Product installtion failed:Sophos system protection:0x80070643

Yaa sure we will test with verbos logging on.let see what we can find.

We have troubleshooted yesterday and we suspect the GPO might be the cause which causing the errors.it might be preventing the services to start and stop

but we are not sure how to confirm that which GPO might be the cause of the issue.

Any thoughts on GPO part?

Hello ajinkya nikam,

preventing the services to start and stop
well, it's stop and start here [;)]. Seriously, the normal SSP.log should show that (or if) the service is stopped at this point. And apparently it can be started (though only with a fresh install).

which GPO
funny question [:D] - seriously, for many if not most settings there's no direct mapping from a symptom to the setting. There's one difference in my updating logs I'd like to point out (not far from Action start: hh:mm:ss InstallValidate:
RESTART MANAGER: Will attempt to shut down and restart applications in no UI modes.
RESTART MANAGER: Detected that the service sophossps will be stopped due to a service control action authored in the package before the files are updated. So, we will not attempt to stop this service using Restart Manager

dunno if this is significant. There's BTW a Prohibit use of Restart Manager setting in the Administrative Templates for the Installer but when set you get:
RESTART MANAGER: Disabled by DisableAutomaticApplicationShutdown system policy; Windows Installer will use the built-in FilesInUse functionality.
the upgrade is nevertheless successful, so this isn't the one.

Christian 

I wonder if the service can't notify the SCM it has started?

In an admin command prompt can you run:

sc sdshow SCMANAGER

and supply the output?  It might be worth comparing the SDDL on a failing/working computer.

Regards,

Jak

Any news on this issue?

We have the same problem with about 120 clients since last week...

What is the output of:

sc sdshow SCMANAGER

when run from an administrative command prompt from a working and non-working computer of the same OS.

sc sdshow SCMANAGER gives the following output on 2 pc's

not working pc:
D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;B
A)

working pc:
D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;B
A)

Hi, 

I have the same problem on my domain (~100 computers).

Find this KB on Sophos, but does not help : https://community.sophos.com/kb/en-us/124021

My msiexec version is 5.0.7601.23593 so higher than explain in KB...

Try a new full protection, still the same issue...

Did you find a solution ?

Regards

still the same here.
I know the article, our msiexec has a higher version too, so that was not it.
Removing system protection service and reinstall sophos from the console is working for us, but that's not what i want to do with 100+ pc's.
Sophos is taking a look this afternoon. I'll keep you informed.

Okay.

Same for us, I delete regedit Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sophossps\Security to delete the service "sc delete sophossps" then reinstall...

Even with GPO, it's really annoying because computer need a restart :(

Hope Sophos will find the answer :-)

can you try this?
C:\ProgramData\Sophos\AutoUpdate\Cache\ssp>msiexec /x{1093B57D-A613-47F3-90CF-0F
D5C5DCFFE6}

this version seems to gives the problem with us.
If this is removed Sophos SSP should restore itself without reboot.
Let me know.