Upgrade from 5.5.1 to 5.5.2 fails

Hello R. Gorek,

is the Sophos Credential Store service installed and running? If so, there should be an associated log in %ProgramData%\Sophos\Credential Store\.

Christian

Heres the content from the log (XXXX is my admin-account):

Logging Started 5180 2020-03-05@14-42-13-184
2020-03-05 14:42:13.934 [INF] Service is starting...
2020-03-05 14:42:13.950 [INF] Check that DP API is functioning correctly
2020-03-05 14:42:13.981 [INF] DP API check succeeeded
2020-03-05 14:42:13.981 [INF] Service has started
2020-03-05 14:42:21.512 [INF] Read credential from store
2020-03-05 14:42:21.512 [INF] 0 credential(s) found
2020-03-05 14:42:21.528 [INF] Query store: 'Sophos Policy Evaluation Tool' - '2.2.3'
2020-03-05 14:42:21.544 [INF] Get user name: 'SEC.DBUser' by 'NT-AUTORITÄT\SYSTEM'
2020-03-05 14:42:21.544 [WAR] Credential not found: 'SEC.DBUser'
2020-03-05 14:42:21.559 [INF] Query store: 'Sophos Policy Evaluation Tool' - '2.2.3'
2020-03-05 14:42:21.559 [INF] Get user name: 'SEC.DBUser' by 'NT-AUTORITÄT\SYSTEM'
2020-03-05 14:42:21.559 [WAR] Credential not found: 'SEC.DBUser'
2020-03-05 14:42:21.575 [INF] Query store: 'Sophos Policy Evaluation Tool' - '2.2.3'
2020-03-05 14:42:21.575 [INF] Get password: 'SEC.DBUser' by 'NT-AUTORITÄT\SYSTEM'
2020-03-05 14:42:21.575 [WAR] Credential not found: 'SEC.DBUser'
2020-03-05 14:43:32.800 [INF] Query store: 'SEC.Bootstrapper' - '5.5.2'
2020-03-05 14:43:32.800 [INF] Get user name: 'SEC.DBUser' by 'xxxxxx'
2020-03-05 14:43:32.800 [WAR] Credential not found: 'SEC.DBUser'
2020-03-05 14:43:32.832 [INF] Query store: 'SEC.Bootstrapper' - '5.5.2'
2020-03-05 14:43:32.847 [INF] Get password: 'SEC.DBUser' by 'xxxxxxx'
2020-03-05 14:43:32.847 [WAR] Credential not found: 'SEC.DBUser'
2020-03-05 14:45:09.226 [INF] Query store: 'SEC.ServerCA' - '5.5.2'
2020-03-05 14:45:09.226 [INF] Get user name: 'SEC.SUMUser' by 'xxxxxx'
2020-03-05 14:45:09.226 [WAR] Credential not found: 'SEC.SUMUser'
2020-03-05 15:30:20.485 [INF] Query store: 'SEC.Bootstrapper' - '5.5.2'
2020-03-05 15:30:20.501 [INF] Get user name: 'SEC.DBUser' by 'xxxxxx'
2020-03-05 15:30:20.501 [WAR] Credential not found: 'SEC.DBUser'
2020-03-05 15:30:20.532 [INF] Query store: 'SEC.Bootstrapper' - '5.5.2'
2020-03-05 15:30:20.532 [INF] Get password: 'SEC.DBUser' by 'xxxxxx'
2020-03-05 15:30:20.532 [WAR] Credential not found: 'SEC.DBUser'

Hello R.Gorek,

didn't see this one before I replied.
setup.exe will likely reinstall the Credential Store if you uninstall it but I think it's working as it should. So 5.5.1 is still there but Deobfuscation skips the SUM credentials .... hm ... I think only Support/Dev can tell what this signifies. The only idea I have is to follow the How to change ... article (don't actually change the password, of course use the one configured in the policies) in the hope it will then pick up the credentials.

Christian

Hi Christian,

i've already tried that, but it didn't make a change.

I will escalate it to the Sophos Support now and give feedback when they find a solution.

Greets,

Robby

Hello Robby,

i've already tried that
I'll aim to be more creative next time ;). As it stubbornly refuses to play nice and 5.5.1 is working it's better to wait what Support has to say. I'm curious about the cause.

Christian,

Hi Gorek 

Could you please PM me the case details you have registered with Support? 

I also tried to upgrade from 5.5.1. to 5.5.2 and i get exactly the same error.

GetSumCredentialsFromCredStore: No Sophos Credential Store Service found: 80070005
GetSumCredentialsFromCredStore: Error 0x80004005: Failed to get username
CustomAction CredStore.GetSUMCredentials returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 16:19:05: CredStore.GetSUMCredentials. Return value 3.

ogging Started 3020 2020-03-05@16-19-00-902
2020-03-05 16:19:01.011 [INF] Service is starting...
2020-03-05 16:19:01.027 [INF] Check that DP API is functioning correctly
2020-03-05 16:19:01.058 [INF] DP API check succeeeded
2020-03-05 16:19:01.058 [INF] Service has started
2020-03-05 17:11:27.585 [INF] Read credential from store
2020-03-05 17:11:27.585 [INF] 0 credential(s) found
2020-03-05 17:11:27.585 [INF] Query store: 'Sophos Policy Evaluation Tool' - '2.2.3'
2020-03-05 17:11:27.601 [INF] Get user name: 'SEC.DBUser' by 'NT AUTHORITY\SYSTEM'
2020-03-05 17:11:27.601 [WAR] Credential not found: 'SEC.DBUser'

Hello Eren777,

i get exactly the same error
I beg to differ [;)]  a little bit- at least it's not exactly - but you're probably right regarding the precondition. Gorek posted
Action start 14:45:09: CredStore.GetSUMCredentials.
GetSumCredentialsFromCredStore:  Initialized.
GetSumCredentialsFromCredStore:  GetUsername operation results: 80131577
GetSumCredentialsFromCredStore:  Error 0x80131577: Failed to get username
whereas in your case it's
GetSumCredentialsFromCredStore: No Sophos Credential Store Service found: 80070005
GetSumCredentialsFromCredStore: Error 0x80004005: Failed to get username

While the consequence is the same in the former case the service could be contacted but the credentials were not yet available. This is actually not an error as they are initially stored when 5.5.2 has been installed. The issue is that the installer failed to load them from the registry.
In your case the installer fails to contact the service - somewhat surprising as it is apparently running. IIRC (can't check my logs right now) the installer should fetch the credentials from the registry and not try to contact the service. This path should only be taken after Server 5.5.2 has been installed and setup.exe is re-run (for whatever reason). You didn't post the part from Server64msi.log that precedes the error - did you get the same Deobfuscation skipped? I assume you've already retried, haven't you? If so, please contact Support. BTW - is your database on the default  local instance?

Christian

Hi Christian,

SI (s) (68:60) [16:19:05:246]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIA28D.tmp, Entrypoint: FormatInteger
Action start 16:19:05: FormatInteger.
MSI (s) (68!24) [16:19:05:277]: PROPERTY CHANGE: Modifying SERVER_FEEDBACKENABLED property. Its current value is '#0'. Its new value: '0'.
FormatInteger: Initialized.
MSI (s) (68:B8) [16:19:05:277]: Doing action: DeobfuscatePassword
Action ended 16:19:05: FormatInteger. Return value 1.
MSI (s) (68:C8) [16:19:05:277]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIA2AD.tmp, Entrypoint: DeobfuscatePassword
Action start 16:19:05: DeobfuscatePassword.
DeobfuscatePassword: Initialized.
DeobfuscatePassword: Deobfuscating: REGISTRYSERVERPASSWORD to SERVER_USERNAMEPASSWORD
DeobfuscatePassword: Deobfuscation skipped: REGISTRYSUMPASSWORD to SUM_USERNAMEPASSWORD
MSI (s) (68:B8) [16:19:05:308]: Doing action: SetServerUserNamePasswordFromCommandLineValue
Action ended 16:19:05: DeobfuscatePassword. Return value 1.

MSI (s) (68:B8) [16:19:05:464]: Note: 1: 1708
MSI (s) (68:B8) [16:19:05:464]: Product: Sophos Management Server -- Installation failed.

MSI (s) (68:B8) [16:19:05:464]: Windows Installer installed the product. Product Name: Sophos Management Server. Product Version: 5.5.2. Product Language: 1033. Manufacturer: Sophos Limited. Installation success or error status: 1603.

MSI (s) (68:B8) [16:19:05:480]: Deferring clean up of packages/files, if any exist
MSI (s) (68:B8) [16:19:05:480]: MainEngineThread is returning 1603
MSI (s) (68:2C) [16:19:05:480]: No System Restore sequence number for this installation.

I already tried to reinstall , but than i get the error "Installer has detected different versions of the components installed"

The Database is on the default local instance.

I already contacted the support.

Hello Eren777,

different versions
expected for a local database as it has already been upgraded. So no use to retry.

Can you still use and work with5.5.1, are you able to open the console? Guess you don't want SEC to be unavailable while you're waiting for a reply.

Christian

Yes 551 und console  is still working.

I got a reply from the support: they asked me, if the sum updatemanager password includes special characters. The only special charakter ,which is included in the password, is the underscore charakter "_"

Hello Eren777,

fine, no need to take action.

What's special and what not ... wouldn't say that an underscore is special (wonder what "special" character Gorek uses). This would be somewhat dissatisfying, it's not that the password just sat there all the time just waiting for the deobfuscation to fail with the 5.5.2 upgrade. Changing the SUM password to test the "special character" theory might not be such a doddle - you'll have to amend the updating policies. As an aside - it looks like passwords will be taken out from the updating policy editor, you specify a username but its password is managed centrally so no need to amend umpteen policies. Just a guess.

Christian

Hello Eren777,

fine, no need to take action.

What's special and what not ... wouldn't say that an underscore is special (wonder what "special" character Gorek uses). This would be somewhat dissatisfying, it's not that the password just sat there all the time just waiting for the deobfuscation to fail with the 5.5.2 upgrade. Changing the SUM password to test the "special character" theory might not be such a doddle - you'll have to amend the updating policies. As an aside - it looks like passwords will be taken out from the updating policy editor, you specify a username but its password is managed centrally so no need to amend umpteen policies. Just a guess.

Christian

Hi,

we do have special characters in our password. For testing purpose i've changed it to one with no special characters, but still the same issue.

Best regards,

Robby Gorek

Hi,

i had the same problem. I tried a few times, at last step-by-step (thx for the snapshots ;-)

My solution at this time: during installation of SEC 5.5.2 watch the services by services.msc in a second windows. Refresh the view by F5 all the time.

In that moment the "Sophos Credential Store" service is beeing created open the properties of the service and change the "log on as" credentials to "local system".

You have to do it quickly, before the installation process generates the error.

At my systems it works. Now all components are on 5.5.2.

Good luck!

Marco

Hi Marco,

Do you have Local Security Policy > Local Policies > User Rights Assignment > Log on as a service configured by Group Policy?  It might be the newly created SophosCSMSA$ account doesn't have this permission on your SEC server.

Hello,

no, I didn't.

At the moment it works with "local system", such as the most other services.

It's not fine that there was no way to change the service account during the setup process and nothing to find about the account created by sophos in the manual.

Our GPOs are managed by the domain, so changing the local policies would only help until they are updated.

Regards,

Marco

Hello Marco,

You have to do it quickly
a SEC install or upgrade is not Prince of Persia. There should be no need for auxiliary monitoring with rapid key-pressing and meticulously timed clicks. Did you get the GetSumCredentialsFromCredStore: No Sophos Credential Store Service found: 80070005 error in the Server64msi log? As far as I can see this CustomAction is only called when the deobfuscation fails (DeobfuscatePassword:  Deobfuscation skipped:) in which case assuring that the service runs wouldn't help as it had not yet stored the credentials at this point. Rather, I think, you got the error near the end where SaveToCredentialStore is called.

The Sophos.Credential.Store.Service uses a Virtual Service Account (VSAs are not a new concept) NT Service\Sophos.Credential.Store.Service. Normally the Log on as a service right is assigned (amongst others) to NT SERVICE\ALL SERVICES. As MEric has suggested your group policy might not assign this right.

Christian 

Hello Robby and Eren777,

has the issue been resolved? Could you upgrade?

Christian

Hi Christian,

not yet. My issue has been escalated to the development team. I am still waiting for a response .

Hi Christian,

we got the same situation issue is escalated to the developement team and still waiting for a reply.

Robby

Finally got an answer from Sophos Support.

Theres an KB article https://sophos.com/kb/114627 which solved the issue.

SEC is now on 5.5.2 and seems to work properly.

Thanks for the help.

I also tried all the suggestions in this thread as well as watching Sophos support spend hours on my server trying to get this installed.  The end following this tip of changing the log on to local as it was being installed was the only thing that worked for me.

Thanks!