Endpoints Failing to Install New Update

Jbull,

We just realized that exact same thing and are looking into getting the RMS installed and tested on machines.  But so far that seems to fix issues.  I'll let you guys know more tomorrow after we test some more.  It's quittin time.

And yep, Sophos needs some good 'ole country music on their hold queue.  ;)

I have tested this morning and found that I can re-protect a computer from the console which will install the AV and the AutoUpdate client.  Once that finishes, it should pull down the RMS msi file which I manually ran with the following script:

msiexec /i "C:\ProgramData\Sophos\AutoUpdate\Cache\rms\Sophos Remote Management System.msi" /qn /l* C:\Temp\SophosRMS.txt

This will silently install the RMS piece and log it to C:\Temp\SophosRMS.txt.

My next test is re-protecting a failed endpoint then pushing the above script with KACE which I plan to do this afternoon.  We are in the process of updating our KACE agents.

Last I heard from my escalated support ticket is that they thought there may be a connection to the KACE and were researching it and would get back to me.  I tried uninstalling a KACE agent, rebooting, and re-protecting a PC and that didn't work so I've kept along this path of manually fixing it until I hear something definitive from support.

This is the latest news from Sophos on my case.  They suggest it is a conflict with KACE software metering and if you stop the KACE metering service, re-protect, then restart the service you should be fine.  I'm not super confident it will fix our issue because I tried uninstalling the KACE agent, rebooting, and re-protecting and it didn't work.  I've included the Sophos KB article below for anyone that it may help and I will post again once I've done some testing.

http://www.sophos.com/en-us/support/knowledgebase/121070.aspx

Yesterday I sent KACE some verbose logs from Process Monitor, Wireshark and the Sophos Diagnostic Utility.  They narrowed it down to KACE Software Metering (kswmetersvc.exe) They parsed the logs and came back with the following:

Hello Tom,

Our Global Team has reviewed the files you uploaded. It looks like Kace might have been the issue at your site.

Issue

During the upgrade to version 10.0.12 or 10.3.7 the Sophos AutoUpdate component fails. The following errors can be found in the specified logs on the affected computer:

Sophos AutoUpdate Setup log.txt

Error: Install of MSI failed with error 1603

Sophos AutoUpdate install log.txt

Product: Sophos AutoUpdate -- Error 1303.The installer has insufficient privileges to access this directory: C:\Program Files (x86)\Sophos\AutoUpdate. The installation cannot continue. Log on as an administrator or contact your system administrator.

Error 1303.The installer has insufficient privileges to access this directory: C:\Program Files (x86)\Sophos\AutoUpdate. The installation cannot continue. Log on as an administrator or contact your system administrator.

Windows Application Event log

Event:
Log Name: Application
Source: MsiInstaller
Date:
Event ID: 11303
Task: N/A
Level: Error
Opcode: Info
Keyword: Classic
User:
User Name:
Computer:
Description:Product: Sophos AutoUpdate -- Error 1303.The installer has insufficient privileges to access this directory: C:\Program Files (x86)\Sophos\AutoUpdate. The installation cannot continue. Log on as an administrator or contact your system administrator.

In the Sophos Enterprise Console or Sophos Control Center the following error may appear:

Installation of Sophos AutoUpdate Failed [0x00000008]

First seen in
Sophos Anti-Virus for Windows 2000+ 10.3.7,
Sophos Anti-Virus for Windows 2000+ 10.0.12

Cause

This issue has been seen on computers running the following service:

Dell KACE Software Meter (kswmetersvc.exe)

When started this service opens a Handle to the Sophos AutoUpdate folder preventing it being deleted as part of the upgrade.

What To Do

To allow an affected computer to install/upgrade:

1. Stop the Dell KACE Software Meter service
2. Re-protect the affected computer/s
3. Once protected start the Dell KACE Software Meter service

Note: We recommend contacting the vendor of the software for information on how to prevent this issue in the future

Looks like you beat me to posting the reply JBull!

In any case, I wanted to also add how we've been fixing it while waiting for a solution, with some success.  Using KACE, we set up a script to uninstall RMS if a machine has RMS but no AV installed.  This scrip runs every 30 minutes, checking for a registry flag it sets so it isn't repeated:

Verify

On Success

Looks like we all came to the same conclusions at the same time!  We too have the RMS working as a backup option, but we just turned our Metering off and haven't had any problems.  Darn Dell products...  Can't live with it and can't live without it...

At least we can move forward now and put this behind all of us.  :)  Thanks for all of your collaboration guys!

So you have seen success turning the metering off and re-deploying?  I haven't had a chance to test yet but I'm hoping for the best.

I appreciate everyone contributing to the thread!

It's been a slow process, but that's exactly what's been working for us. Protecting again from within the Console I've been able to go from 90+ unprotected systems down to 36, some of which haven't touched the network in a few months. Since disabling Kace Metering I haven't had to uninstall anything - just went straight to Protect and Sophos was able to install normally.

I second jbull. Thank you everyone!

Here's what I am doing.....

-Stopping Kace service

-Reinstalling with command lin

-running msiexec /i "C:\ProgramData\Sophos\AutoUpdate\Cache\rms\Sophos Remote Management System.msi" /qn /l* C:\windows\Temp\SophosRMS.txt (Thanks for that)

-rebooting

Hello,

It's worth noting, in order for AutoUpdate to maintain RMS post installing in this way (running the MSI directly), iupd.cfg (C:\Program Files\Sophos\AutoUpdate\Config\iupd.cfg) needs the correct action 0x400107. E.g:

;RMS 2000/XP
[iProductData.{390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92}]
AllowLocalConfig = 1
Action = 0x400107

Also, the MSI of RMS expects to find, cac.pem and mrinit.conf under:

C:\Program Files\Sophos\Remote Management System\

otherwise the install of RMS will fail with error 1722.

Regards,

Jak