This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Uninstallation failed. Unable to locate Sophos UI MSI

I noticed in Sophos Central that one of our machines hadn't updated in a month so went to check it out. I decided to do a fresh install. When trying to uninstall the version currently on the machine I get the following error;

I searched the community for answers but found the issue varied from user to user so I turned on the MSI Logging and this is the result from said log;

Started C:\Program Files\Sophos\Sophos Endpoint Agent\uninstallgui.exe
2019-05-09T07:54:39Z, INFO : Uninstall_IsRebootPending: No reboot pending.
2019-05-09T07:54:39Z, INFO : Machine ID:
2019-05-09T07:54:39Z, INFO : Customer ID: 951362215dff74b1b9442edf10216297
2019-05-09T07:54:39Z, INFO : Endpoint ID: 066a4082-80f8-74a3-2bb9-2361f06fc1c3
2019-05-09T07:54:39Z, INFO : Beginning command definition.
2019-05-09T07:54:39Z, INFO : Checking if service is installed: Sophos AutoUpdate Service
2019-05-09T07:54:39Z, WARNING : Failed to open Sophos AutoUpdate Service : Error code 1060 Service does not exist.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of UI.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of Health.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of MCS.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of SFS.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of SSE.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of MTD.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of SAV.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of Sophos Clean.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of EFW.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of ESH.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of SED.
2019-05-09T07:54:39Z, INFO : Adding command to remove existing installation of SDU.
2019-05-09T07:54:39Z, INFO : Adding command to clean up any remaining registry keys.
2019-05-09T07:54:39Z, INFO : Adding command to clean up any remaining files.
2019-05-09T07:54:39Z, INFO : Command definition complete.
2019-05-09T07:54:39Z, INFO : OS version: 6.1.7601.
2019-05-09T07:54:39Z, INFO : Service pack: 1.0.
2019-05-09T07:54:39Z, INFO : System Language: 1033.
2019-05-09T07:54:39Z, INFO : User Language: 1033.
2019-05-09T07:54:39Z, INFO : 64 bit: yes.
2019-05-09T07:54:40Z, INFO : Starting uninstallation process.
2019-05-09T07:54:40Z, INFO : Starting Sophos UI uninstall command.
2019-05-09T07:54:40Z, INFO : Detected MSI version: 5.0.7601
2019-05-09T07:54:40Z, INFO : About to Uninstall Sophos UI
2019-05-09T07:54:40Z, INFO : Processing INSTALLMESSAGE_RESOLVESOURCE message from MSI
2019-05-09T07:54:40Z, INFO : Processing INSTALLMESSAGE_TERMINATE message from MSI
2019-05-09T07:54:40Z, INFO : Uninstallation of Sophos UI failed with error code: 64c
2019-05-09T07:54:40Z, INFO : Ended uninstalling Sophos UI
2019-05-09T07:54:40Z, ERROR : Sophos uninstall command failed.
2019-05-09T07:54:40Z, INFO : Command completed: success 0, reboot required: 0.
2019-05-09T07:54:40Z, ERROR : Uninstallation failed.
2019-05-09T07:54:40Z, ERROR : Failed to open registry key. Error : 183
2019-05-09T07:54:40Z, WARNING : WinHttpGetProxyForUrl returned: 2f94
2019-05-09T07:54:40Z, INFO : Json to send: {} to: t1.sophosupd.com
2019-05-09T07:54:40Z, INFO : Sending HTTP PUT request to: prod/2019-05-09T07:54:39.384000Z-.json

I'm not sure the best course of action and I cannot find anything related to the "Uninstallation of Sophos UI failed with error code: 64c" message in there.

Any help would be greatly appreciated.

This thread was automatically locked due to age.

0 Phil C1 over 5 years ago

I also just realized I added the wrong log, here is the correct one:

=== Verbose logging started: 09/05/2019 09:35:09 Build type: SHIP UNICODE 5.00.7601.00 Calling process: C:\Program Files\Sophos\Sophos Endpoint Agent\uninstallgui.exe ===
MSI (c) (A0:9C) [09:35:09:844]: Resetting cached policy values
MSI (c) (A0:9C) [09:35:09:844]: Machine policy value 'Debug' is 0
MSI (c) (A0:9C) [09:35:09:844]: ******* RunEngine:
******* Product: {D29542AE-287C-42E4-AB28-3858E13C1A3E}
******* Action:
******* CommandLine: **********
MSI (c) (A0:9C) [09:35:09:844]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (A0:9C) [09:35:09:844]: Grabbed execution mutex.
MSI (c) (A0:9C) [09:35:09:875]: Cloaking enabled.
MSI (c) (A0:9C) [09:35:09:875]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (A0:9C) [09:35:09:875]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (10:9C) [09:35:09:891]: Running installation inside multi-package transaction {D29542AE-287C-42E4-AB28-3858E13C1A3E}
MSI (s) (10:9C) [09:35:09:891]: Grabbed execution mutex.
MSI (s) (10:B8) [09:35:09:891]: Resetting cached policy values
MSI (s) (10:B8) [09:35:09:891]: Machine policy value 'Debug' is 0
MSI (s) (10:B8) [09:35:09:891]: ******* RunEngine:
******* Product: {D29542AE-287C-42E4-AB28-3858E13C1A3E}
******* Action:
******* CommandLine: **********
MSI (s) (10:B8) [09:35:09:891]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (10:B8) [09:35:09:891]: Warning: Local cached package 'C:\windows\Installer\292909f8.msi' is missing.
MSI (s) (10:B8) [09:35:09:891]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (10:B8) [09:35:09:891]: User policy value 'DisableMedia' is 0
MSI (s) (10:B8) [09:35:09:891]: Machine policy value 'AllowLockdownMedia' is 0
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Media enabled only if package is safe.
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Looking for sourcelist for product {D29542AE-287C-42E4-AB28-3858E13C1A3E}
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Adding {D29542AE-287C-42E4-AB28-3858E13C1A3E}; to potential sourcelist list (pcode;disk;relpath).
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Now checking product {D29542AE-287C-42E4-AB28-3858E13C1A3E}
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Media is enabled for product.
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Attempting to use LastUsedSource from source list.
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Trying source C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ui64\.
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Source is invalid due to client source out of sync (product code is the same).
MSI (s) (10:B8) [09:35:09:891]: Note: 1: 1731 2: -2147483645 3: Sophos UI.msi
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Processing net source list.
MSI (s) (10:B8) [09:35:09:891]: Note: 1: 1706 2: -2147483647 3: Sophos UI.msi
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Processing media source list.
MSI (s) (10:B8) [09:35:09:891]: Note: 1: 2203 2: 3: -2147287037
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Source is invalid due to missing/inaccessible package.
MSI (s) (10:B8) [09:35:09:891]: Note: 1: 1706 2: -2147483647 3: Sophos UI.msi
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Processing URL source list.
MSI (s) (10:B8) [09:35:09:891]: Note: 1: 1402 2: UNKNOWN\URL 3: 2
MSI (s) (10:B8) [09:35:09:891]: Note: 1: 1706 2: -2147483647 3: Sophos UI.msi
MSI (s) (10:B8) [09:35:09:891]: Note: 1: 1731 2: 3: Sophos UI.msi
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Now checking product {D29542AE-287C-42E4-AB28-3858E13C1A3E}
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Media is enabled for product.
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Attempting to use LastUsedSource from source list.
MSI (s) (10:B8) [09:35:09:891]: SOURCEMGMT: Trying source C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ui64\.
MSI (s) (10:B8) [09:35:09:906]: SOURCEMGMT: Source is invalid due to client source out of sync (product code is the same).
MSI (s) (10:B8) [09:35:09:906]: Note: 1: 1731 2: -2147483645 3: Sophos UI.msi
MSI (s) (10:B8) [09:35:09:906]: Note: 1: 1731 2: 3: Sophos UI.msi
MSI (s) (10:B8) [09:35:09:906]: SOURCEMGMT: Failed to resolve source
MSI (s) (10:B8) [09:35:09:906]: MainEngineThread is returning 1612
MSI (s) (10:9C) [09:35:09:906]: User policy value 'DisableRollback' is 0
MSI (s) (10:9C) [09:35:09:906]: Machine policy value 'DisableRollback' is 0
MSI (s) (10:9C) [09:35:09:906]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (10:9C) [09:35:09:906]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (10:9C) [09:35:09:906]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (10:9C) [09:35:09:906]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2
MSI (s) (10:9C) [09:35:09:906]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2
MSI (s) (10:9C) [09:35:09:906]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (10:9C) [09:35:09:906]: Restoring environment variables
MSI (c) (A0:9C) [09:35:09:906]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (A0:9C) [09:35:09:906]: MainEngineThread is returning 1612
=== Verbose logging stopped: 09/05/2019 09:35:09 ===
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 5 years ago in reply to Phil C1

Hello Phil C1,

Warning: Local cached package 'C:\windows\Installer\292909f8.msi' is missing
denotes the problem. 292909f8.msi is (or has been) the cached (a copy of) previous Sophos UI.msi. Caching is optional and requested at install time. An installer package has a number of properties, the Installer uninstalls only with a package that "matches" the original w.r.t. certain properties. Naturally the cached package is checked first. If there is none (or it has "disappeared") the Installer searches for the original source. Although Sophos UI.msi is in ...\AutoUpdate\Cache\decoded\ui64\ it can't be used because the package code is not the same. According to the release notes the UI version has changed from 1.7.24 to 1.7.134 with the April update.

This is the Central product and the Central forum would perhaps be the better place for this enquiry (that the term Endpoint is used in both Central and SESC is misleading). With the on-prem version it's easy to obtain the "previous" package. If you no longer have one at your site Support should/might be able to provide it - can't say if they do this.

Christian
Cancel
Vote Up 0 Vote Down

Cancel