Central Endpoint install error - Management console is installed. SEC us not installed?!

Hello Dan,

the log doesn't tell what checks are performed. You don't happen to know hoe SEC was removed some time ago, do you? Or which SEC version it was?
There might be a leftover key like mentioned here (though you'd have to find out the correct product code for the SEC version). 

Christian

Hi QC

It wasn't me that removed it - so I can only assume it was done via the uninstall programs in control panel.

I believe it was version 5.5.2.

Just checked the link and the reg keys mentioned in the thread are not present on the system.

Thanks

Dan.

Hi QC

Those reg keys do not exist on the server :(

Thanks.

Dan.

Hello Dan,

if it wasn't 5.5.2 then this would be no surprise. And I'm just guessing that the installer looks for just these keys.

Codes for other 64bit versions:
5.5.1: {F588BA9B-A6FD-4D5A-9978-52925367AF0A} / B9AB885FDF6AA5D4998725293576FAA0
5.5.0: {9BCC5C9E-94B6-40CA-A025-2A33C78256C6} / E9C5CCB96B49AC040A52A2337C28656C

Hope one of them helps

Christian

They do not exist either

Dan.

Hello Dan,

hm. Too bad. Don't think someone used the Server32.msi or that it was an older version.

I'm afraid, I have no idea what else the installer checks. Perhaps has a hint.

Christian

No worries - thanks for your help anyway!

I have a case open with Support but they're taking ages to get back to me.

If you look in the Central Installer log (\programdata\sophos\cloudinstaller\logs\) you will see the checks, e.g.:

2021-02-17T18:55:50.7846233Z INFO : Running System Property Check: NotSecServer ...
2021-02-17T18:55:50.7886119Z INFO : System Property Check: NotSecServer - PASSED

For example, now this is a MSI based component so the best way to check for the presence of a MSI component is the upgrade code as product codes can change.

If you run Process Monitor at the same time (Sysinternals/Microsoft) you will see the registry check for the upgrade codes by the Cloud installer.

Add a couple of filters:

• ProcessName contains SophosSetup
• Registry Events only
• Path contains upgradecodes

You will see at the same time a Success rather than a Name Not Found

The upgrade code it finds at the time of the failing test will be the issue.

If it helps I found a copy of the SEC installer: C:\sec_551\ServerInstaller\

UpgradeCodes

{C2419059-C131-46CB-922A-E823587552BA} is Server64.msi

{271306A7-5799-4B1B-AEC1-8DC159D2613E} is Server32.msi

If you just open a MSI up in Orca, you can view the Property table to see the UpgradeCode property for a MSI file.

These GUIDs are actually referenced in the registry slightly differently:

C2419059-C131-46CB-922A-E823587552BA = 9509142C131CBC6429A28E32855725AB in the registry.

Note each part is backwards.

Hi 

I have found the below key from SysInternals

Do I need to delete the highlighted key then?

Thanks

Hello Dan,

Do I need to delete
of course - apparently this is one of the things the installer is looking for. As it belongs to a product that is no longer installed it should be pretty safe to delete.

Christian

That's done it!

Thank you both!

That's done it!

Thank you both!