Sophos Endpoint Installation bleibt hängen

Hello Ardit Latifaj 

We appreciate your reaching out to the Sophos Community Forum.

Can you please help us with more information:

1. OS version.

2. Number of affected devices.

3 We need a screenshot of the task manager to understand which component consumes the most resources. 

4. Please help us with the cloudinstaller logs to check for any error or partial installation of sophos on the device. This might happen due to the partial installation of sophos on the device. 

Regards, 

Hello and thank you for the feedback, my apologies for forgetting some details, unfortunately I don't create that many support cases so unfortunately I forgot.

1. OS-Version: Windows 11 23H2 (Build 22631.3880)
2. So far I have received feedback from the customer for 5 devices

3. 

Die Installation ist nach knapp 50 Minuten durchgelaufen - in der Regel dauert dies nur einige Minuten.

4. SophosCloudInstaller_20240814_124745.log

Hello Ardit Latifaj 

Sure, no worries. I have gone through the logs and the information you have added. 

I can see the error in the logs: 

2024-08-14T13:39:06.1402723Z ERROR: Error downloading/running stage 2: Setup program failed with code: 1
2024-08-14T13:39:06.1412725Z ERROR: Exception: Setup program failed with code: 1

Here, I would suggest you re-install the sophos. Please uninstall the sophos using the sophos ZAP tool: Sophos ZAP. This happens due to the partial installation of sophos on the device. Ensure you download the new installer(Endpoint) from the central console and install it on the device. 

In addition, make sure there’s no third-party security software installed on the device. 

Let me know how it goes.

Regards, 

Hello Rutvik Chavda 

I ran the SophosZAP tool, but it didn't resolve the issue. In a previous Sophos case, the support team mentioned that they noticed another antivirus program, a "3rd-party" solution, installed based on the CMD output from "fltmsc." However, this antivirus program is actually part of Windows Defender, which comes standard and has never caused any problems in the past.

I then reinstalled the system, which allowed the antivirus to install flawlessly, and the performance was perfect. Previously, the performance was very poor. However, one thing I noticed after the reinstallation is that the "MsSecFlt" entry no longer appears in the list. Unfortunately, I can't reinstall all the notebooks. Do you have any other ideas about what could be causing the problem?

Can you locate the "Sophos ML Engine Install Log" in the "C:\Windows\Temp" directory? The Sophos ML Engine appears to be the only component installation failure recorded in the logs. 

The logs specific to this component will give us more information on what may have gone wrong.

Dear Sir or Madam,

I would like to thank you for your assistance with the installation. Together with our customer, we were able to determine that the issue was related to a pre-configured Windows 11 23H2 image. During the installation of Windows, "MsSecFlt" is installed, which prevents the Sophos antivirus software from being installed. Additionally, the image negatively impacts system performance. After a clean reinstallation of Windows 11 23H2, no errors were detected.

The case can be closed.

Dear Sir or Madam,

I would like to thank you for your assistance with the installation. Together with our customer, we were able to determine that the issue was related to a pre-configured Windows 11 23H2 image. During the installation of Windows, "MsSecFlt" is installed, which prevents the Sophos antivirus software from being installed. Additionally, the image negatively impacts system performance. After a clean reinstallation of Windows 11 23H2, no errors were detected.

The case can be closed.

Thank you for following up to share your solution!