operation failed ... unknown error: boost::filesystem::status: Access is denied: "C:\WINDOWS\Temp\LB4.tmp"

Hello Joseph Pawlicki,

don't have permissions to remove
Access is denied suggests a permissions issue but it doesn't seem to be an attempt to remove and I'm not aware that Endpoint updating writes to %TEMP%. Anyway without context there's not much to say - could you post a larger part of the log (is it the ALUpdate log?), ideally the whole component update cycle?

Christian

Egg-zactly.  It complains about permissions on these files, yet I can't even view permissions as there's no Security tab (Win2003 - WTH?).  Clearly it's Sophos that's creating the files to begin with, so how can there be an access issue?  Booted to safe mode so that I could remove them, but when system restarts the symptom repeats with new temp files.  The internet, and so far Sophos support, have been surprisingly unhelpful, so thought I'd try here to see if others have encountered.  The log sequence goes:

Time: 6/2/2016 7:48:25
Message: ERROR: the operation failed due to an unknown error: boost::filesystem::status: Access is denied: "C:\WINDOWS\Temp\LB4.tmp"
Module: ALUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:48:25
Message: Product has been successfully installed
Module: ALUpdate
Process ID: 1112
Thread ID: 2792

Time: 6/2/2016 7:47:45
Message: Installing Product Sophos PureMessage
Module: ALUpdate
Process ID: 1112
Thread ID: 2792

Time: 6/2/2016 7:47:44
Message: Installation of Sophos AutoUpdate skipped
Module: ALUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:44
Message: Installation of SAVXP skipped
Module: ALUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:44
Message: Installation of RMSNT skipped
Module: ALUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:44
Message: Downloading phase completed
Module: ALUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:44
Message: Product cache update from secondary server successfully finished
Module: ChannelUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:44
Message: Downloading product PMSR Data from server pmw-dynamic.sophos.com/.../
Module: ChannelUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:35
Message: Downloading product Sophos Endpoint Security and Control from server sophos
Module: SDDS2Update
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:35
Message: Product cache update from primary server successfully finished
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:35
Message: Downloading product Sophos AutoUpdate from server \\SENEGAL\SophosUpdate\CIDs\S000\SAVSCFXP\
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:35
Message: Product cache update from primary server successfully finished
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:35
Message: Downloading product SAVXP from server \\SENEGAL\SophosUpdate\CIDs\S000\SAVSCFXP\
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:35
Message: Product cache update from primary server successfully finished
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:35
Message: Downloading product RMSNT from server \\SENEGAL\SophosUpdate\CIDs\S000\SAVSCFXP\
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384

Time: 6/2/2016 7:47:33
Message: *************** Sophos AutoUpdate started ***************
Module: ALUpdate
Process ID: 1112
Thread ID: 5384

Hello Joseph Pawlicki,

if others have encountered
it's already obvious that I haven't [:)], the .tmp files are probably used when PM is updated.

how can there be an access issue
not impossible, several reasons (not a complete list): pending action (especially delete), file system corruption (ACL order), disk error. As you can delete them after a reboot I'd rule out the latter two. BTW - which of the Properties tabs and information can you access?
I'd suggest the following: Use Sysinternals' Process Monitor to check the operations on these files, search for existing handles with Process Explorer. As this is a PM/Exchange host you probably want to avoid reboots, but I'd also check whether a "normal" reboot releases the files and their state - i.e. verify that the Security tab is again available and inspect General Properties and Permissions. Can't say if this will explain what's going on or lead to a solution.

Christian    

Hello Joseph Pawlicki,

if others have encountered
it's already obvious that I haven't [:)], the .tmp files are probably used when PM is updated.

how can there be an access issue
not impossible, several reasons (not a complete list): pending action (especially delete), file system corruption (ACL order), disk error. As you can delete them after a reboot I'd rule out the latter two. BTW - which of the Properties tabs and information can you access?
I'd suggest the following: Use Sysinternals' Process Monitor to check the operations on these files, search for existing handles with Process Explorer. As this is a PM/Exchange host you probably want to avoid reboots, but I'd also check whether a "normal" reboot releases the files and their state - i.e. verify that the Security tab is again available and inspect General Properties and Permissions. Can't say if this will explain what's going on or lead to a solution.

Christian