No Sophos Security products installed - Windows 11

Hello

I am trying to install Sophos Endpoint Client on a VM running Windows 11 (22H2 - 22621.525).
I want to create a gold image.
The installation completes without errors. After that the status says "No Sophos security products installed".
See screenshots. Only the core agent is installed. Sophos Intercept X is missing.

See screenshots and logs.

What is going wrong here?

Greetings Int3g3r

/cfs-file/__key/communityserver-components-multipleuploadfilemanager/9ed7f2d9_2D00_07b9_2D00_46d5_2D00_91a6_2D00_0f0c1003da41-269107-complete/Logs.zip

Parents
  • Thank you for reaching the community forum,

    Does this VM has an existing Sophos endpoint before but got uninstalled? If so? You may need to uninstall this Endpoint first by running the Sophos ZAP tool?

    You can also follow the below steps to force update the endpoint and install the remaining components.

    1. Turn off tamper protection on the affected endpoint.
    2. Log in to the endpoint using an admin account.
    3. In Services, stop Sophos AutoUpdate Service.
    4. Rename the following folders:
      C:\ProgramData\Sophos\AutoUpdate\Cache\decoded
      C:\ProgramData\Sophos\AutoUpdate\data\warehouse

      to:
      C:\ProgramData\Sophos\AutoUpdate\Cache\old-decoded
      C:\ProgramData\Sophos\AutoUpdate\data\old-warehouse
    5. Delete the file SophosUpdateStatus.xml from the below folder:
      C:\ProgramData\Sophos\AutoUpdate\data\status
    6. Start Sophos AutoUpdate Service.
    7. Open Sophos Endpoint Agent.
    8. Go to About and click Update Now.
    9. Click Open Endpoint Self Help Tool.
    10. Click Refresh and check the status of the affected component on the Installed Components page.
    Glenn ArchieSeñas (GlennSen)
    Global Community Support Engineer | Global Community and Digital Customer Support
    Connect, Engage, Earn Rewards - Join the Sophos Community
  • This is a new created VM. I installed Windows 11 today.
    So there is no old Sophos installation.

    I'm gonna try the solution below.

    Edit:
    C:\ProgramData\Sophos\AutoUpdate\data\warehouse, doesn't exist. So i can't rename it.

    Problem persists.
    "No Sophos security products installed" on main page.

  • When viewing the device in Sophos Central, under the "Protection" column what is shown? 

    Kushal Lakhan
    Global Community Support Engineer
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
Reply Children
  • Everything looks normal

    Does Sophos require windows updates to be enabled?
    I have temporarily disabled this.

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager]
    "SilentInstalledAppsEnabled"=dword:00000000

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
    "NoAutoUpdate"=dword:00000001

  • As long as windows updates have been completed relatively recently, you should not encounter any issues. 

    I suggest checking the following log file to see if there are any errors.
    - C:\ProgramData\Sophos\Sophos UI\Logs\SophosUI.Net.log

    What may also help is to kill the "Sophos UI.exe" process from Task Manager, then launch ProcessMonitor, and re-open it. You will need to stop Tamper Protection to do so. Filtering Process monitor for the process "Sophos UI.exe" will allow you to see if there are any Registry Read errors when the process is trying to obtain data to be displayed.

    Kushal Lakhan
    Global Community Support Engineer
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids