Help us enhance your Sophos Community experience. Share your thoughts in our Sophos Community survey.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 31 replies
  • Subscribers 1 subscriber
  • Views 120974 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Endpoints Failing to Install New Update

PostQ

Hello,

After receiving the new update (10.3.7 3.51) I have 100+ endpoints that are failing to uninstall the new software.  During the install process the old versions of the software are uninstalled, then when the install is starting they error out.  I'm receiving either an "Installation of Sophos AutoUpdate Failed [0x00000008]" error or an "A runtime error occurred. [0x00000062]" error.

From my testing, when this error occurs it's because the AutoUpdate folder that's created in either of the following locations has messed up permissions.  Basically, it won't allow anyone or anything to access it or delete it.  Those locations are:

C:\Program Files (x86)\Sophos\AutoUpdate  -or-  C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir

If I restart the PC with this problem and boot into Safe Mode, log in then out, the bad file is automatically deleted, restart into normal Windows and try the install again.  At that point everything installs correctly and there are no problems.  

I don't want to have to restart 100+ computers into safe mode if I don't have to, we need a better solution and soon because these computers with this problem are unprotected right now.  Thanks for anyone's help!

:50144


This thread was automatically locked due to age.
Parents
  • 0

    I went to an affected machine that was re-protected from the console but missing the RMS piece.  I deleted the RMS folders which gave me no issues so obviously the files were not in use and no services were registered.  I ran a protect again and it reinstalled the AV and AutoUpdate components but no still RMS.  I rebooted the PC and went into C:\ProgramData\Sophos\AutoUpdate\Cache and noticed it started populating it with files and folders.  I went into the RMS folder and tried to manually run "Sophos Remote Management Systems.msi" but it's failing with the error message "Error 1920.Service Sophos Agent (Sophos Agent) failed to start.  Verify that you have sufficient privileges to start system service".  I'm logged in as a domain administrator, but for some reason I'm still running into strange permissions issues.

    I am trying to isolate a way to reinstall the RMS component.  If you just re-protect all the computers and reinstall RMS somehow, I think everything would be fine.  For whatever reason, the upgrade cannot create and register these RMS services.  I'm going home for the night but I'll continue testing tomorrow unless Sophos gets back to me with a fix.  I haven't heard from them since my case was escalated either.

    :50316
Reply
  • 0

    I went to an affected machine that was re-protected from the console but missing the RMS piece.  I deleted the RMS folders which gave me no issues so obviously the files were not in use and no services were registered.  I ran a protect again and it reinstalled the AV and AutoUpdate components but no still RMS.  I rebooted the PC and went into C:\ProgramData\Sophos\AutoUpdate\Cache and noticed it started populating it with files and folders.  I went into the RMS folder and tried to manually run "Sophos Remote Management Systems.msi" but it's failing with the error message "Error 1920.Service Sophos Agent (Sophos Agent) failed to start.  Verify that you have sufficient privileges to start system service".  I'm logged in as a domain administrator, but for some reason I'm still running into strange permissions issues.

    I am trying to isolate a way to reinstall the RMS component.  If you just re-protect all the computers and reinstall RMS somehow, I think everything would be fine.  For whatever reason, the upgrade cannot create and register these RMS services.  I'm going home for the night but I'll continue testing tomorrow unless Sophos gets back to me with a fix.  I haven't heard from them since my case was escalated either.

    :50316
Children
No Data
Unfiltered HTML