This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos AutoUpdate Failure

Hello,

This is my first post, so please don't pick on me!

My side job at university requires me to look after several computers in class rooms, designed to mainly play back videos and support presentations.

Now while the job itself is usually not that challenging, I am somehow confronted with a more serious problem at the moment: Every computer is equipped with Sophos EndPoint Security System (or whatever it is called) and HDGuard. Two computers specifically have issues with Sophos:

Firstly, the "HiWI-PC", which refuses to update Sophos. It tells me, that Sophos cannot be auto updated. The weird thing is, that this happened exactly after updating Windows, there haven't been any problems right before the Windows updates. Because there's HDGuard on every PC, which resets the computer to a previously saved state after each reboot, it's necessary to have an update round every once in a while. Sophos itself is unaffected by HDGuard though, as I believe.

Secondly, the computer in room 21, which has the same problem, maybe a little bit worse: No auto update and it's impossible to get to the Sophos Endpoint Main Window (I am not sure how to call that window, you get whenever you right click on the icon in the right part of the task bar). Basically, that computer is completely unprotected, which is unacceptable.

I did some research on the error in room 21 and I have read something about problems with rights. After I have given more general rights to every user, the autoupdate lasted longer and actually created some directories, but the outcome was the same: It wasn't able to auto update. I have attached the logs here.

I am grateful for every hint, that might solve the problem.


Best regards!

:52275


This thread was automatically locked due to age.
Parents
  • Hello,

    I can see from the "Room 21!" logs:

    Custom Action:

    2014-07-25 16:17:49 StartSAVServices: Action started
    2014-07-25 16:17:49 StartSAVServices: Failed to start the Sophos Anti-Virus service.
    2014-07-25 16:17:49 StartSAVServices: Action failed

    Install Log:

    MSI (s) (E4:B8) [16:17:49:567]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI8069.tmp, Entrypoint: StartSAVServices
    CustomAction StartSAVServices returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

    So that computer failed because the SAV Service failed to start.

    I expected the logs from HIWI to be from Sophos AutoUpdate, i.e. "Sophos AutoUpdate install log.txt", there doesn't appear to be a problem with SAV in those logs.

    For the computer that is failing to start the service, I would suggest Process Monitor (http://technet.microsoft.com/en-gb/sysinternals/bb896645.aspx) is going to be most helpful and understanding why the service is failing to start.

    In addition to that you should see the service writing to a service startup log (Sophos Anti-Virus Startup Log.txt). E.g.
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\

    Which may also hint at the problem.

    Regards,

    Jak

    :52315
Reply
  • Hello,

    I can see from the "Room 21!" logs:

    Custom Action:

    2014-07-25 16:17:49 StartSAVServices: Action started
    2014-07-25 16:17:49 StartSAVServices: Failed to start the Sophos Anti-Virus service.
    2014-07-25 16:17:49 StartSAVServices: Action failed

    Install Log:

    MSI (s) (E4:B8) [16:17:49:567]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI8069.tmp, Entrypoint: StartSAVServices
    CustomAction StartSAVServices returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

    So that computer failed because the SAV Service failed to start.

    I expected the logs from HIWI to be from Sophos AutoUpdate, i.e. "Sophos AutoUpdate install log.txt", there doesn't appear to be a problem with SAV in those logs.

    For the computer that is failing to start the service, I would suggest Process Monitor (http://technet.microsoft.com/en-gb/sysinternals/bb896645.aspx) is going to be most helpful and understanding why the service is failing to start.

    In addition to that you should see the service writing to a service startup log (Sophos Anti-Virus Startup Log.txt). E.g.
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\

    Which may also hint at the problem.

    Regards,

    Jak

    :52315
Children
No Data