Hi All,
system OS: Win 10
SAV Version: v10.7
When i install endpoint with setup.exe , this machine will not going install process.
It show error on %temp%/ESetup.txt "Unexpected product state 1 for product with code {AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}"
So.. any idea with this case?
Hello YuzenChen,
it shouldn't have failed with this error on the very first attempt. Has an install been tried before (locally with setup.exe, a package, or with Protect computers from the console)?
This is one of the few cases where using the tool to Fix problems that block programs from being installed or removed is perhaps your best option.
Christian
Hello Yuzen,
please see here for some comments regarding the tool.
(customer uninstall (apparently not) sophos by himself in the light of this: Don't let your customer use this tool [:D], seriously -it's not for indiscriminate use)
Christian
Hi QC,
I delete all sophos component and re-install with SEC\SophosUpdate\CIDs\S001\SAVSCFXP\Setup.exe .
then autoupdate agent will installed , but only SAVXP install failed. check Console is show this machine SAVXP install failed .
I find log from temp sophos anti-virus major install log , the result is show:
==============================================================
2017-06-14 12:04:37 ERROR: Installation failed
2017-06-14 12:04:37 ERROR: SetupPlugin: Unable to get buffer size for Application registry key Path value.
2017-06-14 12:04:37 ERROR: Failed to get current install location to register with tamper protection. Error 0x80070002
==============================================================
Hello YuzenChen,
this part of the log are just the final words, the last two are simply a consequence of the failed install.
The install log is an MSI log, not too hard to understand but you'd have to read it correctly. If necessary please post the relevant parts, if you can't locate the error the complete log.
Christian
2017-06-14 12:04:37 Unable to delete registry value: SOFTWARE\Sophos\AutoUpdate\UpdateStatus\CrtResult, assuming it does not exist
2017-06-14 12:04:37 INFO: Unable to find the CRT directory, continuing with installation.
2017-06-14 12:04:37 PROCESSOR_ARCHITECTURE environment variable is: AMD64
2017-06-14 12:04:37 Info: Logging started: installing/upgrading Sophos Anti-Virus
2017-06-14 12:04:37 Info: InstallFromPath is: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\
2017-06-14 12:04:37 Info: InstallToPath is:
2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {32C8E300-BDB4-4398-92C2-E9B7D8A233DB} with error code: 1608
2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {2DBFEC23-B924-4B7A-A9DB-E08444E72C9B} with error code: 1608
2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {6BADCD73-E925-46F7-A295-FF2448632728} with error code: 1608
2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {9AC08E99-230B-47e8-9721-4577B7F124EA} with error code: 1608
2017-06-14 12:04:37 Info: SAV is not installed. Installing to {InstallToPath}
2017-06-14 12:04:37 INFO: Checking the validity of the VDL manifest file.
2017-06-14 12:04:37 INFO: The manifest file has been successfully validated.
2017-06-14 12:04:37 INFO: Checking the validity of the AppFeed manifest file.
2017-06-14 12:04:37 INFO: The manifest file has been successfully validated.
2017-06-14 12:04:37 Info: Managed install (from SAU)
2017-06-14 12:04:37 Check for UI changes
2017-06-14 12:04:37 Unable to QI IProductConfig
2017-06-14 12:04:37 Info: productType: 0
2017-06-14 12:04:37 Info: Performing major update of Sophos Anti-Virus using msi.
2017-06-14 12:04:37 Info: Update is signalled.
2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {32C8E300-BDB4-4398-92C2-E9B7D8A233DB} with error code: 1608
2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {2DBFEC23-B924-4B7A-A9DB-E08444E72C9B} with error code: 1608
2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {6BADCD73-E925-46F7-A295-FF2448632728} with error code: 1608
2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {9AC08E99-230B-47e8-9721-4577B7F124EA} with error code: 1608
2017-06-14 12:04:37 Info: Added SAVService to ServicesList.
2017-06-14 12:04:37 Info: Added SAVAdminService to ServicesList.
2017-06-14 12:04:37 Info: Added Sophos Device Control Service to ServicesList.
2017-06-14 12:04:37 Info: Added SophosBootDriver to ServicesList.
2017-06-14 12:04:37 Info: Added swi_service to ServicesList.
2017-06-14 12:04:37 Info: Added swi_filter to ServicesList.
2017-06-14 12:04:37 Info: Added Sophos Web Control Service to ServicesList.
2017-06-14 12:04:37 Info: Added SAVOnAccess to ServicesList.
2017-06-14 12:04:37 Info: component SAV is not registered - skipping.
2017-06-14 12:04:37 Info: component SDC is not registered - skipping.
2017-06-14 12:04:37 Info: component SCS is not registered - skipping.
2017-06-14 12:04:37 Info: component SWI is not registered - skipping.
2017-06-14 12:04:37 Info: component SWC is not registered - skipping.
2017-06-14 12:04:37 UpdateVersionInfo(), SAU can't supply version info - using msi version
2017-06-14 12:04:37 Info: PutSetupOptionsToRegistry
2017-06-14 12:04:37 Info: Check MSXML
2017-06-14 12:04:37 Info: Check boot driver and kms driver
2017-06-14 12:04:37 Info: no existing installation of Sophos Anti-Virus was found
2017-06-14 12:04:37 Info: Restart required for Data Control (clean managed full install)
2017-06-14 12:04:37 Info: Transform file returned:
2017-06-14 12:04:37 Info: SAV Setup plugin: running MsiInstallProduct (C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi, INSTALLDIR="" REBOOT=ReallySuppress UITYPE=full PRODUCTTYPE=0 UPDATEDRIVERS=1 UPDATECLASSFILTER=1 UPDATEBOOTDRIVERS=1 UPDATEKMSDRIVERS=1 SAVIONLY=0 MANAGED=1 RECOVERYMODE=0 DATACONTROL=1 DEVICECONTROL=1 WEBCONTROL=1)
=== Verbose logging started: 2017/6/14 12:04:37 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
MSI (c) (6C:44) [12:04:37:863]: Resetting cached policy values
MSI (c) (6C:44) [12:04:37:863]: Machine policy value 'Debug' is 0
MSI (c) (6C:44) [12:04:37:863]: ******* RunEngine:
******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
******* Action:
******* CommandLine: **********
MSI (c) (6C:44) [12:04:37:863]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (6C:44) [12:04:37:863]: Grabbed execution mutex.
MSI (c) (6C:44) [12:04:37:863]: Cloaking enabled.
MSI (c) (6C:44) [12:04:37:863]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (6C:44) [12:04:37:879]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (78:58) [12:04:37:879]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
MSI (s) (78:58) [12:04:37:879]: Grabbed execution mutex.
MSI (s) (78:48) [12:04:37:879]: Resetting cached policy values
MSI (s) (78:48) [12:04:37:879]: Machine policy value 'Debug' is 0
MSI (s) (78:48) [12:04:37:879]: ******* RunEngine:
******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
******* Action:
******* CommandLine: **********
MSI (s) (78:48) [12:04:37:879]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (78:48) [12:04:37:879]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (78:48) [12:04:37:879]: SRSetRestorePoint skipped for this transaction.
MSI (s) (78:48) [12:04:37:894]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
MSI (s) (78:48) [12:04:37:894]: File will have security applied from OpCode.
MSI (s) (78:48) [12:04:37:894]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi' against software restriction policy
MSI (s) (78:48) [12:04:37:894]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi has a digital signature
MSI (s) (78:48) [12:04:37:894]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi is permitted to run because the user token authorizes execution (system or service token).
MSI (s) (78:48) [12:04:37:894]: MSCOREE not loaded loading copy from system32
MSI (s) (78:48) [12:04:37:894]: End dialog not enabled
MSI (s) (78:48) [12:04:37:894]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
MSI (s) (78:48) [12:04:37:894]: Package we're running from ==> C:\WINDOWS\Installer\1967c.msi
MSI (s) (78:48) [12:04:37:894]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2DBFEC23-B924-4B7A-A9DB-E08444E72C9B}'.
MSI (s) (78:48) [12:04:37:894]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (78:48) [12:04:37:910]: Machine policy value 'DisablePatch' is 0
MSI (s) (78:48) [12:04:37:910]: Machine policy value 'AllowLockdownPatch' is 0
MSI (s) (78:48) [12:04:37:910]: Machine policy value 'DisableLUAPatching' is 0
MSI (s) (78:48) [12:04:37:910]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (s) (78:48) [12:04:37:910]: Looking for storage transform: 1028
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2205 2: 3: Patch
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _Tables 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _Columns 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Media 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: File 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: TRANSFORM: 'PatchPackage' table is missing or empty. No pre-transform fixup necessary.
MSI (s) (78:48) [12:04:37:910]: TRANSFORM: Applying regular transform to database.
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _Tables 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _Columns 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _Validation 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: AdminExecuteSequence 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: AdminUISequence 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: AdvtExecuteSequence 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: AppId 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Binary 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Component 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Directory 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: CreateFolder 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: CustomAction 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: DuplicateFile 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: File 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: EventManifest 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: FeatureComponents 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Icon 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: InstallExecuteSequence 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: InstallUISequence 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Media 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: MsiFileHash 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: MsiServiceConfig 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: MsiShortcutProperty 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Registry 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: RemoveFile 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: RemoveRegistry 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: SecureObjects 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: ServiceControl 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: TextStyle 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: XmlFile 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: AppSearch 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: ModuleSignature 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: CompLocator 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: ModuleComponents 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: #_PatchCache 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: #_BaselineData 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: #_BaselineFile 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: #_BaselineCost 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _MsiPatchTransformView 3: -2147287038
MSI (s) (78:48) [12:04:37:910]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2DBFEC23-B924-4B7A-A9DB-E08444E72C9B}'.
MSI (s) (78:48) [12:04:37:910]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (78:48) [12:04:37:910]: Transforms are not secure.
MSI (s) (78:48) [12:04:37:910]: Transforming table Property.
MSI (s) (78:48) [12:04:37:910]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos Anti-Virus Major Install Log_170614_040437.txt'.
MSI (s) (78:48) [12:04:37:910]: Command Line: INSTALLDIR= REBOOT=ReallySuppress UITYPE=full PRODUCTTYPE=0 UPDATEDRIVERS=1 UPDATECLASSFILTER=1 UPDATEBOOTDRIVERS=1 UPDATEKMSDRIVERS=1 SAVIONLY=0 MANAGED=1 RECOVERYMODE=0 DATACONTROL=1 DEVICECONTROL=1 WEBCONTROL=1 CURRENTDIRECTORY=C:\WINDOWS\system32 CLIENTUILEVEL=3 MSICLIENTUSESEXTERNALUI=1 CLIENTPROCESSID=3692
MSI (s) (78:48) [12:04:37:910]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{B11B63E0-A3EB-478A-AF04-AAE0B577AEB2}'.
MSI (s) (78:48) [12:04:37:910]: Product Code passed to Engine.Initialize: '{2DBFEC23-B924-4B7A-A9DB-E08444E72C9B}'
MSI (s) (78:48) [12:04:37:910]: Product Code from property table before transforms: '{2DBFEC23-B924-4B7A-A9DB-E08444E72C9B}'
MSI (s) (78:48) [12:04:37:910]: Product Code from property table after transforms: '{2DBFEC23-B924-4B7A-A9DB-E08444E72C9B}'
MSI (s) (78:48) [12:04:37:910]: Product not registered: beginning first-time install
MSI (s) (78:48) [12:04:37:910]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
MSI (s) (78:48) [12:04:37:910]: Product {2DBFEC23-B924-4B7A-A9DB-E08444E72C9B} is admin assigned: LocalSystem owns the publish key.
MSI (s) (78:48) [12:04:37:910]: Product {2DBFEC23-B924-4B7A-A9DB-E08444E72C9B} is managed.
MSI (s) (78:48) [12:04:37:910]: MSI_LUA: Credential prompt not required, user is an admin
MSI (s) (78:48) [12:04:37:910]: PROPERTY CHANGE: Adding ProductState property. Its value is '1'.
MSI (s) (78:48) [12:04:37:910]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (78:48) [12:04:37:910]: Note: 1: 2720 2: 2
MSI (s) (78:48) [12:04:37:910]: MSI_LUA: Elevation prompt disabled for silent installs
MSI (s) (78:48) [12:04:37:910]: MainEngineThread is returning 1625
MSI (s) (78:58) [12:04:37:910]: No System Restore sequence number for this installation.
安裝被系統原則拒絕。請連絡您的系統管理員。
C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
MSI (s) (78:58) [12:04:37:910]: User policy value 'DisableRollback' is 0
MSI (s) (78:58) [12:04:37:910]: Machine policy value 'DisableRollback' is 0
MSI (s) (78:58) [12:04:37:910]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (78:58) [12:04:37:910]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (78:58) [12:04:37:910]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (78:58) [12:04:37:910]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (6C:44) [12:04:37:910]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (6C:44) [12:04:37:910]: MainEngineThread is returning 1625
=== Verbose logging stopped: 2017/6/14 12:04:37 ===
2017-06-14 12:04:37 ERROR: Installation failed
2017-06-14 12:04:37 ERROR: SetupPlugin: Unable to get buffer size for Application registry key Path value.
2017-06-14 12:04:37 ERROR: Failed to get current install location to register with tamper protection. Error 0x80070002
Hello YuzenChen,
the error is 1625, ERROR_INSTALL_PACKAGE_REJECTED and MSDN offers as description: with This installation is forbidden by system policy. Contact your system administrator.
Apparently AutoUpdate and RMS did install, it's only SAV that fails? The MSI should correctly handle elevation, but there seems to be an issue with UAC/LUA, can't say why. Guess it does install on other PCs. Please contact Support directly, I've no idea what to do at the moment (but perhaps Aditya Patel or Haridoss Sreenivasan have one). One more question - is UAC completely turned off (if it is turn it on)?
Christian
