This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cause with protecting clients in SEC

Hello,

 

i have a cause with protecting clients in our network. The employees work from home and are connected via VPN.

 

In the enterprise console i click at protect, but nothing happens.

 

How i can protect these laptops ?


Primary Server is my Server and secondary is Sophos.



This thread was automatically locked due to age.
Parents
  • Hello Marvin Harms,

    Protect requires that the management server can "find" the computer - i.e. it must be able to resolve the names (that you have probably imported by some means) with Windows networking or DNS. Nothing would be strange, something should happen - at least you should get an error message.

    Who has administrative rights on these laptops? It might be simpler to install with a package.

    Christian

  • Hello Christian,

    thanks for your fast reply. I imported the clients from the Active Directory.

    The error ist 0000002E (or more "0" :D )

    I think all has administrative rights, we are all external consultants and work from home or in projects.

    I tried it with the standalone installer. The client is protected but not shown as protected in die Enterprise console.

     

     

    Marvin

  • Hello Christian,

    i deployed my SophosEndpoint.exe to my Laptop and installed it. After installation there is no connection to the Enterprise Console. My Server crendentials are in the Sophos AutoUpdate.

    I think there is an other cause,too... Can´t reach my server over UNC path and can´t ping the server from client and the client from the server.

     

    Marvin

  • Hello Marvin,

    can´t ping
    at least the endpoint must be able to resolve the server's name (NetBIOS or FQDN) and reach the SMB ports or, if updating via HTTP, port 80, and for communication ports 8192 and 8194. ICMP (ping) isn't necessary. Protect from the console has additional requirements but this comes second.

    Do you ping with the name or IP and what is the error?

    Christian

  • Hello Christian,

    i ping with the IP and with the name.

    Made GPO like the Sophos Support on the Domain Server.  https://www.youtube.com/watch?v=3bZJxvadoT0

     

    Unfortunately, I do not know how to continue with my error.

    Do I understand this in the right way if i can not reach the server about the UNC path and can´t ping, the installation / protection can not start?

     

    Marvin

  • Hello Marvin,

    of course the endpoint must be able to reach the server - how else could it download and update the software (or report its status).
    The screenshot suggests that the route to 192.168.xxx.xxx is broken - it gets as far as the 62.x.x.x and then gets the Zielhost nicht erreichbar. It's a network problem, not a problem with your installation.

    Christian

  • Hello Christian,

    I have come further with my problems.. If i click protect, theyellow arrow is there.

     

    Now i have two other errors.

     

    Error fffffffd computer not managed

    and

    80070002 The installation could not be started

    Have seen the articles, but it doesnt help, or I can not get on with it.

     

    Here is a screenshot from the alc.log (c:\ProgramData\Sophos\AutoUpdate\logs\alc.log)

     

    Marvin

     

  • Hello Marvin,

    the screenshot can't be from shortly after Protect as it is apparently already installed. Did you try to Protect a computer where Sophos is already installed?
    Strange that it shows failed downloads RMSNT, SAVXP, AutoUpdate, and SSP due to error 86 (password incorrect) - the latter three are then downloaded from Sophos - but succeeds with NTP and SED. The credentials should be the same so why do they suddenly work? Is this a domain account?

    As to the errors: The second says that the install task couldn't be created or started, the first tell that it was started but RMS failed to report back (either it's not running on the endpoint or it could not reach port 8192 or 8194 on the server).

    Christian

  • Hello Christian,

    Yes, i tried protect the computer where sophos AutoUpdate is installed.

    0Sophos is my account like "SophosUpdateMgr".

     

    After uninstall AutoUpdate and protect computer again i have this error :

     

    If i make telnet connections from client to server, i see these:

    Telnet to Server on Port 8192

    Telnet to Server on Port 8194

    I see the Cursor flicker

     

    Marvin

     

     

  • Hello Marvin,

    so the install has succeeded. The server answers on port 8192 - is 192.168.158.139 the IP you have used for telnet? - and the response on 8194 is the expected one. If so, please check the Router log in %ProgramData%\Sophos\Remote Management System\3\Router\Logs\. This should tell why the endpoint can't communicate with the server.

    Christian

  • Hello Christian,

     

    09.03.2018 10:48:27 1C8C I SOF: C:\ProgramData/Sophos/Remote Management System/3/Router/Logs/Router-20180309-094827.log
    09.03.2018 10:48:27 1C8C I Sophos Messaging Router 4.1.1.127 starting...
    09.03.2018 10:48:27 1C8C I Setting ACE_FD_SETSIZE to 138
    09.03.2018 10:48:27 1C8C I Initializing CORBA...
    09.03.2018 10:48:27 1C8C I Connection cache limit is 10
    09.03.2018 10:48:28 1C8C I Router::ConfigureSslContext: keeping legacy compatibility of TLS 1 and TLS 1.1.
    09.03.2018 10:48:28 1C8C I Creating ORB runner with 4 threads
    09.03.2018 10:48:28 1C8C W No public key certificate found in the store. Requesting a new certificate.
    09.03.2018 10:48:28 1C8C I Getting parent router IOR from 192.168.158.139:8192
    09.03.2018 10:48:28 1C8C I This computer is part of the domain PARADOX
    09.03.2018 10:48:49 1C8C I This computer is part of the domain PARADOX
    09.03.2018 10:48:49 1C8C I Getting parent router IOR from fe80::bc28:431e:a704:4f2:8192
    09.03.2018 10:48:49 1C8C E ACE_INET_Addr::ACE_INET_Addr: fe80::bc28:431e:a704:4f2: Authoritive: Host not found
    09.03.2018 10:48:49 1C8C W Parent address unknown: Authoritive: Host not found (11001)
    09.03.2018 10:48:49 1C8C I Getting parent router IOR from PXNPAPP07.paradox.local:8192
    09.03.2018 10:49:10 1C8C I Getting parent router IOR from PXNPAPP07:8192
    09.03.2018 10:49:32 1C8C I This computer is part of the domain PARADOX
    09.03.2018 10:49:32 1C8C E Failed to get parent router IOR
    09.03.2018 10:49:32 1C8C W Failed to get certificate, retrying in 600 seconds
    09.03.2018 10:59:33 1C8C I Getting parent router IOR from 192.168.158.139:8192
    09.03.2018 10:59:54 1C8C I Getting parent router IOR from fe80::bc28:431e:a704:4f2:8192
    09.03.2018 10:59:54 1C8C E ACE_INET_Addr::ACE_INET_Addr: fe80::bc28:431e:a704:4f2: Authoritive: Host not found
    09.03.2018 10:59:54 1C8C W Parent address unknown: Authoritive: Host not found (11001)
    09.03.2018 10:59:54 1C8C I Getting parent router IOR from PXNPAPP07.paradox.local:8192
    09.03.2018 11:00:15 1C8C I Getting parent router IOR from PXNPAPP07:8192
    09.03.2018 11:00:36 1C8C E Failed to get parent router IOR
    09.03.2018 11:00:36 1C8C W Failed to get certificate, retrying in 600 seconds
    09.03.2018 11:08:32 1C8C E Router::Start: Caught Router stopped before certificate obtained

     

    This is the Logfile... The only entry is from the 09.03 ?

     

    Have you a idea? I am so desperate....

    Marvin

  • This Logfile is from the Endpoint or do you need the log from the server ?

Reply Children
No Data