Brand New Install, issues with updating

Hello Jeremy Brook,

as far as I can see the erros are for Hitman Pro and Endpoint Agent (not sure right now what the latter is), the former now called Intercept-X if I'm correct and AFAIK not yet available for the on-premise SEC. Is this a trial license?

As far as the regular components are concerned everything looks fine - no download errors, and Installation skipped indicates that last time there were some changes the installation was successful.

Christian

This is a purchased subscription for "Endpoint Protection - Advanced 2"

When I log in it shows me downloads specific to my subscription.  The console version was 5.4.1 and the file was sec_541_sfx.exe 708Mb

To deploy the endpoints I am simply right clicking on a computer from within the console and choose "protect computer" this then rolls out the install.  I also have the option of running setup from the shared directory.

If these Applications such as Hitman Pro and Endpoint agents no longer exist or are not part of the SEC then this all suggests there is a bug in this version of the console as it wants to install it but the necessary files are not part of the share.

I have had a look through the shared directory and within their there are several subfolders for each package of sophos and there doesn't seem to be one for hitman pro (and others).

My thoughts at the moment is that there is some sort of conflict between the older cloud based sophos and the sophos managed via SEC.  All the test machines had the cloud version install, but this was removed prior to installing the SEC version.  You mention Hitman Pro agents are not part of SEC but could it have part of the cloud version and this is causing an issue with the autoupdater?

This is a purchased subscription for "Endpoint Protection - Advanced 2"

When I log in it shows me downloads specific to my subscription.  The console version was 5.4.1 and the file was sec_541_sfx.exe 708Mb

To deploy the endpoints I am simply right clicking on a computer from within the console and choose "protect computer" this then rolls out the install.  I also have the option of running setup from the shared directory.

If these Applications such as Hitman Pro and Endpoint agents no longer exist or are not part of the SEC then this all suggests there is a bug in this version of the console as it wants to install it but the necessary files are not part of the share.

I have had a look through the shared directory and within their there are several subfolders for each package of sophos and there doesn't seem to be one for hitman pro (and others).

My thoughts at the moment is that there is some sort of conflict between the older cloud based sophos and the sophos managed via SEC.  All the test machines had the cloud version install, but this was removed prior to installing the SEC version.  You mention Hitman Pro agents are not part of SEC but could it have part of the cloud version and this is causing an issue with the autoupdater?

Hello Jeremy,

AFAIK Hitman Pro is rebranded to Intercept X - currently in Beta for the Central version, Beta for on-premise SEC next year. So it's not discontinued but rather coming soon (as additional product but managed by SEC).
Did you ever use it on your Central managed endpoints (though I think there shouldn't be any leftovers causing AutoUpdate to try to download it). And as said it's not yet available for SEC. Guess you'd see it as extra product (in addition to the different platform products) under subscriptions. Is there an associated policy section?

Christian

Just to let you know I only just installed the cloud version using sophos central maybe 2 weeks ago, I then decided to move to SEC because I found my license wasn't transferable and SEC is much better for client deploying and reporting than the central online based system.

So I have just done a full uninstall of all the sophos related items within add/remove program from one of the clients.  I then went to manually delete all the sophos folders within program files (including x86) and programdata.  Two of the folders failed to delete which I found on because two sophos services were still running.  I also noticed a folder called HitmanPro.Agent within the programdata folder.  I can confirm that this folder is definitely part of the Sophos Central install as I have just checked on a live machine that hasn't had the SEC install deployed but did have sophos central.  So yes my original suspision is correct in that Sophos SEC and Sophos Central conflict even though sophos SEC claims to have uninstalled Central version.

Now when I install sophos using SEC it no longer fails to download Hitman Pro but still fails on this "Sophos Endpoint Agent" again I reckon this is related to Sophos central and not SEC.  What I am going to try no is to remove Sophos SEC, reinstall Sophos central and then uninstall this myself (before I have used the Sophos SEC thirdparty uninstall tool) then reinstall sophos SEC and see what I get.

Getting there, I haven't done the reinstalls yet but I noticed in programs and features "Sophos Endpoint Agent" was listed with a install date of November and a generic exe icon (not the usual sophos icon).  When I tried to uninstall it told me it no longer exists and it remove the item from the list.  This item wasn't there where I uninstalled as above so more fuel regarding sophos SEC inability to uninstall sophos central prior to install.

Hello Jeremy,

thanks for the update. The on-premise (SEC) installer's setup.exe should refuse to install if it finds a Central managed component, it might not yet be aware of the recent changes. While there's a Cloud Migration Tool in the other direction, AFAIK, you have to completely uninstall (and reboot) to avoid any issues (and depending on what was and what was not uninstalled the bootstrapper might fail to make the correct decision).

Christian

True that installing sophos should fail is central was installed and this is kinda true.  One of the features of SEC is called "Third-Party Security Software Detection" if this is selected it will (or should) uninstall other AV applications.  In my cause provided tamper protection was switched off it does indeed remove sophos central just not entirely as is proven by conflicts with the program updates.

Anyways this is going from worse to worse, having so much trouble removing sophos (SEC) as there are many items missing from Programs and features so I can't cleanly uninstall.  There are still about 5 sophos services still running, even though according to windows sophos isn't installed.  I am going to have to manually work on cleaning up the install.  Why I hate AV programs over the years just so much bloatware!

Hello Jeremy,

"Third-Party Security Software Detection"
arguably Central isn't exactly third-party. [;)]
Joking aside - uninstall should be clean, there are a very few remnants left behind to assist in an uninstall-reinstall scenario. Services normally go away (and should do so even with enhanced Taper Protection) at least after a reboot.

If the uninstall is not clean on the Central protected machines you should contact Support directly providing them the SDU logs.

Christian

So  I have finally got it installed and updating

1.  Sophos SEC install does NOT correctly uninstall sophos central and leaves behind two packages and breaks further breaks sophos SAVXP installation (XP is nothing to do with windows XP btw).  It appears the only way to resolve it to visit every machine and manually uninstall.

2. I have gone through the entire registry and deleted every reference I could find to the word 'sophos'

3. Using msizap from the ms sdk I have removed any of the sophos installers from windows install cache

4. Deleted all sophos folders in program files, program files (x86) and programdata

5. To get SAVXP installing correctly I had to remove the MSI version checking from the installation using compatibility mode, this allowed the program to install.

6.  I then ran the normal setup as if performing a manual install.  This now ran through and installed 5 packages, compared to 7 (2 of which where obviously from sophos central)

7. Even though policies where correct, and live on the client, in SEC it was showing "Awaiting Policy from console".  To correct this I had to click "Comply with" and in my case I added all policies.  Now the PC is showing up to date with no error and alerts.

I am not going to try and fix the two other work stations following my own guide.  From this exercise I have learnt that the third part removal tool is flawed and should be avoided and use the softwares own uninstallation procedures. 

Hello Jeremy,

the third part removal tool is flawed
I was only half-joking when I doubted Sophos Central's third-partyness. Are you sure it was the CRT which did the uninstall?
I think that the on-premise version simply doesn't recognize the Central components. When Central (then Cloud) became available a Cloud-to-On-premise scenario was "unthinkable". A (scripted) uninstall of the Central versions before installing on-premise is the easiest way to do it.

Christian