The Sophos Community will be offline for scheduled maintenance this Saturday, May 27th, at 13:00 UTC for approximately 1 hour. Apologies for any inconvenience caused.
"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
A client computer fails to send Patch assessments back to the Patch Event Viewer within Sophos Enterprise Console. On the client, the xxxx_session.log in:
Windows XP/2003 - C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Patch Agent\Logs\
C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Patch Agent\Logs\
Windows Vista+ - C:\Program Data\Sophos\Sophos Patch Agent\Logs\
C:\Program Data\Sophos\Sophos Patch Agent\Logs\
contains the below text:
Code: 0x80004005 Unspecified error Evidence: Info Msg: Missing required file Program Directory: C:\Program Files\Sophos\Sophos Patch Agent\ File: mcescan.cab
First seen in Sophos Endpoint Security and Control 10.0
Sophos Enterprise Console 5.0 and 5.1 use a default 1 minute timeout for file transfer to Patch client computers, on some networks this may not allow enough time to download the large mcescan.cab file.
Sophos Enterprise Console 5.2 has this setting increased to 5 minutes by default.
This issue needs to be resolved on the Sophos Enterprise Console server and all affected clients.
You need to take either of the below actions:
<binding name="PatchBindingConfiguration" maxReceivedMessageSize="2000000" transferMode="Streamed">
<binding name="PatchBindingConfiguration" maxReceivedMessageSize="2000000" transferMode="Streamed" sendTimeout="00:05:00">
Note: Under certain conditions you may find that 5 minutes is not long enough to download the mcescan.cab file, if so you will need to increase the timeout to 10 minutes even after upgrading to Sophos Enterprise Console 5.2.
Http Retrieve file failed. Server: secserver.domain.com Port: 80 Action: /Sophos/Management/Patch/EndpointCommunicator/v101/file/0064d5e5c2d142f2a9b9f32d1d0a6d3a
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.