We have a bunch of PCs in our factory that have limited website access. There is a list of approved websites they can reach.
On these units Sophos will not update. I am trying to find out the location of the site it's trying to download from so I can add it to the list of sites these PCs can access.
Thanks,
Steve
Hi Steve,
Is that Endpoint managed via Sophos Central [cloud]?
In that case, please follow the Link here and reinstall Sophos Autoupdate manually and see if that fixes the issue.
Sophos AutoUpdate is missing during the initial Sophos Cloud installation or during an update.
If that is an Endpoint managed by an on-premise version, then please check the MSI Install logs located at C:\Windows\Temp or %temp% folder on that device to find the error message.
An uninstall reinstall will also help.
Thank you for the reply.
I do not have that issue. All the services are there and running, however I did go and try the instructions sent, however even with Admin rights on that PC it won't complete the install saying:
Could not delete key \SOFTWARE\Sophos\Remote Management System\ManagementAgent\Adapters\ALC. Then it says it can't write the value either.
The issue is we have web access rules on these PCs they aren't reaching the server to do the update.
If I knew what the server name/IP is that autoupdate is reaching I can add it to the list of approved websites and it should let us update Sophos.
Hi Steve,
Here are the list of Domains you need to white list to access Sophos cloud servers for updates.
Saj,
Thank you for that document. That is exactly what I needed. However I noticed in the doc it showed where some of the logs were so I took a look to see if it showed exactly which site it was trying to reach.
It did and I noticed that it started back in August.
2019-11-20T14:12:13.943Z [ 6468] [v6.0.457.0] INFO No update caches configured
2019-11-20T14:12:13.943Z [ 6468] [v6.0.457.0] INFO Updating over HTTP
2019-11-20T14:12:14.754Z [ 6468] [v6.0.457.0] INFO No manually configured proxy.
2019-11-20T14:12:14.754Z [ 6468] [v6.0.457.0] INFO WinHttp default proxy not set
2019-11-20T14:12:14.770Z [ 5268] [v6.0.457.0] WARN Failed to get the automatic proxy configuration. The error code was 12180.
2019-11-20T14:12:14.770Z [ 6468] [v6.0.457.0] INFO Trying update location: dci.sophosupd.com/.../c81ebd40582d49026d19aaf659f56eea.dat with proxy: <direct; no proxy>
2019-11-20T14:12:19.763Z [ 6468] [v6.0.457.0] WARN Failed update location: http://dci.sophosupd.com with proxy: <direct; no proxy>: WinHttpReceiveResponse failed with error code 12002
2019-11-20T14:12:19.763Z [ 6468] [v6.0.457.0] INFO Trying update location: dci.sophosupd.net/.../c81ebd40582d49026d19aaf659f56eea.dat with proxy: <direct; no proxy>
2019-11-20T14:12:24.771Z [ 6468] [v6.0.457.0] WARN Failed update location: http://dci.sophosupd.net with proxy: <direct; no proxy>: WinHttpReceiveResponse failed with error code 12002
2019-11-20T14:12:24.771Z [ 6468] [v6.0.457.0] INFO Trying update location: dci.sophosupd.com/.../c81ebd40582d49026d19aaf659f56eea.dat with proxy: <direct; no proxy>
2019-11-20T14:12:29.764Z [ 6468] [v6.0.457.0] WARN Failed update location: http://dci.sophosupd.com with proxy: <direct; no proxy>: WinHttpReceiveResponse failed with error code 12002
2019-11-20T14:12:29.764Z [ 6468] [v6.0.457.0] INFO Trying update location: dci.sophosupd.net/.../c81ebd40582d49026d19aaf659f56eea.dat with proxy: <direct; no proxy>
2019-11-20T14:12:34.772Z [ 6468] [v6.0.457.0] WARN Failed update location: http://dci.sophosupd.net with proxy: <direct; no proxy>: WinHttpReceiveResponse failed with error code 12002
2019-11-20T14:12:34.772Z [ 6468] [v6.0.457.0] INFO Trying update location: dci.sophosupd.com/.../c81ebd40582d49026d19aaf659f56eea.dat with proxy: <direct; no proxy>
2019-11-20T14:12:39.764Z [ 6468] [v6.0.457.0] WARN Failed update location: http://dci.sophosupd.com with proxy: <direct; no proxy>: WinHttpReceiveResponse failed with error code 12002
2019-11-20T14:12:39.764Z [ 6468] [v6.0.457.0] INFO Trying update location: dci.sophosupd.net/.../c81ebd40582d49026d19aaf659f56eea.dat with proxy: <direct; no proxy>
2019-11-20T14:12:44.773Z [ 6468] [v6.0.457.0] WARN Failed update location: http://dci.sophosupd.net with proxy: <direct; no proxy>: WinHttpReceiveResponse failed with error code 12002
2019-11-20T14:12:44.773Z [ 6468] [v6.0.457.0] INFO Trying update location: dci.sophosupd.com/.../c81ebd40582d49026d19aaf659f56eea.dat with proxy: <direct; no proxy>
2019-11-20T14:12:49.765Z [ 6468] [v6.0.457.0] WARN Failed update location: http://dci.sophosupd.com with proxy: <direct; no proxy>: WinHttpReceiveResponse failed with error code 12002
2019-11-20T14:12:49.765Z [ 6468] [v6.0.457.0] INFO Trying update location: dci.sophosupd.net/.../c81ebd40582d49026d19aaf659f56eea.dat with proxy: <direct; no proxy>
2019-11-20T14:12:54.774Z [ 6468] [v6.0.457.0] WARN Failed update location: http://dci.sophosupd.net with proxy: <direct; no proxy>: WinHttpReceiveResponse failed with error code 12002
2019-11-20T14:12:54.774Z [ 6468] [v6.0.457.0] INFO Trying update location: dci.sophosupd.com/.../c81ebd40582d49026d19aaf659f56eea.dat with proxy: <direct; no proxy>
2019-11-20T14:12:59.766Z [ 6468] [v6.0.457.0] WARN Failed update location: http://dci.sophosupd.com with proxy: <direct; no proxy>: WinHttpReceiveResponse failed with error code 12002
2019-11-20T14:12:59.766Z [ 6468] [v6.0.457.0] INFO Trying update location: dci.sophosupd.net/.../c81ebd40582d49026d19aaf659f56eea.dat with proxy: <direct; no proxy>
2019-11-20T14:13:04.774Z [ 6468] [v6.0.457.0] WARN Failed update location: http://dci.sophosupd.net with proxy: <direct; no proxy>: WinHttpReceiveResponse failed with error code 12002
2019-11-20T14:13:05.617Z [ 6468] [v6.0.457.0] ERROR No reachable update locations
I've reached out to my Network vendor to open up our web services to they can access dci.sophosupd.net. I'll see if this fixes the issue.
According to my vendor he is saying that the server for shphosupd is already in our web list so I'm not sure where the problem is coming from. I have confirmed I can ping the server from the PCs but Sophos just won't update anymore.
Any more ideas are appreciated.
Steve
Hello Steve,
I can ping
I can't refrain from pointing out time and again that ping (contrary to common expectation) doesn't tell much if anything at all. That it succeeds only confirms that there is a network path to the update servers.
We're concerned with an application that encounters a 12002 (timeout). The problem is likely in the transport (TCP) or application (HTTPS) layer. Please try to open the update location with a browser. The result should indicate whether the location can't be reached (i.e. it doesn't get as far as sending a request) or no response is received.
Christian
Hello Steve,
I can ping
I can't refrain from pointing out time and again that ping (contrary to common expectation) doesn't tell much if anything at all. That it succeeds only confirms that there is a network path to the update servers.
We're concerned with an application that encounters a 12002 (timeout). The problem is likely in the transport (TCP) or application (HTTPS) layer. Please try to open the update location with a browser. The result should indicate whether the location can't be reached (i.e. it doesn't get as far as sending a request) or no response is received.
Christian
