Unable to locate Sophos Autoupdate MSI

Hello Faruk Ahmed,

given the lack of details the only possible answer is Copy an appropriate MSI from another machine to the location where the Windows Installer expects it. I can add that the location is usually C:\Windows\Installer\ , where the Installer is looking for the cached MSI (its name has been changed to 8 hex digits and you'd have to find out the name from either the uninstall log or the registry).

Christian

How can we find out the name from either the uninstall log or the registry for changing?

Hello ,

for AutoUpdate 5.16. the key is

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9B1ACBFAC6946EA489EAE31AFC6FC545\InstallProperties

and the value LocalPackage names the MSI. Please note the the code (the blue part) might be different if you have another version of AutoUpdate, you can find it by searching for C:\ProgramData\Sophos\AutoUpdate\cache\sau\ under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products.

Christian

Hello

I did not found specific code from C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sau, uder path is missing here,How can find out specific code.

Hello  Faruk Ahmed ,

you have to search for this path in the registry, (under HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products) this should take you to the Installer key with the correct code in case the one I posted does not exist. It seems this is a Central installation so likely it is different.

Christian

Hello

I understood. Your code not matched with my code.It may be different .how can find out my code for change?

Hello  Faruk Ahmed,

as said, if you don't know the code you have to search for the ...\decoded\sau\ path to find the name of the MSI. I've used the path that applies to my system (it does not contain the decoded) but it should show the principle. The path is in the InstallSource value, the LocalPackage value contains the name of the cached MSI.

Christian

As you have on-prem, to get the same version of the msi needed you might need to obtain it from a computer that is running the same version, maybe it's been off for a while and just hasn't updated or you might need to create a new subscription in SUM to create a new CID of an older package to obtain the MSI file.

As Christian points out, the first step is to find the expected file name for the cached MSI and the version of the component installed.  You can find both of these under:

\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\[CODE]\InstallProperties

DisplayVersion
LocalPackage

As you now have the version installed you need to find the MSI that matches that version.  The SEC UI allows you to see the version of components in a subscription so that will help.  Once you find the Sophos AutoUpdate.msi file for the version installed you can copy it to the same location as defined in the LocalPackage.  The uninstall should then work,

Worse case is you can use SophosZap and it will blow it all away.

I agree with SophosZap, it might be easier and faster to just wipe Sophos from the machine and reinstall it here.