Unable to uninstall Sophos AutoUpdate 5.2.0.276

One thing you could try, as per:

https://community.sophos.com/kb/en-us/117348

I.e. setting the ShowFixedPackages registry key.

If you look under a subscription, and the various versions of the Windows packages available, you can then look at the component versions.  Do you see a SAU 5.2.0.276 i the list?  If so you could subscribe to that package, create a distribution point and you can get the MSI file from there.

I've forgotten how old 5.2 is but this may be available in one of the packages.

Regards,

Jak

Hey Jak,

Cheers for that. I've created a new subscription for "Fixed Extended 10.6.3 VE3.65.3" which includes the AutoUpdate version 5.2.0.276. I then created a group and placed the offending computer in there, however when attempting to protect the computer to begin installation I unfortunately receive an error "80070002 Installaton failed. See knowledgebase article 29287. Installation failed. The computer may need additional configuration before installation."

I've had a look at https://community.sophos.com/kb/en-us/29287 and followed the steps within to combat the error, however have had no success in doing so, still receive the same error even though the criteria are all met. Happy to hear any suggestions, I must be missing something.

Cheers,

Christian

I don't think you need to protect the computer. I figured you'd just have SUM create the CID purely to harvest the SAU MSI file.  You can then just rename it to C:\Windows\Installer\ddc87f3e.msi on the problem client before running the uninstaller.

Regards,

Jak

Ah awesome that sounds good. Sorry would you happen to know where to look for the newly created the CID? Or is there a process to create the CID somewhere through SEC? I currently have S000 as the only folder under CIDs. However the UM itself hasn't updated since 23 Aug, so perhaps it just won't download until I sort that issue out. 

In SEC, switch to the Update Manager list, create a new subscription on the left.  Choose the old package.

You then need to add that to the subscription list maintained by your SUM.

SUM should then start downloading and you'll end up with a S001 CID I assume you can go into and capture the file in question.  If you look at the View-Bootstrap locations it should be listed once SUM has finished download and deployment of the share.

You can remove the subscription once done and delete the S001 directory.

Regards,

Jak

Perfect, that sounds promising. Thanks Jak, I'll try that out once I get this Update Manager not updating issue sorted.

If you want to link the latest SUMTrace log [https://community.sophos.com/kb/en-us/110143] we can have a look at it.

If you want to link the latest SUMTrace log [https://community.sophos.com/kb/en-us/110143] we can have a look at it.

I'd love to, have at it! Thanks :)

SUMTrace20170831T163941.zip

Hello Christian,

the UM itself hasn't updated since 23 Aug
could you show where you see this? From the log it doesn't look like there's a failed Self-Update.

Did you add a subscription yet as neither the Fixed Extended 10.6.3 nor a CID other than \S000\ is mentioned?

Christian

Hey Christian,

Of course, I've attached a couple of screenshots showing the setup with the additional subscription I'm trying to get going. 

Pics.zip

The UM appears to be stuck on downloading binaries, I've tried rebooting the server / restarting the UM services a few times with no luck.

I had a look at another post and tried a couple of things such as making sure Everyone has read/write permission on the SophosUpdate share, and changing the C:\ProgramData\Sophos\Update Manager\Working folder to Working_OLD to let that rebuild, however no luck for me with those ones.

Hello Christian,

thanks. The subscription configuration looks correct. SUM is indeed not the latest version (1.6.2.186) though.
I see that the Download status is Downloading binaries - but the SUMTrace log shows completed (and as far as I can see successful) hourly Software and every 10 minutes Threat detection data updates. Wonder if internal communication is stalled - if you look at ACSINF01's Computer details in the Endpoints view - what is the Last message time and is it Up to date?

Even if the Last message time is recent SUM might not communicate. If you look into %ProgramData%\Sophos\Remote Management System\3\Agent\AdapterStorage\SDDM\ is the timestamp of SDDM Status current? In the Agent log you should see SDDM state observer received a status lines corresponding to the DumpConfigXML lines in the SUMTrace. If not then please restart both the Sophos Agent and the SUM service (IIRC this usually helps, not sure about the order, perhaps doesn't matter).

Christian

Hey,

Hmm strange. I had a look at some of the "Up to date" computers, and their last message times correlate to the 23 of August @ 7pm. They each have a red cross on their icon, and are all awaiting policy transfers. The SDDM Status timestamp is indeed up to date, however SDDM config is from the 23rd of August. I had a look at comparing the SDDM Agent log with the SUMTrace log as you have suggested, this was what I found: (Each log snippet separated by a few lines with a couple of the preceding lines above it)

ACS SEC.zip

They appear different to me, but I might be looking in the wrong spots. I gave those services a restart, however it appears to be still downloading binaries. Thanks a lot for your help on this one. :)

Hello Christian,

didn't mention the other component involved in communication - assuming only SUM can't communicate.
From their last message times correlate to the 23 of August it seems to be the Sophos Message Router which doesn't pass the messages. I assume it's running but not working as it should - you could check its log or simply restart it (and it does no harm to restart the Management Service as well). 

Christian

Hey Christian,

I gave those service restarts a shot on Friday night unfortunately without success. A reboot of the server hasn't changed much either. I'll keep trying a couple of others things and see what else I can find. Thanks for your help so far.

Cheers,

Christian