"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
Automatic updates are failing, the following is logged in the Sophos Console:
00000070 There was a problem while establishing a connection to the server. Details: LogonUser ("SophosSAUxxx0", ".", ...) failed A Windows API call returned error 1385.
Error 1385 is a Windows system error that means the following:
Logon failure: The user has not been granted the requested logon type at this computer.
First seen in Sophos Anti-Virus for Windows 2000+
This can occur if the Authenticated Users group has "Deny log on as a service" enabled.
Check the policy applied to the computer.
Standalone or Workgroup Networks - Local Security Settings:
Domain Group Policy Windows 2003/2008 Active Directory:
Switch to HTTP updating
HTTP updating can be used to work around this issue. See article 38238 for more information.
Create a new account for Sophos AutoUpdate
A new account can be created for AutoUpdate to use for during updates, before working through these steps you will need to see Manually creating an AutoUpdate account for details.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.