Failed to install ntp64: general error - Windows 10

Question

Hello! 
 We have been seeing the Failed to install ntp64: general error in a lot of our machines since around November. Most of the computers affected were new machines we imaged with SCCM. I see that this error was common with Windows 7 due to an update and I was wondering if that is the case here. I believe all machines should be Windows 10 build version 2004. 
 Is there a fix, or do I need to reinstall? The last time I tried to uninstall it didn't, and then I was locked out of Tamper Protection and it was showing it was still on, even though I turned it off... 
 Thank you in advance! 
 
 James

Sophos User930 · Accepted Answer

This appears to be the fatal event: 
 MSI (s) (20:4C) [18:02:51:011]: Executing op: ActionStart(Name=MsiUninstallDrivers,,) MSI (s) (20:4C) [18:02:51:011]: Executing op: CustomActionSchedule(Action=MsiUninstallDrivers,ActionType=3073,Source=BinaryData,Target=UninstallDriverPackages,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}21Sophos Network Threat ProtectionSophos Limited) MSI (s) (20:4C) [18:02:51:011]: Creating MSIHANDLE (83) of type 790536 for thread 8012 MSI (s) (20:8C) [18:02:51:011]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI701F.tmp, Entrypoint: UninstallDriverPackages DIFXAPP: UninstallDriverPackages() DIFXAPP: 'CustomActionData' property 'DIFxApp Version' is 2.1. DIFXAPP: 'CustomActionData' property 'UI Level' is 2. DIFXAPP: 'CustomActionData' property 'componentId' is {76F354A6-97D5-4872-9781-2F2642A4F18A}. DIFXAPP: 'CustomActionData' property 'flags' is 0x15. DIFXAPP: 'CustomActionData' property 'ProductName' is Sophos Network Threat Protection. DIFXAPP: 'CustomActionData' property 'ManufacturerName' is Sophos Limited. DIFXAPP: ERROR 0x2 encountered while opening persistent-info key for component '{76F354A6-97D5-4872-9781-2F2642A4F18A}' DIFXAPP: UninstallDriverPackages failed with error 0x2 DIFXAPP: RETURN: UninstallDriverPackages() 2 (0x2) CustomAction MsiUninstallDrivers returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) 
 DIFX is a Microsoft Driver installer framework. Here the NTP MSI is running the MsiUninstallDrivers custom action. This appears to be failing to locate a registry key associated with the SNTP.sys driver component. 
 Looking at the MSI with Orca, here is the CA, it points at the code being utilized being in the standard Microsoft DIFX library DLL (can be exported from the Binary table if needed) so there isn't any specific Sophos code here to remove the driver. 
 
 I assume Googling for "difx" "UninstallDriverPackages" would return many examples of failure reason as it's quite a generic error for a common routine. 
 The error 2 is ERROR_FILE_NOT_FOUND. The 76F354A6-97D5-4872-9781-2F2642A4F18A component, according to the MSI log in the SNTP.sys driver, so this is the driver that is failing to uninstall. 
 I guess once approach is to run Process Monitor when perform an update, cross reference the new uninstall log for this custom action running and the same error code by DIFX and see the registry key (I think it's a reg key rather than a file given the name) that is not found. Maybe under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DIFx\? 
 The other option might be be simply to run SophosZap - https://support.sophos.com/support/s/article/KB-000038989?language=en_US - on the computer, reboot as requested and then re-install. Does the same issue persist? 
 I suppose, if I had the issue on may computers, I might want to get to the bottom of it to apply a more surgical fix but if it's a one off, SophosZap as the first port of call would be my first choice. 
 Hope it helps.

Sophos User930 · Answer

Could you link an install log from a client? If AutoUpdate keeps retrying evert hour to install, which it should be, there will probably be quite a few under \windows	emp\ 
 E.g. Sophos Network Threat Protection Install Log 20210203 150932.txt 
 Thanks.

Failed to install ntp64: general error - Windows 10

Top Replies