Failed to install ntp: unexpected error

Hi,

There should be an install log in \windows\temp.  This is an MSI log so it might be quite large but if you make it availble here that should reveal all.

Regards,

Jak

The only thing I am finding in the logs that contain the word "ntp" was in the sophos network threat protection install logs.  I submitted a diagnostics log for Sophos Support to analyze.

The failed to install ntp: unexpected error is just showing up in the events log in the cloud console.

In the logs I do see "setup::MsiInstaller::installOrUpgrade: Install/upgrade returned 1603"

The log file: Sophos Network Threat Protection Install Log (timestamp).txt you found has logging from the setup plugin, and the MSI logging itself.  If you search down from the top for the phrase:

return value 3

does it come up with anything?  If so, the 10 lines above should provide enough context, failing which, attaching thee entire log here would be good.

Regards,

Jak

Here is the log.

Hi,

Is the Windows Event log service started? You can check if you launch services.msc.  If not, can you start the service and force an update to kick off a new install attempt?

Regards,

Jak

The event log service wont start.  Could that be the problem?

Hi,

OK...Interesting, how about check the permissions on "c:\windows\system32\logfiles\wmi\RTbackup". 

Ensure that the local system account has full control, reboot and then see if the Event Log service starts.  If so, the next update of Sophos should work.

Regards,

Jak

Jak

I also have this issue on a device in my estate, However my differs alittle from the original post.

CAQuietExec:  Transaction support within the specified resource manager is not started or was shut down due to an error.
MSI (s) (B4!A0) [15:03:11:718]: Closing MSIHANDLE (138) of type 790531 for thread 7328
MSI (s) (B4!A0) [15:03:11:718]: Creating MSIHANDLE (139) of type 790531 for thread 7328
CAQuietExec:  Error 0x80071a91: Command line returned an error.
MSI (s) (B4!A0) [15:03:11:719]: Closing MSIHANDLE (139) of type 790531 for thread 7328
CAQuietExec:  Error 0x80071a91: CAQuietExec Failed
MSI (s) (B4:28) [15:03:11:719]: Closing MSIHANDLE (136) of type 790536 for thread 2988
CustomAction RegisterEventManifest returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)MSI (s) (B4:AC) [15:03:11:721]: User policy value 'DisableRollback' is 0
MSI (s) (B4:AC) [15:03:11:721]: Machine policy value 'DisableRollback' is 0
Action ended 15:03:11: InstallFinalize. Return value 3.

Have tried running "fsutil resource setautoreset true c:\" from the command prompt and removing transaction logs from C:\Windows\System32\Config\TxR\ but no dice.

Any Ideas ?

I apologise after a couple of reboots that's fixed it. Odd.