The Sophos Community will be offline for scheduled maintenance this Saturday, May 27th, at 13:00 UTC for approximately 1 hour. Apologies for any inconvenience caused.
"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
When you run 'Protect computers' from the Enterprise Console you see the following error in the console, logged against the computer it applies to:
Error Code 00000034: Could not access the shared folder from which the installation program is run
First seen in Enterprise Console 4.5.0
The error may appear when the server is under a temporary heavy load. Therefore waiting for the process causing the temporary load to complete will help.
This extra load could be because the Sophos management server has just been upgraded or a new Endpoint Security package has been downloaded centrally and new deployments to clients are underway. If you are manually protecting a large number of clients there may be too many concurrent connections to the share and this can overload the server. To avoid the error you should protect a smaller number of clients at a time.
If the server is not under load then please continue with the steps below.
Even if there are no issues recorded it is recommended you now force an update to the SUM server.
In the Enterprise Console select Update Managers from the toolbar, right-click the update manager and select "Update Now".
1The address path in the policy should only be entered up to and including the share name i.e. \\servername\SophosUpdate or http://servername/SophosUpdate. The subscription applied to the particular updating policy (see the Subscription tab) will tell the client the exact sub-folder to update from. The updating address combined with the subscription will appear locally in the client's updating policy i.e. \\servername\SophosUpdate\CIDs\S000\SAVSCFXP or http://servername/SophosUpdate/CIDs/S00/SAVSCFXP
If Sophos AutoUpdate has installed (i.e. a blue Sophos shield is shown in the system tray by the clock) the ALC.log file should be checked. The log should be accessed via the shield.
Check if there are any particular errors messages or error codes shown and search the knowledgebase for troubleshooting advice as required.
On the client reporting the error confirm that it can access the UNC path by browsing to the path from Start | Run. If the share opens this has confirmed the account you are currently logged onto the computer with can access the share. You should now check the account used in the updating policy can connect to the share.
If there are only a few clients reporting the error then an acceptable workaround is to delete the client from the console, re-find the computer again and re-deploy. This will resolve/ confirm if there are any DNS or networking issues.
For testing purposes only you can run the Sophos Anti-Virus MSI file to see if it installs correctly or produces an error message.
If you have completed all the steps above and are still experiencing the issue please forward a Sophos Diagnostic Utility output to Sophos Technical Support from the client and the SUM server/ management server.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.