Sophos Installation Failure

  Endpoint Installation Failed 

Edit tags
[edited by: GlennSen at 4:55 AM (GMT -7) on 2 Apr 2024]
  • Very odd, I've not seen that before. When the installer runs, the SophoUI component is installed. The logs for the component's installer go to the installing user's temp directory, e.g. %temp%, E.g.

    %temp%\Sophos UI Install Log 2024-03-14 10-42-05Z.txt

    At the bottom of the log, it details that it is going to start the Sophos Ui.exe process for all active sessions:

    2024-03-14T10:42:05.870Z [ 6888: 6884] I Commit step: Start UI in all sessions
    2024-03-14T10:42:05.870Z [ 6888: 6884] W AdjustTokenPrivileges did not adjust all specified privileges. Last error: 1300
    2024-03-14T10:42:05.886Z [ 6888: 6884] W WTSQueryUserToken failed to get user for session 2
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Opened UI in session 2
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Sophos UI 2.10.672 Installer completed successfully.
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Succeeded: Sophos UI 2.10.672 Installer
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Action was successful; reboot is not required

    A Process Monitor log of the install shows Explorer.exe is the Parent of the Sophos UI.exe process:

    10:42:06.0285184 Explorer.EXE 8448 Process Create C:\Program Files\Sophos\Sophos UI\Sophos UI.exe SUCCESS PID: 7824, Command line: "C:\Program Files\Sophos\Sophos UI\Sophos UI.exe" /hidden

    10:42:06.0285233 Sophos UI.exe 7824 Process Start SUCCESS Parent PID: 8448, Command line: "C:\Program Files\Sophos\Sophos UI\Sophos UI.exe" /hidden, Current directory: C:\Windows\system32\, Environment:

    Anything useful in the sophos UI install log around this time?