Sophos Upgrade from 5.5.0 to 5.5.2

The most common reason I've heard of this happening here is due to the "Logon as a service" rights being defined within your local or domain security policy.  The Credential Store creates a new service account and attempts to start the service using that account as part of the installation process.  If the local or domain security policy does not include "NT SERVICES\ALL SERVICES", the Credential Store service may fail to start.

Hi MEric,

Thank you for your response.

As I couldn't install the Credential Store service while upgrading and it terminated/stopped straight away from there. Please let me know how to fix this and what I can do next to complete an upgrade.

Thank you and look forward to your response.

Kind regards,

Accounts Payable1

Does NT SERVICE/ALL SERVICES exist if you run the following in an administrative command prompt?  What you are looking for in the report is under Settings > Policies > Windows Settings > Security Settings > Local Policies User Rights Assignment > Log on as a service.
gpresult /h C:\Windows\Temp\report.htm
C:\Windows\Temp\report.htm

If this setting has been specified and NT SERVICE\ALL SERVICES is not listed, you will need to add it in.  Open up Group Policy Management on your DC and modify the group policy applied to your SEC server. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Log on as a service.  When adding the user, type in NT SERVICE/ALL SERVICES and click "OK", not Browse.  Save this policy.

After saving, force the SEC server to retrieve this new policy by running gpupdate /force.  Verify that NT SERVICE/ALL SERVICES now exists under the report by running the gpresult command mentioned at the start.  If so attempt to run the installer again.

Hii MEric,

Thank you for your response.

Yes I will follow your instructions to add  NT SERVICES\ALL SERVICES to Group Policy Management. I would like to ask you I can run setup.exe file from the sec_552 install folder to continue upgrading to 5.5.2 (As I see Sophos Management Database version 5.5.2 has been installed the under Programs and Features) or I have to run sec_552_sfx.exe to start from the beginning to complete an upgrade 5.5.2

Please advise...

Thank you.

Kind regards,

T Doan

Hello T Doan,

I can run setup.exe file from the sec_552 install folder
yes, for subsequent attempts this is the right choice. the sfx does nothing more than extracting the archive to sec_552 and calling setup.exe.

Sophos Management Database version 5.5.2 has been installed
you'll run into the problem described in Installer has detected different versions of the components installed. This would be Scenario 1 in the article. Uninstall the Database component, re-run the Installer, it will offer to upgrade the other components (the Database will be greyed out). Do not forget to reinstall the Database component with the CREATE_DATABASES=0 argument even though there will be no future upgrades - if for whatever reason you re-run the Installer again it would otherwise let you (or someone else) tick the Database component, attempt to install it but fail. Might cause confusion.

Christian

Hi Christian,

Thank you for the update.

I will do as what you mentioned and let you know the result after upgrading.

Kind regards,

T Doan

Hi Christian,

Thank you for the update.

I will do as what you mentioned and let you know the result after upgrading.

Kind regards,

T Doan