Reflexion will be End-of-life on March 31,2023. See Sophos Reflexion EoL FAQs to learn more.
Hello,
Can I get an advice what shall I try next on resolving the problem of installation of Endpoint protection on users PC.
The main problem is error:
Last Agent Update - 23 days ago - Update Failed
I had tried reinstalling an Sophos Endpoint protection multiple times but same error occurs at the end of installation "Failed to install ESH64: general error."
I had checked all log files and searched on google for same problems, there was some suggestions to check some registry values and I did but it didn't help. There was also some suggestions for checking PC's services but same result.
Sophos UI log - last part
2022-09-27T14:10:42.106Z [ 9200: 1668] I Launching UI in session 1: 57722022-09-27T14:10:42.106Z [ 9200: 1668] I Sophos UI 2.6.83.0 Installer completed successfully.2022-09-27T14:10:42.106Z [ 9200: 1668] I Succeeded: Sophos UI 2.6.83.0 Installer2022-09-27T14:10:42.107Z [ 9200: 1668] I Action was successful; reboot is not required2022-09-27T14:10:42.107Z [ 9200: 1668] I End product setup
Only error I had came across is this:
Sophos Endpoint Self Help Install log
setup::MsiInstaller::install: New version: {4EFCDD15-24A2-4D89-84A4-857D1BF68FA8}, version: 3.2.339.0setup::`anonymous-namespace'::getMsiInformationFromProductCode: ERR: 1612 Failed to open product: {4EFCDD15-24A2-4D89-84A4-857D1BF68FA8}setup::MsiInstaller::install: Install failed: MsiOpenProductW failed: The installation source for this product is not available. Verify that the source exists and that you can access it.EshSetup::setResult: installation failedEshSetup::InstUninstEntry: Installed in: C:\Program Files\Sophos\Endpoint Self Help\FileOperations::CopyFileForcefully: Copying file 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\esh64\Configuration\CustomConfig.json' to 'C:\Program Files\Sophos\Endpoint Self Help\Configuration\CustomConfig.json'EshSetup::InstallConfig: Successfully copied config fileFileOperations::DeleteDirectoryForcefully: Attempt to delete 'C:\Program Files\Sophos\Endpoint Self Help\Rules'FileOperations::CopyDirForcefully: Copying dir 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\esh64\rules' to 'C:\Program Files\Sophos\Endpoint Self Help\Rules'EshSetup::InstallRules: Successfully installed rules dir
and in SophosUpdate.log
2022-09-28T07:17:25.968Z [ 4772: 8352] I Successfully established interface IProductSetup2.2022-09-28T07:17:27.169Z [ 4772: 8352] I Reboot state: 02022-09-28T07:17:27.169Z [ 4772: 8352] W Failed to install product 7F682906-6E49-481B-89C5-2DCA36720F4F.2022-09-28T07:17:27.180Z [ 6076: 4944] E su-setup: exit 1
So please any advice what should I try next is appreciated
Hello Adis,
Thank you for reaching out via community. Please would you be able to upload the sophosupdate.log here so that we can get an idea of what's happening to the update?Thank You.
Ismail Jaweed Ahmed (Ismail) Senior Professional Service Engineer
I was able to find the same error mentioned in the following article. - RESOLVED Advisory: Sophos Central Windows devices - Sophos ML Engine installation failure
You can also try using the following commands to see if this will perform the necessary certificate installation for you.
mkdir C:\digicerttemp
cd C:\digicerttemp
certutil.exe -urlcache -f cacerts.digicert.com/DigiCertTrustedRootG4.crt C:\digicerttemp\DigiCertTrustedRootG4.crt
certutil.exe -addstore root C:\digicerttemp\DigiCertTrustedRootG4.crt
cd \
rmdir digicerttemp /S /Q
I was also able to find the solution You have mentioned, but that was not the same problem:2022-09-27T16:10:44 wWinMain: Command line: "C:\Program Files\Sophos\Sophos ML Engine\ML1\telemetry\16642859911287214"2022-09-27T16:10:44 `anonymous-namespace'::Startup: Successfully set search path using standard approach.2022-09-27T16:10:44 Validate: Validate using standard approach (no models.json was found)2022-09-27T16:10:44 ValidateData: Sucessfully validated "C:\\Program Files\\Sophos\\Sophos ML Engine\\ML1\\telemetry\\16642859911287214\\model.dat"2022-09-27T16:10:44 wWinMain: Validation succeeded
Hi Adis, Please would you be able to upload the sophosupdate.log here so that we can get an idea of what's happening to the update?The endpoint self-help is the one that is failing. It must be the registry artefacts. We can find out things in the logs.
SophosUpdate (1).logHope that someone will discover what is going on with this PC.
Also, If you can run the below PowerShell code
$global:productNames = @("*sophos*") $global:UninstallKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' ) $global:results = foreach ($global:key in (Get-ChildItem $UninstallKeys)){ foreach ($product in $productNames){ if ($key.GetValue("DisplayName") -like "$product"){ [pscustomobject]@{ DisplayName = $key.GetValue("DisplayName"); KeyName = $key.Name.split('\')[-1]; UninstallString = $key.GetValue("UninstallString"); }}}};$results | Format-Table
Thanks for the log, Confirming that Endpoint Self-help is failing, its component code is 7F682906-6E49-481B-89C5-2DCA36720F4FPlease would you be able to also upload the latest Sophos Endpoint Self Help Install Log from the temp directory here?
Did try to run this power shell but there was an error in command:At line:1 char:38 + $global:productNames = @("*sophos*") $global:UninstallKeys = @('HKLM: ... + ~~~~~~~~~~~~~~~~~~~~~ Unexpected token '$global:UninstallKeys' in expression or statement. At line:1 char:199 + ... Microsoft\Windows\CurrentVersion\Uninstall' ) $global:results = forea ... + ~~~~~~~~~~~~~~~ Unexpected token '$global:results' in expression or statement. + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException + FullyQualifiedErrorId : UnexpectedToken
P r o d u c t S e t u p : : P r o d u c t S e t u p : B e g i n p r o d u c t s e t u p s e t u p : : E n v i r o n m e n t : : G e t N a t i v e M a c h i n e I n f o r m a t i o n : I s W o w 6 4 P r o c e s s 2 s e t u p : : E n v i r o n m e n t : : G e t N a t i v e M a c h i n e I n f o r m a t i o n : p r o c e s s M a c h i n e 0 x 0 0 0 0 0 1 4 C s e t u p : : E n v i r o n m e n t : : G e t N a t i v e M a c h i n e I n f o r m a t i o n : n a t i v e M a c h i n e 0 x 0 0 0 0 8 6 6 4 s e t u p : : E n v i r o n m e n t : : E n v i r o n m e n t : O S i s : 6 4 b i t s e t u p : : E n v i r o n m e n t : : E n v i r o n m e n t : N a t i v e i s : i n t e l E s h S e t u p : : I n s t a l l : B e g i n i n s t a l l E s h S e t u p : : I n s t U n i n s t E n t r y : S h o w g u i : f a l s e E s h S e t u p : : I n s t U n i n s t E n t r y : E x i s t i n g p r o d u c t c o d e : { 4 E F C D D 1 5 - 2 4 A 2 - 4 D 8 9 - 8 4 A 4 - 8 5 7 D 1 B F 6 8 F A 8 } E s h S e t u p : : L o g I n s t a l l e d F i l e I n f o : F i l e s i n f o l d e r '