Thread Info
  • State Not Answered
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 21 replies
  • Subscribers 6 subscribers
  • Views 39111 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Product installtion failed:Sophos system protection:0x80070643

ajinkya nikam

We have recently rolled out preview subscription on our 500 endpoints for enhance tamper protection.

all our 500 plus endpoint reporting update failed. SEC version 5.4.1

we have checked the acl.logs we have error --Product installtion failed:Sophos system protection:0x80070643

we further investigate windows\temp\sophossystemprotection logs for error

following are the errors 


SetupSspUserAccount: LoadAccount(SophosSSPUser) failed (error 1332)

SetupShsUserAccount: Granting permissions to user "NT SERVICE\sophossps"
MSI (s) (84:20) [04:47:16:041]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)
MSI (s) (84:20) [04:47:16:041]: Executing op: ServiceControl(,Name=sophossps,Action=1,Wait=1,)
MSI (s) (84:20) [04:51:16:283]: Product: Sophos System Protection -- Error 1920. Service 'Sophos System Protection Service' (sophossps) failed to start. Verify that you have sufficient privileges to start system services.              

log file SophosSystemProtectionSetup_170119_111714.log

 

StartService: Initialized.
StartService: Error 0x8007041d: Service rejected start request.

 

MSI (s) (84:20) [04:51:46:689]: Windows Installer reconfigured the product. Product Name: Sophos System Protection. Product Version: 1.3.1. Product Language: 1033. Manufacturer: Sophos Limited. Reconfiguration success or error status: 1603.

 

Please provide the solution for the issue



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to QC

    Hi Christians,

    Thank for your reply

    Yes we have refer the article regarding error 1920 and follow the steps but didn't work out.

    we have diverse machines windows 7,8,10. all our endpoint are taking windows updates.

    we tried to install and uninstall the ms update that article talks about but no luck.

    still issue persist

     

  • 0 in reply to ajinkya nikam

    Hello ajinkya nikam,

    from the logs it seems that the installer waits about 4 minutes to get the information that the service has been started. Did PM show that ssp.exe starts, if so - did it get as far as writing its log (in which case perhaps verbose logging might give an insight)?

    Christian

  • 0 in reply to QC

    sophos system protection service goes to state of starting while taking updates n then it stopped. 

    when we try to start it it will end up with error.

    >>i m not sure what causing services to stopped & unable to update the sophos system protection 1.3.0 to 1.3.1??

    when we manually uninstall sophos system protection 1.3.0 and hit update>sophos system protection 1.3.1 installed successfully

    But m not sure what causing to stop it to upgrade the system protection.

     

  • 0 in reply to QC

    Hi Christian,

    Any thoughts on the issue?

    We still haven't figure out what causing the issue

     

  • 0 in reply to ajinkya nikam

    Hello ajinkya nikam,

    I'd have to check how it behaves/behaved on my endpoints. I'm not at work though today.

    Christian

  • 0 in reply to QC

    Hi Christain,

     

    Thanks.looking forward to hear from you

  • 0 in reply to ajinkya nikam

    Hello ajinkya nikam,

    I've up- and downgraded the ssp service several times. There are only minor differences in the messages (the 1332 error is expected, BTW), and your MsiNetAssemblySupport is 4.6 (mine's 4.0). Stopping and starting the service is part of the upgrade install, there's no obvious reason why the start succeeds on an initial install but fails on the upgrade.
    Did you turn on verbose logging? There might be some information in the SSP.log.

    Christian

  • 0 in reply to QC

    Yaa sure we will test with verbos logging on.let see what we can find.

     

    We have troubleshooted yesterday and we suspect the GPO might be the cause which causing the errors.it might be preventing the services to start and stop

    but we are not sure how to confirm that which GPO might be the cause of the issue.

    Any thoughts on GPO part?

  • 0 in reply to ajinkya nikam

    Hello ajinkya nikam,

    preventing the services to start and stop
    well, it's stop and start here [;)]. Seriously, the normal SSP.log should show that (or if) the service is stopped at this point. And apparently it can be started (though only with a fresh install).

    which GPO
    funny question [:D] - seriously, for many if not most settings there's no direct mapping from a symptom to the setting. There's one difference in my updating logs I'd like to point out (not far from Action start: hh:mm:ss InstallValidate:
    RESTART MANAGER: Will attempt to shut down and restart applications in no UI modes.
    RESTART MANAGER: Detected that the service sophossps will be stopped due to a service control action authored in the package before the files are updated. So, we will not attempt to stop this service using Restart Manager

    dunno if this is significant. There's BTW a Prohibit use of Restart Manager setting in the Administrative Templates for the Installer but when set you get:
    RESTART MANAGER: Disabled by DisableAutomaticApplicationShutdown system policy; Windows Installer will use the built-in FilesInUse functionality.
    the upgrade is nevertheless successful, so this isn't the one.

    Christian 

  • 0 in reply to QC

    I wonder if the service can't notify the SCM it has started?

    In an admin command prompt can you run:

    sc sdshow SCMANAGER

    and supply the output?  It might be worth comparing the SDDL on a failing/working computer.

    Regards,

    Jak

Unfiltered HTML