This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Network Trheat Protection installation failed

The component is not installed, I already tried to uninstall and install again, restart the computer several times and nothing, the operating system is windows 10

SophosCloudInstaller_20230302_041225.log

2023-02-28T23:26:01.054Z [ 7252: 7024] I Begin IProductSetup2::Install for Sophos Network Threat Protection
2023-02-28T23:26:01.055Z [ 7252: 7024] A Constructing installer for Sophos Network Threat Protection
2023-02-28T23:26:01.056Z [ 7252: 7024] I   ZTNA is not installed: nothing to uninstall
2023-02-28T23:26:01.201Z [ 7252: 7024] I Running: NTP installer
2023-02-28T23:26:01.201Z [ 7252: 7024] I   Executing step: Current Installation Version Logger
2023-02-28T23:26:01.201Z [ 7252: 7024] I     NTP Version: <Not Installed>
2023-02-28T23:26:01.202Z [ 7252: 7024] I     Sntp Version: <Not Installed>
2023-02-28T23:26:01.202Z [ 7252: 7024] I     SophosZtnaTap Version: <Not Installed>
2023-02-28T23:26:01.202Z [ 7252: 7024] I     SntpService Version: <Not Installed>
2023-02-28T23:26:01.202Z [ 7252: 7024] I   Executing step: To Be Installed Version Logger
2023-02-28T23:26:01.202Z [ 7252: 7024] I     NTP Version: 1.17.1467
2023-02-28T23:26:01.203Z [ 7252: 7024] I     Sntp Version: 1.17.1461
2023-02-28T23:26:01.204Z [ 7252: 7024] I     SophosZtnaTap Version: 9.24.6.3
2023-02-28T23:26:01.205Z [ 7252: 7024] I     SntpService Version: 1.17.1361
2023-02-28T23:26:01.205Z [ 7252: 7024] I   Executing step: NTP directory installer
2023-02-28T23:26:01.205Z [ 7252: 7024] I     Executing step: Create directory C:\Program Files\Sophos\Sophos Network Threat Protection and all parent directories
2023-02-28T23:26:01.206Z [ 7252: 7024] I     Executing step: Create directory C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration and all parent directories
2023-02-28T23:26:01.207Z [ 7252: 7024] I     Executing step: Create directory C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules and all parent directories
2023-02-28T23:26:01.208Z [ 7252: 7024] I     Executing step: Create directory C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors and all parent directories
2023-02-28T23:26:01.209Z [ 7252: 7024] I     Executing step: Create directory C:\ProgramData\Sophos\Sophos Network Threat Protection and all parent directories
2023-02-28T23:26:01.210Z [ 7252: 7024] I     Executing step: Create directory C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs and all parent directories
2023-02-28T23:26:01.211Z [ 7252: 7024] I     Executing step: Create directory C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS and all parent directories
2023-02-28T23:26:01.212Z [ 7252: 7024] I     Executing step: Create directory C:\ProgramData\Sophos\Heartbeat and all parent directories
2023-02-28T23:26:01.213Z [ 7252: 7024] I     Executing step: Create directory C:\ProgramData\Sophos\Heartbeat\Config and all parent directories
2023-02-28T23:26:01.215Z [ 7252: 7024] I     Executing step: Create directory C:\ProgramData\Sophos\Heartbeat\Logs and all parent directories
2023-02-28T23:26:01.216Z [ 7252: 7024] I     Executing step: Create directory C:\ProgramData\Sophos\Heartbeat\Persist and all parent directories
2023-02-28T23:26:01.217Z [ 7252: 7024] I   Executing step: Driver installer
2023-02-28T23:26:01.218Z [ 7252: 7024] I     Executing step: CopyMultipleFilesStep: copying 3 files
2023-02-28T23:26:01.218Z [ 7252: 7024] I       Executing step: CopyFile(C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Sntp.sys, C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys)
2023-02-28T23:26:01.220Z [ 7252: 7024] I       Executing step: CopyFile(C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Sntp.inf, C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf)
2023-02-28T23:26:01.222Z [ 7252: 7024] I       Executing step: CopyFile(C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Sntp.cat, C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.cat)
2023-02-28T23:26:01.224Z [ 7252: 7024] I     Executing step: CopyFile(C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys, C:\WINDOWS\system32\Drivers\sntp.sys)
2023-02-28T23:26:01.242Z [ 7252: 7024] I     Executing step: Install service step: sntp
2023-02-28T23:26:01.243Z [ 7252: 7024] I       Successfully created service: 'sntp'.
2023-02-28T23:26:01.244Z [ 7252: 7024] I       Set service description to: 'Sophos Network Threat Protection Driver'.
2023-02-28T23:26:01.244Z [ 7252: 7024] I     Executing step: Start service step: sntp
2023-02-28T23:26:01.295Z [ 7252: 7024] I       Waiting 60000ms for service to start.
2023-02-28T23:26:01.295Z [ 7252: 7024] I       Waiting for operation to succeed within 60000ms.
2023-02-28T23:26:01.295Z [ 7252: 7024] I       The service is running.
2023-02-28T23:26:01.295Z [ 7252: 7024] I   Executing step: Event manifest installer
2023-02-28T23:26:01.295Z [ 7252: 7024] I     Executing step: CopyFile(C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Sntp.man, C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man)
2023-02-28T23:26:01.296Z [ 7252: 7024] I     Executing step: RegisterEventManifest(C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man)
2023-02-28T23:26:01.613Z [ 7252: 7024] W       InstallManifest: error installing manifest file C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man
2023-02-28T23:26:01.613Z [ 7252: 7024] E     Failed step: RegisterEventManifest(C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man), rolling back previous steps
2023-02-28T23:26:01.613Z [ 7252: 7024] I     Rolling back step: CopyFile(C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Sntp.man, C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man)
2023-02-28T23:26:01.614Z [ 7252: 7024] W     Failed composite step
2023-02-28T23:26:01.614Z [ 7252: 7024] E   Failed step: Event manifest installer, rolling back previous steps
2023-02-28T23:26:01.614Z [ 7252: 7024] I   Rolling back step: Driver installer
2023-02-28T23:26:01.614Z [ 7252: 7024] I     Rolling back step: Start service step: sntp
2023-02-28T23:26:01.656Z [ 7252: 7024] I       Waiting 60000ms for service stop
2023-02-28T23:26:01.656Z [ 7252: 7024] I       Waiting for operation to succeed within 60000ms.
2023-02-28T23:26:01.656Z [ 7252: 7024] I       Service has stopped.
2023-02-28T23:26:01.656Z [ 7252: 7024] I     Rolling back step: Install service step: sntp
2023-02-28T23:26:01.656Z [ 7252: 7024] I       Rollback: deleting service: sntp
2023-02-28T23:26:01.657Z [ 7252: 7024] I       Waiting 60000ms for service deletion
2023-02-28T23:26:01.657Z [ 7252: 7024] I       Waiting for operation to succeed within 60000ms.
2023-02-28T23:26:01.657Z [ 7252: 7024] I       Successfully deleted service: sntp
2023-02-28T23:26:01.657Z [ 7252: 7024] I     Rolling back step: CopyFile(C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys, C:\WINDOWS\system32\Drivers\sntp.sys)
2023-02-28T23:26:01.659Z [ 7252: 7024] I     Rolling back step: CopyMultipleFilesStep: copying 3 files
2023-02-28T23:26:01.659Z [ 7252: 7024] I       Rolling back step: CopyFile(C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Sntp.cat, C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.cat)
2023-02-28T23:26:01.660Z [ 7252: 7024] I       Rolling back step: CopyFile(C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Sntp.inf, C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf)
2023-02-28T23:26:01.660Z [ 7252: 7024] I       Rolling back step: CopyFile(C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Sntp.sys, C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys)
2023-02-28T23:26:01.661Z [ 7252: 7024] I   Rolling back step: NTP directory installer
2023-02-28T23:26:01.661Z [ 7252: 7024] I     Rolling back step: Create directory C:\ProgramData\Sophos\Heartbeat\Persist and all parent directories
2023-02-28T23:26:01.661Z [ 7252: 7024] I     Rolling back step: Create directory C:\ProgramData\Sophos\Heartbeat\Logs and all parent directories
2023-02-28T23:26:01.661Z [ 7252: 7024] I     Rolling back step: Create directory C:\ProgramData\Sophos\Heartbeat\Config and all parent directories
2023-02-28T23:26:01.661Z [ 7252: 7024] I     Rolling back step: Create directory C:\ProgramData\Sophos\Heartbeat and all parent directories
2023-02-28T23:26:01.662Z [ 7252: 7024] I     Rolling back step: Create directory C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS and all parent directories
2023-02-28T23:26:01.662Z [ 7252: 7024] I     Rolling back step: Create directory C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs and all parent directories
2023-02-28T23:26:01.662Z [ 7252: 7024] I     Rolling back step: Create directory C:\ProgramData\Sophos\Sophos Network Threat Protection and all parent directories
2023-02-28T23:26:01.662Z [ 7252: 7024] I     Rolling back step: Create directory C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors and all parent directories
2023-02-28T23:26:01.662Z [ 7252: 7024] I     Rolling back step: Create directory C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules and all parent directories
2023-02-28T23:26:01.662Z [ 7252: 7024] I     Rolling back step: Create directory C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration and all parent directories
2023-02-28T23:26:01.662Z [ 7252: 7024] I     Rolling back step: Create directory C:\Program Files\Sophos\Sophos Network Threat Protection and all parent directories
2023-02-28T23:26:01.663Z [ 7252: 7024] I   Rolling back step: To Be Installed Version Logger
2023-02-28T23:26:01.663Z [ 7252: 7024] I   Rolling back step: Current Installation Version Logger
2023-02-28T23:26:01.663Z [ 7252: 7024] W   Failed composite step
2023-02-28T23:26:01.663Z [ 7252: 7024] I Execution failed: NTP installer
2023-02-28T23:26:01.663Z [ 7252: 7024] E Action failed; reboot is not required
2023-02-28T23:26:01.663Z [ 7252: 7024] I End product setup



This thread was automatically locked due to age.
  • Hi Edwin,

    Thanks for reaching out to the Sophos Community Forum. 

    Let me know if it's possible for you to do the following.

    - Disable Tamper Protection
    - Copy Sntp.man from C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\
    - Paste to C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man
    - Once the file is copied trigger an update

    Let me know if this works for you.

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
  • I would check if wevtutil.exe runs OK on the computer.

    During the install the NTP install process. C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe runs:

    wevtutil.exe im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"

    On removal: SophosNTPUninstall.exe runs:
    wevtutil.exe um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"

    Test 1:

    If you open a cmd prompt and type

    C:\>where wevtutil.exe
    it should return:
    C:\Windows\System32\wevtutil.exe

    Test 2:
    Run:
    wevtutil.exe el 

    This is a test command, all OK?

    Test 3:
    Run Process Monitor and run the installer.
    If it fails, locate where wevtutil.exe is run.  What is the process exit code of wevutuil.exe assuming it is launched? It might be helpful. 

  • Thanks, this worked for me