Sophosdiag.exe / Endpoint Self Help crashing when loading

Given the module referenced is wuapi.dll, which is the Windows Update Client API. I suspect it's due to enumerating the installed patches which SophosDiag does display.

If you stop and disable the Windows Update service it might confirm that, I assume then it might load as it handles this:

Beyond that I would try and get a process dump of SophosDiag.exe when it crashes.  Easiest way is to download Procdump (ProcDump - Windows Sysinternals | Microsoft Docs) from Sysinternals/Microsoft to say:

C:\dumps\

From an admin prompt run:

C:\dumps\procdump.exe -ma -i C:\dumps

launch the SophosDiag,exe so it crashes and you should then have 1, possibly 2 dump files.  Only the first is required.

You can run:

C:\dumps\procdump.exe -u

to remove the registration as the post-mortem debugger once you have the dump file.

Maybe send it to Support or link it here.

Regards,

Given the module referenced is wuapi.dll, which is the Windows Update Client API. I suspect it's due to enumerating the installed patches which SophosDiag does display.

If you stop and disable the Windows Update service it might confirm that, I assume then it might load as it handles this:

Beyond that I would try and get a process dump of SophosDiag.exe when it crashes.  Easiest way is to download Procdump (ProcDump - Windows Sysinternals | Microsoft Docs) from Sysinternals/Microsoft to say:

C:\dumps\

From an admin prompt run:

C:\dumps\procdump.exe -ma -i C:\dumps

launch the SophosDiag,exe so it crashes and you should then have 1, possibly 2 dump files.  Only the first is required.

You can run:

C:\dumps\procdump.exe -u

to remove the registration as the post-mortem debugger once you have the dump file.

Maybe send it to Support or link it here.

Regards,

If you open up a PowerShell ISE Window, paste the following:

$updateSession = New-Object -ComObject 'Microsoft.Update.Session'
$updateSearcher = $updateSession.CreateUpdateSearcher()
$searchResult = $updateSearcher.Search('IsInstalled=1 and IsHidden=0')
foreach ($update in $searchResult.Updates) { $update.Title }

Does it list the title of installed patches or does it error when you run it?

Hi there, Thank you so much for replying and helping. I ran the Powershell ISE script and all updates listed fine, same issue occurred when stopping the Windows Update Service too. I've ran the results of the dmp file and pasted it below. Hopefully that gives some information that you might know instantly or whether I need to log this with support?

Many thanks :) 

https://pastebin.com/XNNv9UpL

When you say:

"Same issue occurred when stopping the Windows Update Service too".  Is this ESH process crashing?  Did that include disabling the service and stopping it?

Hi, Yes I stopped within services.msc then tried to reload ESH. All processes half way loaded again and crashed without warning. So no difference with the service Stopped or Started.

But was the Windows Update service stopped AND disabled.  My concern was if the service is started by the COM call from ESH and then fails.  If the service is disabled it cannot start.