Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 2 answers
  • Subscribers 4 subscribers
  • Views 9455 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos installer creates a local AutoUpdate account using naming convention 'SophosSAU<machine-name>aaa' instead of 'SophosSAU<machine-name>0'

Liam Hitchen

Sophos installer creates a local AutoUpdate account using naming convention 'SophosSAU<machine-name>aaa' instead of 'SophosSAU<machine-name>0' which seems to be affecting our client computers thus preventing them from updating correctly.  The 'aaa' section of the local account replaces the last 2 characters of the machine name which is causing all sorts of issues.  Is there a reason for this?  Has Sophos changed the way it creates the local account?  We are currently using Sophos Endpoint 10.6.3., previously used Sophos 10.3.x.  The Sophos shield in the taskbar sits with a red X.  My only solution is to manually create a local account prior to installation and insert the registry keys, etc.  Any info on fixing this would be much appreciated.



This thread was automatically locked due to age.
  • 0

    Hello Liam Hitchen,

    indeed the installer now appends (or, as in your case, perhaps overlays) the string aaa instead of appending 0. Neither the SophosSAU article nor the release notes mention this change - if it is intended. Can't say if this change came with 10.6.3.

    replaces the last 2 characters [...] all sorts of issues
    which besides the failed updates (bad enough of course)? Shouldn't make a difference how the name built (except for DCs where there is a greater chance for collisions - wonder if it'd count up to aab, aac, ...) - unless the local account name and the Download User registry value are different. Haven't observed the overlay though, might depend on the computername length.
    [Edit] A few checks suggest that only the first 8 characters of the computer name are used. No issues here though as far as I can tell. [/Edit]

    Please contact Support directly - this is nothing you or I could fix it seems. I'd appreciate if you could post their answer here.

    Christian

  • 0 in reply to QC

    Unfortunately, Sophos Support have not provided a reason as to why the local account is created with the 'aaa'.  Instead, they have directed me to a KB article on how to manually create the local account before installing Sophos.  I've already done this and yes it does work, but I was more interested in why the change in the naming of the local account used for autoupdating.  To be honest, I don't think their support team even know why so it looks like all hope is lost !!

    https://community.sophos.com/kb/en-us/48910 - I already used this to manually create the local account so I will just have to use this as the official resolution.

  • 0 in reply to Liam Hitchen

    One thing to note: If you're using Sophos Central - Then you get Sophos AutoUpdate XG and there is no local SophosSAU account as it's all HTTP updating.

    Regrards,

    Jak

  • 0 in reply to Liam Hitchen

    Hello Liam Hitchen,

    the official resolution
    while I don't (yet) know how the new format is affecting [y]our client computers I'd not call this a resolution. By all means Support should call for 58627 and related articles to be updated (even if Development doesn't want to disclose the rationale).
    IMO 48910 only applies when either account creation by the Installer fails for whatever reason or your organisation objects to the automatically generated name. The latter is obviously not the case,  and apparently the former neither - you've mentioned updating failures therefore installation must have succeeded. 

    Has Sophos changed the way it creates the local account?
    Definitely the name generation. But as said this shouldn't make a difference. Possibly there are also changes in the account creation procedure though it doesn't look like they generally cause problems or we'd have already heard.

    I will just have to use this
    Depending on the deployment method the UserPreset could be a cinch but it doesn't sound like it is in your environment. I'd like to help but I'd need the failure details - preferably a complete update cycle from the ALUpdate log (it starts with ALUpdate started: -ScheduledUpdate ...). If you don't want to make it public you can send me a private message.

    Christian   

Unfiltered HTML