    MSI (s) (20:4C) [18:02:51:605]: Creating MSIHANDLE (98) of type 790536 for thread 8012
    MSI (s) (20:44) [18:02:51:605]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7274.tmp, Entrypoint: SetupSspUserAccount
    MSI (s) (20!5C) [18:02:51:620]: Creating MSIHANDLE (99) of type 790531 for thread 6492
    MSI (s) (20!5C) [18:02:51:620]: Closing MSIHANDLE (99) of type 790531 for thread 6492
    MSI (s) (20!5C) [18:02:51:745]: Creating MSIHANDLE (100) of type 790531 for thread 6492
    SetupSspUserAccount: Initialized.
    MSI (s) (20!5C) [18:02:51:745]: Closing MSIHANDLE (100) of type 790531 for thread 6492
    MSI (s) (20!5C) [18:02:51:745]: Creating MSIHANDLE (101) of type 790531 for thread 6492
    SetupSspUserAccount: OLDUSERGROUP does not exist - not adding permissions
    MSI (s) (20!5C) [18:02:51:745]: Closing MSIHANDLE (101) of type 790531 for thread 6492
    MSI (s) (20:44) [18:02:51:761]: Closing MSIHANDLE (98) of type 790536 for thread 8012
    SetupSspUserAccount: Granting permissions to user "NT SERVICE\sntpservice"
    MSI (s) (20:4C) [18:02:51:761]: Executing op: ActionStart(Name=UninstallSophosNTPLWF,,)
    MSI (s) (20:4C) [18:02:51:761]: Executing op: ActionStart(Name=StopServices,Description=Stopping services,Template=Service: [1])
    MSI (s) (20:4C) [18:02:51:761]: Executing op: ServiceControl(,Name=SntpService,Action=1,Wait=1,)
    MSI (s) (20:4C) [18:02:52:839]: Executing op: ActionStart(Name=UnregisterManagementAdapter,,)
    MSI (s) (20:4C) [18:02:52:839]: Executing op: ActionStart(Name=UnregisterManagementAdapterRollback,,)
    MSI (s) (20:4C) [18:02:52:839]: Executing op: CustomActionRollback(Action=UnregisterManagementAdapterRollback,ActionType=1345,Source=BinaryData,Target=RegisterManagementAdapter,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll)
    MSI (s) (20:4C) [18:02:52:839]: Creating MSIHANDLE (102) of type 790536 for thread 8012
    MSI (s) (20:84) [18:02:52:839]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7747.tmp, Entrypoint: RegisterManagementAdapter
    MSI (s) (20!68) [18:02:52:855]: Creating MSIHANDLE (103) of type 790531 for thread 9576
    MSI (s) (20!68) [18:02:52:855]: Closing MSIHANDLE (103) of type 790531 for thread 9576
    MSI (s) (20!68) [18:02:52:855]: Creating MSIHANDLE (104) of type 790531 for thread 9576
    RegisterManagementAdapter: RegisterManagementAdapter called
    MSI (s) (20!68) [18:02:52:855]: Closing MSIHANDLE (104) of type 790531 for thread 9576
    MSI (s) (20!68) [18:02:52:855]: Creating MSIHANDLE (105) of type 790531 for thread 9576
    RegisterManagementAdapter: Adapter = NTP: C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll
    MSI (s) (20!68) [18:02:52:855]: Closing MSIHANDLE (105) of type 790531 for thread 9576
    MSI (s) (20:84) [18:02:52:855]: Closing MSIHANDLE (102) of type 790536 for thread 8012
    RegisterManagementAdapter: Management adapter successfully registered
    MSI (s) (20:4C) [18:02:52:855]: Executing op: ActionStart(Name=UnregisterHbtManagementAdapter,,)
    MSI (s) (20:4C) [18:02:52:855]: Executing op: ActionStart(Name=UnregisterHbtManagementAdapterRollback,,)
    MSI (s) (20:4C) [18:02:52:855]: Executing op: CustomActionRollback(Action=UnregisterHbtManagementAdapterRollback,ActionType=1345,Source=BinaryData,Target=RegisterHbtManagementAdapter,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll)
    MSI (s) (20:4C) [18:02:52:855]: Creating MSIHANDLE (106) of type 790536 for thread 8012
    MSI (s) (20:24) [18:02:52:855]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7758.tmp, Entrypoint: RegisterHbtManagementAdapter
    MSI (s) (20!88) [18:02:52:870]: Creating MSIHANDLE (107) of type 790531 for thread 9864
    MSI (s) (20!88) [18:02:52:870]: Closing MSIHANDLE (107) of type 790531 for thread 9864
    MSI (s) (20!88) [18:02:52:870]: Creating MSIHANDLE (108) of type 790531 for thread 9864
    RegisterManagementAdapter: RegisterManagementAdapter called
    MSI (s) (20!88) [18:02:52:870]: Closing MSIHANDLE (108) of type 790531 for thread 9864
    MSI (s) (20!88) [18:02:52:870]: Creating MSIHANDLE (109) of type 790531 for thread 9864
    RegisterManagementAdapter: Adapter = HBT: C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll
    MSI (s) (20!88) [18:02:52:870]: Closing MSIHANDLE (109) of type 790531 for thread 9864
    MSI (s) (20:24) [18:02:52:870]: Closing MSIHANDLE (106) of type 790536 for thread 8012
    RegisterManagementAdapter: Management adapter successfully registered
    MSI (s) (20:4C) [18:02:52:870]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
    MSI (s) (20:4C) [18:02:52:870]: Executing op: CustomActionRollback(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
    MSI (s) (20:4C) [18:02:52:870]: Creating MSIHANDLE (110) of type 790536 for thread 8012
    MSI (s) (20:C4) [18:02:52:886]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7768.tmp, Entrypoint: ExecSecureObjectsRollback
    MSI (s) (20:C4) [18:02:52:886]: Closing MSIHANDLE (110) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:52:886]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
    MSI (s) (20:4C) [18:02:52:886]: Executing op: CustomActionRollback(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
    MSI (s) (20:4C) [18:02:52:886]: Creating MSIHANDLE (111) of type 790536 for thread 8012
    MSI (s) (20:18) [18:02:52:886]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI7779.tmp, Entrypoint: ExecSecureObjectsRollback
    MSI (s) (20:18) [18:02:52:901]: Closing MSIHANDLE (111) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:52:901]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
    MSI (s) (20:4C) [18:02:52:901]: Executing op: CustomActionRollback(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
    MSI (s) (20:4C) [18:02:52:901]: Creating MSIHANDLE (112) of type 790536 for thread 8012
    MSI (s) (20:04) [18:02:52:901]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI778A.tmp, Entrypoint: ExecSecureObjectsRollback
    MSI (s) (20:04) [18:02:52:917]: Closing MSIHANDLE (112) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:52:917]: Executing op: ActionStart(Name=ExecSecureObjectsRollback_64,,)
    MSI (s) (20:4C) [18:02:52:917]: Executing op: CustomActionRollback(Action=ExecSecureObjectsRollback_64,ActionType=11521,Source=BinaryData,Target=**********,CustomActionData=**********)
    MSI (s) (20:4C) [18:02:52:917]: Creating MSIHANDLE (113) of type 790536 for thread 8012
    MSI (s) (20:1C) [18:02:52:917]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI779A.tmp, Entrypoint: ExecSecureObjectsRollback
    MSI (s) (20:1C) [18:02:52:933]: Closing MSIHANDLE (113) of type 790536 for thread 8012
    MSI (s) (20:4C) [18:02:52:933]: Executing op: ActionStart(Name=UnpublishFeatures,Description=Unpublishing Product Features,Template=Feature: [1])
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Features,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegAddValue(Name=AllComponents,Value=@p{P%*BW1=zd&z]$)mJsdaW[qjB%Y@U4ZzjvKD[5OsJv@s}cJ=1oT4'~aF~4CQXZM}~YD=K6f.8uiFmqd,Xcv8TA_@VbUBW=+!`T%nnV0vM_d9sEnaMsf]&GlD$QUD{d49sg^P!D(ceJiKkS)R0[+AZ!s1-[w=,A6.YbZ3{ss=JEohg_[p2i8w+l98ljZ?~=1vSw1@Rb4dZ7NP)4@?Ay3?02Rl`TRfq'zN,GK@vS'}KY[htxv%v05IXn_AO3,LR+RiW5?B,P*E21a9U[TiuMN_Upq)D26Y?%.9S)}_R4*WyYsY(gU,`eg=gKq@xBGEO(!Er)d%fi$=MA=~W3(2ru}Bhqp$+W1=1!z7OkB7ULd_*5ATP2r=0iFt=RAXOhfI)zHg2_y8x,@]-~5&T_DI6xBNcJEAusiiK'M1{=`Z{{cQL&_9mRpGI0qTe78f`d9~7Zy=A!C`^NHWEqA?u_ljl9e@6]gb@m*7n-F0p6-acr5?!O(=7Jl~_]RT$+fEcA3==X[i?MRDY2dmLeda@S=@3Gw]nbS$@ZL67bKoECp=)rPpn?oAJ(}f_mFWDe^9FoNyCexjS6Pt8m+6=Ld@rqk,J59'm.iy%{OBC6_=mqN0zSy_CKZL,?MY1.M==wExHp,N$jwf@_%sbe2Au(qh3f62HtpO'DMliL@9C'V[VqeV?fJ[7'H?Q~PAYa$-TR,SwJ+Skorl$F*@hZ~fPvko[S5W(}CCJ^c@h2e2Q1wj{6('3f)giZc@F=6^fRo9h6,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Features\9009F1B458DC0C34CBDB4D1909D8A525,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegRemoveKey()
    MSI (s) (20:4C) [18:02:52:933]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\9009F1B458DC0C34CBDB4D1909D8A525 3: 2
    MSI (s) (20:4C) [18:02:52:933]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: ComponentRegister(ComponentId={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},KeyPath=C:\Windows\system32\vccorlib120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: ComponentRegister(ComponentId={570C624B-D57C-4CD1-9013-1B80C800093B},KeyPath=C:\Windows\system32\msvcp120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: ComponentRegister(ComponentId={E5B92048-5859-4AF1-AEAD-B97EBF00B087},KeyPath=C:\Windows\system32\msvcr120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: ComponentRegister(ComponentId={63B83B20-1AB9-4F49-B0B2-4489724CA96C},KeyPath=C:\Windows\SysWOW64\vccorlib120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=0)
    MSI (s) (20:4C) [18:02:52:933]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
    MSI (s) (20:4C) [18:02:52:933]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegisterSharedComponentProvider(,,,Component={63B83B20-1AB9-4F49-B0B2-4489724CA96C},,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,,,,,)
    MSI (s) (20:4C) [18:02:52:933]: Executing op: ComponentRegister(ComponentId={74260D9F-D644-423B-B2D4-0291EA4BA8BE},KeyPath=C:\Windows\SysWOW64\msvcp120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=0)
    MSI (s) (20:4C) [18:02:52:933]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
    MSI (s) (20:4C) [18:02:52:933]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
    MSI (s) (20:4C) [18:02:52:933]: Executing op: RegisterSharedComponentProvider(,,,Component={74260D9F-D644-423B-B2D4-0291EA4BA8BE},,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,,,,,)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={0835C947-D6D2-4E52-AF14-0231D04E88EA},KeyPath=C:\Windows\SysWOW64\msvcr120.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=0)
    MSI (s) (20:4C) [18:02:52:948]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
    MSI (s) (20:4C) [18:02:52:948]: WIN64DUALFOLDERS: 'C:\WINDOWS\system32\' will substitute 20 characters in 'C:\Windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1).
    MSI (s) (20:4C) [18:02:52:948]: Executing op: RegisterSharedComponentProvider(,,,Component={0835C947-D6D2-4E52-AF14-0231D04E88EA},,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,,,,,)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={73F7BF07-5A6C-45CF-B42D-786698434BCA},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={7C58F223-7247-466F-BFB7-7AFCF335E96D},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={1B63A9FF-509B-4CD9-BA54-256A7D62B724},KeyPath=C:\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=0)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={5FDACC4C-306D-434E-8DF0-F356318B9B39},KeyPath=02:\Software\Sophos\Telemetry\Plugins\NTP\Path,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=0)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={6EFE6551-BEDB-470F-9B98-4DD9D50BD010},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={BE16C094-CC09-4502-8856-ED495E915D2D},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={1FCDB37D-595F-4837-919B-EC3B0753CEA3},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={D27928F9-1751-4CE1-817A-C94C9DDFA521},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1},KeyPath=C:\ProgramData\Sophos\Heartbeat\Config\Heartbeat.xml,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={B77F9317-494B-4351-897B-D7676F0A553D},KeyPath=C:\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={53CBCC30-891C-4EDC-9106-456F524A7547},KeyPath=C:\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=0)
    MSI (s) (20:4C) [18:02:52:948]: Executing op: ComponentRegister(ComponentId={668853A5-00CE-412E-B21F-0721B6A8A0A9},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={4E691ABE-115D-4721-9F9A-3547D17077C5},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={DF927ABB-6A5F-44F2-A430-137AAC79AA71},KeyPath=22:\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={B7D2E43B-E8A6-4483-9BF7-5195F70225EF},,State=-7,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={8E48EE2F-1444-46BF-BCD4-B5F66A4AFF10},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={38879DEA-36FA-41BE-ACF3-B084CB40689B},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={173F7C99-1A05-4365-B40A-D4EE897D94DE},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={355DC0F9-A6B5-4FCA-8121-00847E59A436},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=1,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={FC337C28-D909-4BF7-826A-F06F35C592F8},,State=-7,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={43CBB64E-B6FD-496B-8B4D-9D8842C8E5B2},KeyPath=C:\ProgramData\Sophos\Heartbeat\Persist\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={9DAD77F9-1B7B-4731-8A40-3EC32A42ACC7},KeyPath=C:\ProgramData\Sophos\Heartbeat\Logs\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={14456086-9032-4E19-9F29-9F1F9DD21F4E},KeyPath=C:\ProgramData\Sophos\Heartbeat\Config\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={8D83ACDA-6DCE-41F3-B5C1-7C01BD45026C},KeyPath=C:\ProgramData\Sophos\Heartbeat\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={270CF92A-C3C0-4385-B596-337555FE9560},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={F1B8B8D7-46D7-4CA9-B109-35931536EA8A},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={74F91047-4C42-457F-B531-A83EF6EC85E2},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:964]: Executing op: ComponentRegister(ComponentId={4D81D62C-8373-45B8-ABF2-0C0D6ED2DE34},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: ComponentRegister(ComponentId={E1E87C49-DD4A-4C77-8D42-3ACD20DBC536},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: ComponentRegister(ComponentId={07B90057-705F-44F2-8465-C2A4C77784E7},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\,State=3,ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: ActionStart(Name=InstallInitialize,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegRemoveKey()
    MSI (s) (20:4C) [18:02:52:979]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList 3: 2
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegRemoveKey()
    MSI (s) (20:4C) [18:02:52:979]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525 3: 2
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegRemoveValue(Name=C:\WINDOWS\Installer\{4B1F9009-CD85-43C0-BCBD-D491908D5A52}\shield.ico,Value=#1,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\UpgradeCodes\D396FC6A171C5FD4EA9422B3666FA5A1,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=9009F1B458DC0C34CBDB4D1909D8A525,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Features\9009F1B458DC0C34CBDB4D1909D8A525,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=AllComponents,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Features\9009F1B458DC0C34CBDB4D1909D8A525,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=AdvertiseFlags,Value=#388,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=Assignment,Value=#1,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=AuthorizedLUAApp,Value=#0,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=Clients,Value=[~]:[~],)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=DeploymentFlags,Value=#3,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=InstanceType,Value=#0,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=Language,Value=#1033,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=PackageCode,Value=2E4A59B035947EC48B7F35BB91E732A4,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=ProductIcon,Value=C:\WINDOWS\Installer\{4B1F9009-CD85-43C0-BCBD-D491908D5A52}\shield.ico,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=ProductName,Value=Sophos Network Threat Protection,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=Version,Value=#17369275,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:979]: Executing op: RegAddValue(Name=LastUsedSource,Value=#%n;1;C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=PackageName,Value=Sophos Network Threat Protection.msi,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList\Net,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=1,Value=#%C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525\SourceList\Media,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=1,Value=;,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Classes\Installer\Products\9009F1B458DC0C34CBDB4D1909D8A525,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Uninstall\{4B1F9009-CD85-43C0-BCBD-D491908D5A52},SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=DisplayName,Value=Sophos Network Threat Protection,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\InstallProperties,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=DisplayName,Value=Sophos Network Threat Protection,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\InstallProperties,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Usage,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegRemoveKey()
    MSI (s) (20:4C) [18:02:52:995]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Usage 3: 2
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Usage,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\D396FC6A171C5FD4EA9422B3666FA5A1,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=9009F1B458DC0C34CBDB4D1909D8A525,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Uninstall\{4B1F9009-CD85-43C0-BCBD-D491908D5A52},SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=Language,Value=#1033,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=Version,Value=#17369275,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=WindowsInstaller,Value=#1,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=VersionMinor,Value=#9,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=VersionMajor,Value=#1,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=URLUpdateInfo,Value=www.sophos.com/.../updates,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=URLInfoAbout,Value=http://www.sophos.com/,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=UninstallString,Value=#%MsiExec.exe /X{4B1F9009-CD85-43C0-BCBD-D491908D5A52},)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=SystemComponent,Value=#1,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=EstimatedSize,Value=#29481,)
    MSI (s) (20:4C) [18:02:52:995]: Executing op: RegAddValue(Name=Size,,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Readme,,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Publisher,Value=Sophos Limited,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=NoRepair,Value=#1,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=NoModify,Value=#1,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=ModifyPath,Value=#%MsiExec.exe /X{4B1F9009-CD85-43C0-BCBD-D491908D5A52},)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=InstallSource,Value=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=InstallLocation,,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=InstallDate,Value=20200515,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=HelpTelephone,,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=HelpLink,Value=#%www.sophos.com/.../,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=DisplayVersion,Value=1.9.2235.0,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Contact,Value=Sophos Technical Support,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Comments,Value=Network threat protection,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=AuthorizedCDFPrefix,,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\InstallProperties,SecurityDescriptor=BinaryData,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Language,Value=#1033,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Version,Value=#17369275,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=WindowsInstaller,Value=#1,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=VersionMinor,Value=#9,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=VersionMajor,Value=#1,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=URLUpdateInfo,Value=www.sophos.com/.../updates,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=URLInfoAbout,Value=http://www.sophos.com/,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=UninstallString,Value=#%MsiExec.exe /X{4B1F9009-CD85-43C0-BCBD-D491908D5A52},)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=SystemComponent,Value=#1,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=EstimatedSize,Value=#29481,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Size,,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Readme,,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=Publisher,Value=Sophos Limited,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=NoRepair,Value=#1,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=NoModify,Value=#1,)
    MSI (s) (20:4C) [18:02:53:011]: Executing op: RegAddValue(Name=ModifyPath,Value=#%MsiExec.exe /X{4B1F9009-CD85-43C0-BCBD-D491908D5A52},)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=LocalPackage,Value=C:\WINDOWS\Installer\4978e5.msi,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegCreateKey()
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=InstallSource,Value=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=InstallLocation,,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=InstallDate,Value=20200515,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=HelpTelephone,,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=HelpLink,Value=#%www.sophos.com/.../,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=DisplayVersion,Value=1.9.2235.0,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=Contact,Value=Sophos Technical Support,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=Comments,Value=Network threat protection,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegAddValue(Name=AuthorizedCDFPrefix,,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegRemoveValue(Name=C:\WINDOWS\Installer\4978e5.msi,Value=#0,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegRemoveKey()
    MSI (s) (20:4C) [18:02:53:026]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages 3: 2
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Transforms,,BinaryType=1,,)
    MSI (s) (20:4C) [18:02:53:026]: Executing op: RegRemoveKey()
    MSI (s) (20:4C) [18:02:53:026]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9009F1B458DC0C34CBDB4D1909D8A525\Transforms 3: 2
    MSI (s) (20:4C) [18:02:53:026]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
    MSI (s) (20:4C) [18:02:53:026]: Error in rollback skipped. Return: 5
    MSI (s) (20:4C) [18:02:53:026]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:53:026]: Note: 1: 2318 2:
    MSI (s) (20:4C) [18:02:53:026]: No System Restore sequence number for this installation.
    MSI (s) (20:4C) [18:02:53:026]: Unlocking Server
    MSI (s) (20:4C) [18:02:53:026]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
    Action ended 18:02:53: INSTALL. Return value 3.
    Property(N): UpgradeCode = {A6CF693D-C171-4DF5-AE49-223B66F65A1A}
    Property(N): INSTALLTYPE_IS_CENTRAL = #1
    Property(N): INSTALLDIR = C:\Program Files\Sophos\Sophos Network Threat Protection\
    Property(N): ProductData = C:\ProgramData\Sophos\Sophos Network Threat Protection\
    Property(N): Config = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\
    Property(N): Status = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\
    Property(N): Logs = C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\
    Property(N): SnortData = C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\
    Property(N): HeartbeatData = C:\ProgramData\Sophos\Heartbeat\
    Property(N): HeartbeatConfig = C:\ProgramData\Sophos\Heartbeat\Config\
    Property(N): HeartbeatLogs = C:\ProgramData\Sophos\Heartbeat\Logs\
    Property(N): HeartbeatPersist = C:\ProgramData\Sophos\Heartbeat\Persist\
    Property(N): SophosNTPLWFDir = C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\
    Property(N): TARGETDIR = C:\
    Property(N): VersionNT64 = 603
    Property(N): RegisterSntpEventManifest = "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"
    Property(N): RegisterSntpEventManifestRollback = "wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"
    Property(N): UnregisterSntpEventManifest = "wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"
    Property(N): UnregisterSntpEventManifestRollback = "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"
    Property(N): MsiUninstallDrivers = 2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}21Sophos Network Threat ProtectionSophos Limited
    Property(N): UninstallSophosNTPLWF = "C:\WINDOWS\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF
    Property(N): ExecSecureObjectsRollback_64 = **********
    Property(N): UnregisterManagementAdapterRollback = C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll
    Property(N): RegisterManagementAdapter = C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll
    Property(N): UnregisterHbtManagementAdapterRollback = C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll
    Property(N): RegisterHbtManagementAdapter = C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll
    Property(N): CleanUpSsspUserAccount = NT SERVICE\sntpservice
    Property(N): CleanUpSsspUserAccountRollback = NT SERVICE\sntpservice
    Property(N): RemoveSIPSSubmitterUserAccount = NT SERVICE\SntpService
    Property(N): RemoveSIPSSubmitterUserAccountRollback = NT SERVICE\SntpService
    Property(N): plugins = C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\
    Property(N): SnortDynModulesDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\
    Property(N): SnortPreProcDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\
    Property(N): SnortConfDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\
    Property(N): Sophos = C:\Program Files\Sophos\
    Property(N): ProgramFiles64Folder = C:\Program Files\
    Property(N): SophosAppData = C:\ProgramData\Sophos\
    Property(N): CommonAppDataFolder = C:\ProgramData\
    Property(N): VersionNT = 603
    Property(N): Installed = 00:00:00
    Property(N): ALLUSERS = 1
    Property(N): MSIRESTARTMANAGERCONTROL = Disable
    Property(N): ARPCOMMENTS = Network threat protection
    Property(N): ARPCONTACT = Sophos Technical Support
    Property(N): ARPHELPLINK = http://www.sophos.com/support/
    Property(N): ARPNOMODIFY = 1
    Property(N): ARPNOREPAIR = 1
    Property(N): ARPPRODUCTICON = shield.ico
    Property(N): ARPURLINFOABOUT = http://www.sophos.com/
    Property(N): ARPURLUPDATEINFO = www.sophos.com/.../updates
    Property(N): Manufacturer = Sophos Limited
    Property(N): ProductCode = {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
    Property(N): ProductLanguage = 1033
    Property(N): ProductName = Sophos Network Threat Protection
    Property(N): ProductVersion = 1.9.2235.0
    Property(N): RegisterWithAutoUpdate = {8087796B-2289-4897-98A5-58FF23DAAFD0};ntp64
    Property(N): SecureCustomProperties = WIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTED
    Property(N): MsiHiddenProperties = ExecSecureObjects_64;ExecSecureObjectsRollback_64
    Property(N): INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 = C:\
    Property(N): SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = C:\Windows\SysWOW64\
    Property(N): SystemFolder = C:\WINDOWS\SysWOW64\
    Property(N): DirectoryTable100_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = DirectoryTable
    Property(N): System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C = C:\Windows\system32\
    Property(N): System64Folder = C:\WINDOWS\system32\
    Property(N): DirectoryTable100_amd64.05F0B5F5_44A8_3793_976B_A4F17AECF92C = DirectoryTable
    Property(N): PackageCode = {0B95A4E2-4953-4CE7-B8F7-53BB197E234A}
    Property(N): ProductState = 5
    Property(N): UPGRADINGPRODUCTCODE = {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}
    Property(N): CLIENTPROCESSID = 1012
    Property(N): CLIENTUILEVEL = 3
    Property(N): MSICLIENTUSESEXTERNALUI = 1
    Property(N): REMOVE = ALL
    Property(N): MsiSystemRebootPending = 1
    Property(N): PRODUCTLANGUAGE = 1033
    Property(N): VersionDatabase = 405
    Property(N): VersionMsi = 5.00
    Property(N): WindowsBuild = 9600
    Property(N): ServicePackLevel = 0
    Property(N): ServicePackLevelMinor = 0
    Property(N): MsiNTProductType = 1
    Property(N): WindowsFolder = C:\WINDOWS\
    Property(N): WindowsVolume = C:\
    Property(N): RemoteAdminTS = 1
    Property(N): TempFolder = C:\WINDOWS\TEMP\
    Property(N): ProgramFilesFolder = C:\Program Files (x86)\
    Property(N): CommonFilesFolder = C:\Program Files (x86)\Common Files\
    Property(N): CommonFiles64Folder = C:\Program Files\Common Files\
    Property(N): AppDataFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\
    Property(N): FavoritesFolder = C:\WINDOWS\system32\config\systemprofile\Favorites\
    Property(N): NetHoodFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
    Property(N): PersonalFolder = C:\WINDOWS\system32\config\systemprofile\Documents\
    Property(N): PrintHoodFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
    Property(N): RecentFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\
    Property(N): SendToFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\
    Property(N): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
    Property(N): LocalAppDataFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Local\
    Property(N): MyPicturesFolder = C:\WINDOWS\system32\config\systemprofile\Pictures\
    Property(N): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
    Property(N): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    Property(N): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
    Property(N): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
    Property(N): DesktopFolder = C:\Users\Public\Desktop\
    Property(N): FontsFolder = C:\WINDOWS\Fonts\
    Property(N): GPTSupport = 1
    Property(N): OLEAdvtSupport = 1
    Property(N): ShellAdvtSupport = 1
    Property(N): MsiAMD64 = 6
    Property(N): Msix64 = 6
    Property(N): Intel = 6
    Property(N): PhysicalMemory = 8074
    Property(N): VirtualMemory = 5598
    Property(N): AdminUser = 1
    Property(N): MsiTrueAdminUser = 1
    Property(N): LogonUser = SYSTEM
    Property(N): UserSID = S-1-5-18
    Property(N): UserLanguageID = 1033
    Property(N): ComputerName = PBC-1ZHCPN2-LT
    Property(N): SystemLanguageID = 1033
    Property(N): ScreenX = 1024
    Property(N): ScreenY = 768
    Property(N): CaptionHeight = 19
    Property(N): BorderTop = 1
    Property(N): BorderSide = 1
    Property(N): TextHeight = 16
    Property(N): TextInternalLeading = 3
    Property(N): ColorBits = 32
    Property(N): TTCSupport = 1
    Property(N): Time = 18:02:53
    Property(N): Date = 2/14/2021
    Property(N): MsiNetAssemblySupport = 4.8.4084.0
    Property(N): MsiWin32AssemblySupport = 6.3.19041.546
    Property(N): RedirectedDllSupport = 2
    Property(N): MsiRunningElevated = 1
    Property(N): Privileged = 1
    Property(N): USERNAME = PBC-COM
    Property(N): COMPANYNAME = COMPHX
    Property(N): DATABASE = C:\WINDOWS\Installer\4978e5.msi
    Property(N): OriginalDatabase = C:\WINDOWS\Installer\4978e5.msi
    Property(N): UILevel = 2
    Property(N): Preselected = 1
    Property(N): ACTION = INSTALL
    Property(N): ROOTDRIVE = C:\
    Property(N): CostingComplete = 1
    Property(N): OutOfDiskSpace = 0
    Property(N): OutOfNoRbDiskSpace = 0
    Property(N): PrimaryVolumeSpaceAvailable = 0
    Property(N): PrimaryVolumeSpaceRequired = 0
    Property(N): PrimaryVolumeSpaceRemaining = 0
    MSI (s) (20:4C) [18:02:53:042]: Closing MSIHANDLE (2) of type 790542 for thread 8012
    Property(N): INSTALLLEVEL = 1
    CustomAction returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
    MSI (s) (20:00) [18:02:53:042]: Note: 1: 2205 2: 3: Control
    Action ended 18:02:53: RemoveExistingProducts. Return value 3.
    Action ended 18:02:53: INSTALL. Return value 3.
    Property(S): UpgradeCode = {A6CF693D-C171-4DF5-AE49-223B66F65A1A}
    Property(S): INSTALLTYPE_IS_CENTRAL = #1
    Property(S): INSTALLDIR = C:\Program Files\Sophos\Sophos Network Threat Protection\
    Property(S): ProductData = C:\ProgramData\Sophos\Sophos Network Threat Protection\
    Property(S): Config = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\
    Property(S): Status = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\
    Property(S): Logs = C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\
    Property(S): SnortData = C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\
    Property(S): HeartbeatData = C:\ProgramData\Sophos\Heartbeat\
    Property(S): HeartbeatConfig = C:\ProgramData\Sophos\Heartbeat\Config\
    Property(S): HeartbeatLogs = C:\ProgramData\Sophos\Heartbeat\Logs\
    Property(S): HeartbeatPersist = C:\ProgramData\Sophos\Heartbeat\Persist\
    Property(S): SophosNTPLWFDir = C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\
    Property(S): TARGETDIR = C:\
    Property(S): VersionNT64 = 603
    Property(S): SnortDynModulesDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\
    Property(S): SnortPreProcDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\
    Property(S): SnortConfDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\
    Property(S): plugins = C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\
    Property(S): Sophos = C:\Program Files\Sophos\
    Property(S): ProgramFiles64Folder = C:\Program Files\
    Property(S): SophosAppData = C:\ProgramData\Sophos\
    Property(S): CommonAppDataFolder = C:\ProgramData\
    Property(S): VersionNT = 603
    Property(S): ALLUSERS = 1
    Property(S): MSIRESTARTMANAGERCONTROL = Disable
    Property(S): ARPCOMMENTS = Network threat protection
    Property(S): ARPCONTACT = Sophos Technical Support
    Property(S): ARPHELPLINK = http://www.sophos.com/support/
    Property(S): ARPNOMODIFY = 1
    Property(S): ARPNOREPAIR = 1
    Property(S): ARPPRODUCTICON = shield.ico
    Property(S): ARPURLINFOABOUT = http://www.sophos.com/
    Property(S): ARPURLUPDATEINFO = www.sophos.com/.../updates
    Property(S): Manufacturer = Sophos Limited
    Property(S): ProductCode = {2D2A1891-4657-4E6F-9373-BFCE4C9AC5BA}
    Property(S): ProductLanguage = 1033
    Property(S): ProductName = Sophos Network Threat Protection
    Property(S): ProductVersion = 1.11.194.0
    Property(S): RegisterWithAutoUpdate = {8087796B-2289-4897-98A5-58FF23DAAFD0};ntp64
    Property(S): SecureCustomProperties = WIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTED
    Property(S): MsiHiddenProperties = ExecSecureObjects_64;ExecSecureObjectsRollback_64
    Property(S): WIX_UPGRADE_DETECTED = {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
    Property(S): INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 = C:\
    Property(S): SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = C:\WINDOWS\SysWOW64\
    Property(S): SystemFolder = C:\WINDOWS\SysWOW64\
    Property(S): DirectoryTable100_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = DirectoryTable
    Property(S): System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C = C:\WINDOWS\system32\
    Property(S): System64Folder = C:\WINDOWS\system32\
    Property(S): DirectoryTable100_amd64.05F0B5F5_44A8_3793_976B_A4F17AECF92C = DirectoryTable
    Property(S): MsiLogFileLocation = C:\WINDOWS\TEMP\Sophos Network Threat Protection Install Log 20210214 180145.txt
    Property(S): PackageCode = {BDBDC64C-EB88-4135-BD3F-FE19CA9893E3}
    Property(S): ProductState = -1
    Property(S): PackagecodeChanging = 1
    Property(S): REBOOT = ReallySuppress
    Property(S): INSTALLINGVERSION = 1.11.194.0
    Property(S): ARPSYSTEMCOMPONENT = 1
    Property(S): CURRENTDIRECTORY = C:\WINDOWS\system32
    Property(S): CLIENTUILEVEL = 3
    Property(S): MSICLIENTUSESEXTERNALUI = 1
    Property(S): CLIENTPROCESSID = 1012
    Property(S): MsiSystemRebootPending = 1
    Property(S): VersionDatabase = 405
    Property(S): VersionMsi = 5.00
    Property(S): WindowsBuild = 9600
    Property(S): ServicePackLevel = 0
    Property(S): ServicePackLevelMinor = 0
    Property(S): MsiNTProductType = 1
    Property(S): WindowsFolder = C:\WINDOWS\
    Property(S): WindowsVolume = C:\
    Property(S): RemoteAdminTS = 1
    Property(S): TempFolder = C:\WINDOWS\TEMP\
    Property(S): ProgramFilesFolder = C:\Program Files (x86)\
    Property(S): CommonFilesFolder = C:\Program Files (x86)\Common Files\
    Property(S): CommonFiles64Folder = C:\Program Files\Common Files\
    Property(S): AppDataFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\
    Property(S): FavoritesFolder = C:\WINDOWS\system32\config\systemprofile\Favorites\
    Property(S): NetHoodFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
    Property(S): PersonalFolder = C:\WINDOWS\system32\config\systemprofile\Documents\
    Property(S): PrintHoodFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
    Property(S): RecentFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\
    Property(S): SendToFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\
    Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
    Property(S): LocalAppDataFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Local\
    Property(S): MyPicturesFolder = C:\WINDOWS\system32\config\systemprofile\Pictures\
    Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
    Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
    Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
    Property(S): DesktopFolder = C:\Users\Public\Desktop\
    Property(S): FontsFolder = C:\WINDOWS\Fonts\
    Property(S): GPTSupport = 1
    Property(S): OLEAdvtSupport = 1
    Property(S): ShellAdvtSupport = 1
    Property(S): MsiAMD64 = 6
    Property(S): Msix64 = 6
    Property(S): Intel = 6
    Property(S): PhysicalMemory = 8074
    Property(S): VirtualMemory = 5605
    Property(S): AdminUser = 1
    Property(S): MsiTrueAdminUser = 1
    Property(S): LogonUser = SYSTEM
    Property(S): UserSID = S-1-5-18
    Property(S): UserLanguageID = 1033
    Property(S): ComputerName = PBC-1ZHCPN2-LT
    Property(S): SystemLanguageID = 1033
    Property(S): ScreenX = 1024
    Property(S): ScreenY = 768
    Property(S): CaptionHeight = 19
    Property(S): BorderTop = 1
    Property(S): BorderSide = 1
    Property(S): TextHeight = 16
    Property(S): TextInternalLeading = 3
    Property(S): ColorBits = 32
    Property(S): TTCSupport = 1
    Property(S): Time = 18:02:53
    Property(S): Date = 2/14/2021
    Property(S): MsiNetAssemblySupport = 4.8.4084.0
    Property(S): MsiWin32AssemblySupport = 6.3.19041.546
    Property(S): RedirectedDllSupport = 2
    Property(S): MsiRunningElevated = 1
    Property(S): Privileged = 1
    Property(S): USERNAME = PBC-COM
    Property(S): COMPANYNAME = COMPHX
    Property(S): DATABASE = C:\WINDOWS\Installer\5e8d70f4.msi
    Property(S): OriginalDatabase = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi
    Property(S): UILevel = 2
    Property(S): ACTION = INSTALL
    Property(S): MIGRATE = {4B1F9009-CD85-43C0-BCBD-D491908D5A52}
    Property(S): ROOTDRIVE = C:\
    Property(S): CostingComplete = 1
    Property(S): OutOfDiskSpace = 0
    Property(S): OutOfNoRbDiskSpace = 0
    Property(S): PrimaryVolumeSpaceAvailable = 0
    Property(S): PrimaryVolumeSpaceRequired = 0
    Property(S): PrimaryVolumeSpaceRemaining = 0
    Property(S): INSTALLLEVEL = 1
    MSI (s) (20:00) [18:02:53:058]: Note: 1: 1708
    MSI (s) (20:00) [18:02:53:058]: Product: Sophos Network Threat Protection -- Installation failed.

    MSI (s) (20:00) [18:02:53:058]: Windows Installer installed the product. Product Name: Sophos Network Threat Protection. Product Version: 1.11.194.0. Product Language: 1033. Manufacturer: Sophos Limited. Installation success or error status: 1603.

    MSI (s) (20:00) [18:02:53:058]: Closing MSIHANDLE (1) of type 790542 for thread 8960
    MSI (s) (20:00) [18:02:53:073]: Deferring clean up of packages/files, if any exist
    MSI (s) (20:00) [18:02:53:073]: MainEngineThread is returning 1603
    MSI (s) (20:DC) [18:02:53:073]: No System Restore sequence number for this installation.
    === Logging stopped: 2/14/2021 18:02:53 ===
    MSI (s) (20:DC) [18:02:53:073]: User policy value 'DisableRollback' is 0
    MSI (s) (20:DC) [18:02:53:073]: Machine policy value 'DisableRollback' is 0
    MSI (s) (20:DC) [18:02:53:073]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (20:DC) [18:02:53:073]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
    MSI (s) (20:DC) [18:02:53:073]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
    MSI (s) (20:DC) [18:02:53:073]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
    MSI (s) (20:DC) [18:02:53:073]: Destroying RemoteAPI object.
    MSI (s) (20:78) [18:02:53:073]: Custom Action Manager thread ending.
    MSI (c) (F4:3C) [18:02:53:073]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
    MSI (c) (F4:3C) [18:02:53:073]: MainEngineThread is returning 1603
    === Verbose logging stopped: 2/14/2021 18:02:53 ===

    setup::MsiInstaller::installOrUpgrade: Install/upgrade returned 1603
    `anonymous-namespace'::setResult: installation failed
    setup::TamperProtectionControl::enable: Registered tamper protection integrity.dat for NTP
    setup::TamperProtectionControl::enable: Enabled tamper protection for NTP
    ProductSetup::~ProductSetup: End product setup

    So am I reading this right that the tamper protection is causing the issue?

  • +1 in reply to CapMReynolds

    This appears to be the fatal event:

    MSI (s) (20:4C) [18:02:51:011]: Executing op: ActionStart(Name=MsiUninstallDrivers,,)
    MSI (s) (20:4C) [18:02:51:011]: Executing op: CustomActionSchedule(Action=MsiUninstallDrivers,ActionType=3073,Source=BinaryData,Target=UninstallDriverPackages,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}21Sophos Network Threat ProtectionSophos Limited)
    MSI (s) (20:4C) [18:02:51:011]: Creating MSIHANDLE (83) of type 790536 for thread 8012
    MSI (s) (20:8C) [18:02:51:011]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI701F.tmp, Entrypoint: UninstallDriverPackages
    DIFXAPP: UninstallDriverPackages()
    DIFXAPP: 'CustomActionData' property 'DIFxApp Version' is 2.1.
    DIFXAPP: 'CustomActionData' property 'UI Level' is 2.
    DIFXAPP: 'CustomActionData' property 'componentId' is {76F354A6-97D5-4872-9781-2F2642A4F18A}.
    DIFXAPP: 'CustomActionData' property 'flags' is 0x15.
    DIFXAPP: 'CustomActionData' property 'ProductName' is Sophos Network Threat Protection.
    DIFXAPP: 'CustomActionData' property 'ManufacturerName' is Sophos Limited.
    DIFXAPP: ERROR 0x2 encountered while opening persistent-info key for component '{76F354A6-97D5-4872-9781-2F2642A4F18A}'
    DIFXAPP: UninstallDriverPackages failed with error 0x2
    DIFXAPP: RETURN: UninstallDriverPackages() 2 (0x2)
    CustomAction MsiUninstallDrivers returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

    DIFX is a Microsoft Driver installer framework.  Here the NTP MSI is running the MsiUninstallDrivers custom action. This appears to be failing to locate a registry key associated with the SNTP.sys driver component.

    Looking at the MSI with Orca, here is the CA, it points at the code being utilized being in the standard Microsoft DIFX library DLL (can be exported from the Binary table if needed) so there isn't any specific Sophos code here to remove the driver.

    I assume Googling for "difx" "UninstallDriverPackages" would return many examples of failure reason as it's quite a generic error for a common routine. 

    The error 2 is ERROR_FILE_NOT_FOUND.  The 76F354A6-97D5-4872-9781-2F2642A4F18A component, according to the MSI log in the SNTP.sys driver, so this is the driver that is failing to uninstall.

    I guess once approach is to run Process Monitor when perform an update, cross reference the new uninstall log for this custom action running and the same error code by DIFX and see the registry key (I think it's a reg key rather than a file given the name) that is not found.  Maybe under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DIFx\?

    The other option might be be simply to run SophosZap - https://support.sophos.com/support/s/article/KB-000038989?language=en_US -  on the computer, reboot as requested and then re-install.  Does the same issue persist?

    I suppose, if I had the issue on may computers, I might want to get to the bottom of it to apply a more surgical fix but if it's a one off, SophosZap as the first port of call would be my first choice.

    Hope it helps. 

  • 0 in reply to Sophos User930

    Thank you for the reply, I ended up using SophosZap remove the client and reinstall it.

    As to the issue, it was due to how our SCCM task sequence was created and most likely didn't get the correct permissions at the time it was installing Sophos and some how it was still not working even when I made sure the groups/etc was completed.

Unfiltered HTML