The Sophos Community will be offline for scheduled maintenance this Saturday, May 27th, at 13:00 UTC for approximately 1 hour. Apologies for any inconvenience caused.
"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
Upgrade from Enterprise Console 5.0 to Enterprise Console 5.1 fails with the message:
Sophos Enterprise Console 5.1.0 Installation Failed
A red warning circle with a white cross is displayed with no text to the right as shown in this screenshot (click for larger image):
The Sophos bootstrap log (\ProgramData\Sophos\Management Installer\) contains the following message:
[Date Time], INFO : Could not get database account information from previous version. Database Page will be displayed
and later on the following text is logged:
[Date Time], INFO : About to install Server[32|64].msi [Date Time], INFO : Processing INSTALLMESSAGE_TERMINATE message from MSI [Date Time], INFO : Installation of Server[32|64].msi failed with error code: 1603 [Date Time], INFO : Ended installing Server[32|64].msi [Date Time], INFO : Installation of Management Server failed with error code: 1603
The MSI log of the Server[32|64].msi contains the following error messages:
MessageQueuingExecuteUninstall: Error 0x80070032: Domain SIDs not supported MessageQueuingExecuteUninstall: Error 0x80070032: Failed to get SID for account name MessageQueuingExecuteUninstall: Error 0x80070032: Failed to remove message queue permission MessageQueuingExecuteUninstall: Error 0x80070032: Failed to remove message queue permissions CustomAction MessageQueuingExecuteUninstall returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
First seen in Enterprise Console 5.1.0
Manual modification of the Enterprise Console 5.0 install to remove/clear the database user registry account details.
See 'Technical details' section below for more information.
C:\Program Files\Sophos\Enterprise Console\ObfuscationUtil.exe
ObfuscationUtil.exe -w --obfuscate clearpass
From the current state of the installation you have two options:
The following steps should be followed to revert back to a working Enterprise Console 5.0:
C:\Program Files\Sophos\Enterprise Console\DataBackupRestore.exe -action=backup -subsystem=All -datasourcetype=Database
C:\Program Files\Sophos\Enterprise Console\DataBackupRestore.exe -action=restore -subsystem=All -datasourcetype=Database
The registry key: HKLM\SOFTWARE\[Wow6432Node]\Sophos\EE\Management Tools\DatabaseUser, contains account information the 'Sophos Management Service' service uses to connect to the Sophos database. This key should contain the database account details chosen during installation. Article 113954 has more information on the accounts requested during installation.
During the upgrade to Enterprise Console 5.1 the installer attempts to read the account information back from these keys. If it fails to obtain the values it displays the database account page for the user to confirm the SQL Server instance and account information. Note: This 'database' screen of the installer is not shown during an 'upgrade' workflow and is therefore indicative of the problem.
The upgrade proceeds, however the account information is not available during the uninstall of Enterprise Console 5.0 which leads to the failure.
Tutti i commenti qui inseriti vengono letti (dal team di supporto), ma non verranno inviate risposte specifiche ad alcun quesito tecnico. Nel caso richiediate supporto tecnico, vi invitiamo a postare il vostro quesito nella nostra community. Altrimenti, se la richiesta di supporto riguarda un prodotto con licenza, vi invitiamo ad aprire un ticket per il team di supporto.