Unknown Error 0x80070057 decomposing ""

Hello Donald Lindhuber,

0x80070057 normally means parameter error, it could have a number of causes though. I assume (it's just a guess) that a file that is to be scanned "disappears", this might be normal. How frequent are these errors (30-40 PCs out of how many endpoints - I've several thousand but less than one of these per month)? Could be a certain application (as a few ten endpoints show these errors I'd rule out disk or driver errors).  

Christian

That would make sense. This happens to the 30-40 nightly if I clear the error message. This happens at 10:00pm (ET) when scanning occurs. It seems like the PCs are the same ones every night. I will be keeping track of that. It might have something to do with those workstations. This only started occurring after the recent ~140MB download/install that Sophos put out.

Hello Donald,

when scanning occurs
a scheduled scan? Then it might be feasible to set up a trace or use ProcessMonitor to find out what's going on.

Christian

It is a policy set up to scan PCs at 10pm. How would I go about setting up the trace or process monitor with Sophos?

It is a policy set up to scan PCs at 10pm. How would I go about setting up the trace or process monitor with Sophos?

Hello Donald,

please contact Support directly - you say that it seems to have started with the upgrade to 10.6, or perhaps it's just the engine. If it's indeed a change in a Sophos component you'd probably have to send them the logs anyway so it's better to have guidance in advance.

If you are not familiar with Sysinternal's Microsoft's ProcessMonitor (this is what I meant) don't bother (for now).

Christian

I appreciate your help and will contact support!

P.S. I am familiar with Microsoft's Process Explorer, but wasn't sure if you meant that or if there was something that Sophos had to monitor these things.

-Don

Hello Don,

Process Monitor is Explorer's cousin. The basics are intuitive, locating the error in the output is harder.

Christian