Windows 7 OS Updates blocked since October

Hi MarkWheeler,

Apart from uninstalling the endpoint, have you tried any other troubleshooting around this? I'd recommend you try isolating the component by following this KBA and see if switching off one of the components resolves the issue. - https://support.sophos.com/support/s/article/KB-000036572?language=en_US

In short to my below, i have tried all of these steps regardless of whether the settigs do stay off during restart (as they all appear re-enabled upon the reboot into windows) but no resolve, turning them off one at a time and trying or all off togehter..updates still fail and revert the configuration upon update restart request. Removing Sophos Central currently appears the only way to get these updates installed. 

Please if you have further suggestions feel free to provide.. I have since also tried the below without result;

Step 1

1. Access the following folder: C:\Windows\System32\drivers\
2. Rename hmpalert.sys to hmpalert.orig
3. Reboot the computer.
4. Test the issue and share the result
5. Revert the changes

Step 2-

1. Access the following folder: C:\Windows\System32\drivers\
2. Rename savonaccess.sys to savonaccess.orig
3. Reboot the computer.
4. Test the issue and share the result
5. Revert the changes

Step 3-

1. Disable Tamper Protection in Sophos Endpoint
2. Navigate to C:\Windows\System32\Drivers
3. Locate the file 'sntp.sys'
4. Rename the file to sntp.sys.OLD
5. Reboot the server to unload the filter driver
6. Retest
7. Remove .old from sntp.sys.old

All W7 machines are effected that have Sophos Central installe,d but gaain this appears to have changed only recently (about a week or two ago), as before they were all updating without issue...has a recent Sophos Central agent update gone out that caused an issue (although id expect other customers to maybe also be finding this issue otherwise?) our agent details the below version numbers;

Core Agent 2.20.4.1

Endpoint Advanced 10.8.11.3

Sophos Intercept X 2.0.22

We have also tried to put one of these devices into the early access BETA group, but this didnt appear to resolve the issue either. (but the only product that appeared to be altered from the above when we added this to the BETA early access was the interept X which went to 2.0.23.

Thanks

Damien

Hi Kushal

Also i have no idea if this is relevant, but after setting this test device to No Protection from your earlier message, the device of course still shows in the About Tamper Protection disabled, but Malicious Behaviour Detection enabled...whilst waiting for further support, i thought id also just try to turn this off in the Central admin policy that this device is assigned to under Runtime Protection..and updated the devices sophos central agent via about - update but Malicious Behaviour detection still remains enabled in the settings..only this and tamper are listed left..bu this still shows as enabled when it should be disabled based on the policy de-selections made?

Hi Kushal, still no progress from Sophos via the ticket yet..ive been pushed up to second line it appears, but the enigneer has so far detailed he loaded up a W7 VM with sophos and can update without issue (i assume hes doing it via Check for updates)..we have tried instlaling updates manually from windows upate altagloue ourselves as a test, as all our devices get upates from WSUS (which he did just ask us) so im not sure if this makes any difference..but i did suspect if he ran a VM himself that he wouldnt get any issues, as otherwise id expect to see more of these issues globally world wide if others were having the problems...this is why i beleive for what ever reason its related to aixtron and our machines and sopohs..either due to a odd sophos policy or setting we might have in place, or some GPO on our W7 devices oddly..so i kind of hope they can see something from the logs i have generated and provided to them..any kick you can provide them, or additional test, please let me know,

THanks

Damien

I have followed up with you via DM to keep you updated on the progress.

I was also able to look into the logs you provided to advise some further troubleshooting steps. 

Let me know if you can report back your findings either to the support case or via DM so that I may update the case internally. 

Thank you,

Hi Kushal, many thanks for your reply, i will look at your DM now, and report back. thanks

For anyone wanting an update on this issue...there is still no update..Level 3 support have supposedly passed this onto development..but other than being asked to run a few more tests on a w7 machine, nothing really has moved on this...i had removd sophos agent from one device which of course then allowed the machine to apply its updates, i then provided a log on this so they could compare a 'failed' log when sophos was installed and one when it wasnt, i then reinstalled sophos which caused further updates to still fail again as expected..but disabling all the sophos services on this device then allowed the updates to install..leading us to beleive it was a services issue with one or more of the sophos services..however on trying to do the same on another machine (that hadnt had sohpos uninstalled and reinstalled however) this hasnt produced the same result with the services disabled...very odd..awaiting further responce from Sophos!

We have also been experiencing this issue for Server 2008 r2 ESU patches. Started around the beginning of November. Patches install fine when Sophos Endpoint Agent is uninstalled. As soon as it is installed, patches get uninstalled/fail on the reboot phase.

Here is the official advisory from Sophos Advisory: Windows 7 and 2008 R2 Nov/Dec 2021 Updates May Fail to Install (sophos.com)

We are having the same issue with Windows 7 devices: Microsoft Updates will install only if Sophos is uninstalled first. We raised a call with Microsoft, who confirmed that Sophos is locking the files. Sophos has referred us to the link below, which is very unhelpful. 

Advisory: Windows 7 and 2008 R2 Nov/Dec 2021 updates may fail to install (sophos.com) 

The link above mentioned files ntdll.dll and cryptnet.dll, which are included in the Windows 7 December update (KB5008244). (ntdll.dll 6.1.7601.25792 10-Nov-21 20:19
cryptnet.dll 6.1.7601.25757 11-Oct-21 20:31)

Microsoft have advised that Sophos should raise a call with them to resolve the issue.

I too am awaiting a response from Sophos.

Yup and this is still an issue for us as the original poster...the sophos article also doesnt help, at least the workaround as turning off tamper and disabling the services doesnt work on all devicves for some reason..so the best and confirmed only way is to remove sophos do the upddates and reinstall sophos..but this isnt a great option espeially when we have many W7 devices for special reasons and there is no policy method to turn tamper offf in central anymore for bulk amount of devices..its eitehr the entire thing, or manually on individual devices...ilm still awating sophhos to get back to me..

Yup, see my reply to Jonathan...still open ticket with Sophos, level 3 support who say they are working with there dev team on this still...what we were told is its an issue since the Nov updates where MS made a change to some .dlls..which Sophos have its fingers in causing issues with the updates therefore failing as these .dlls are held in action or something...so either MS need to change there update back to how they were (or fix the problems with what ever vulnerabilties caused them to change these .dlls) or sophos need to find a better way to allow these to update without causingissues whilst sophos centrla is installed/running.

Yup, see my reply to Jonathan...still open ticket with Sophos, level 3 support who say they are working with there dev team on this still...what we were told is its an issue since the Nov updates where MS made a change to some .dlls..which Sophos have its fingers in causing issues with the updates therefore failing as these .dlls are held in action or something...so either MS need to change there update back to how they were (or fix the problems with what ever vulnerabilties caused them to change these .dlls) or sophos need to find a better way to allow these to update without causingissues whilst sophos centrla is installed/running.