Thread Info
  • State Not Answered
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 5 replies
  • Subscribers 17 subscribers
  • Views 15480 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Installation Failure

Chathuranga Weerathunga

Endpoint Installation Failed 



This thread was automatically locked due to age.
Parents
  • 0

    Very odd, I've not seen that before. When the installer runs, the SophoUI component is installed. The logs for the component's installer go to the installing user's temp directory, e.g. %temp%, E.g.

    %temp%\Sophos UI Install Log 2024-03-14 10-42-05Z.txt

    At the bottom of the log, it details that it is going to start the Sophos Ui.exe process for all active sessions:

    2024-03-14T10:42:05.870Z [ 6888: 6884] I Commit step: Start UI in all sessions
    2024-03-14T10:42:05.870Z [ 6888: 6884] W AdjustTokenPrivileges did not adjust all specified privileges. Last error: 1300
    2024-03-14T10:42:05.886Z [ 6888: 6884] W WTSQueryUserToken failed to get user for session 2
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Opened UI in session 2
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Sophos UI 2.10.672 Installer completed successfully.
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Succeeded: Sophos UI 2.10.672 Installer
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Action was successful; reboot is not required

    A Process Monitor log of the install shows Explorer.exe is the Parent of the Sophos UI.exe process:

    10:42:06.0285184 Explorer.EXE 8448 Process Create C:\Program Files\Sophos\Sophos UI\Sophos UI.exe SUCCESS PID: 7824, Command line: "C:\Program Files\Sophos\Sophos UI\Sophos UI.exe" /hidden

    10:42:06.0285233 Sophos UI.exe 7824 Process Start SUCCESS Parent PID: 8448, Command line: "C:\Program Files\Sophos\Sophos UI\Sophos UI.exe" /hidden, Current directory: C:\Windows\system32\, Environment:

    Anything useful in the sophos UI install log around this time?

Reply
  • 0

    Very odd, I've not seen that before. When the installer runs, the SophoUI component is installed. The logs for the component's installer go to the installing user's temp directory, e.g. %temp%, E.g.

    %temp%\Sophos UI Install Log 2024-03-14 10-42-05Z.txt

    At the bottom of the log, it details that it is going to start the Sophos Ui.exe process for all active sessions:

    2024-03-14T10:42:05.870Z [ 6888: 6884] I Commit step: Start UI in all sessions
    2024-03-14T10:42:05.870Z [ 6888: 6884] W AdjustTokenPrivileges did not adjust all specified privileges. Last error: 1300
    2024-03-14T10:42:05.886Z [ 6888: 6884] W WTSQueryUserToken failed to get user for session 2
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Opened UI in session 2
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Sophos UI 2.10.672 Installer completed successfully.
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Succeeded: Sophos UI 2.10.672 Installer
    2024-03-14T10:42:06.042Z [ 6888: 6884] I Action was successful; reboot is not required

    A Process Monitor log of the install shows Explorer.exe is the Parent of the Sophos UI.exe process:

    10:42:06.0285184 Explorer.EXE 8448 Process Create C:\Program Files\Sophos\Sophos UI\Sophos UI.exe SUCCESS PID: 7824, Command line: "C:\Program Files\Sophos\Sophos UI\Sophos UI.exe" /hidden

    10:42:06.0285233 Sophos UI.exe 7824 Process Start SUCCESS Parent PID: 8448, Command line: "C:\Program Files\Sophos\Sophos UI\Sophos UI.exe" /hidden, Current directory: C:\Windows\system32\, Environment:

    Anything useful in the sophos UI install log around this time?

Children
No Data
Unfiltered HTML