Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 11 replies
  • Subscribers 0 subscribers
  • Views 35148 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Enterprise Console - Update failure

Contrac_IT

Hello,

I'm not sure if this is the correct area, please advise if not.

I've installed a trial version of Sophos Enterprise Console in a Win2012 environment and trying to deploy to 3 windows 8 machines for testing purposes.

At first I was getting the error: 80070002 The installation could not be started: The system cannot find the file specified. The computer may need additional configuration before installation.

I'd gone through the installation pre-requisites and watched a nice little video, checked shares and could access from workstation, eventually noticed opening firewalls via domain policy for inbound and outbound for reporting purposes.

I added these to domain policy and then I could push out to the workstation. If I go to the work station I can see Sophos installed now but it keeps saying update failed.

If I right-click and do manual update I get the progress window throwing files across saying contacting server...for about 1 minute then says cannot contact server.

1 question is where do I see the log file that may provide more information as to why this is. If I look in Enterprise Console > Events there is nothing in here.

If I browse to the workstation log file I see its a specific log file which needs to be open using Sophos but can't find which .exe file I need to open with for it or can I access these somehow via the console ?

Or if anyone might know why I can get this far and its able to install on workstations but no update.

The Status in console has just stayed with the orange down arrow next to computer for about 40 mins now with no change....as of writing this I finally got an error saying "computer is not yet managed"

So I understand this to be a firewall issue yet checking on deployment server and workstation in question I can see domain policy has deployed my inbound firewall rules for ports 8192 and 8194

Snippet from log file:
Trace(2015-Feb-20 16:44:45): Logging on network access user
Trace(2015-Feb-20 16:44:45): Attempting to make a connection to remote machine \\HA-SOPHOS\SophosUpdate\CIDs\S000\SAVSCFXP\
Trace(2015-Feb-20 16:44:47): CIDUpdate(Info): \\HA-SOPHOS\SophosUpdate, HASBS\administrator, 86
Trace(2015-Feb-20 16:44:57): GetCacDotPemFromLocalRMS could not open the Router registry key.
Trace(2015-Feb-20 16:44:57): GetCacDotPemFromSUM could not open the Management Tools registry key.
Trace(2015-Feb-20 16:44:57): Custom certificate could not be obtained.
Trace(2015-Feb-20 16:44:57): Remote connection over UNC.
Trace(2015-Feb-20 16:45:02): File master.upd not found (Remote). Return code 0x80040f04
Trace(2015-Feb-20 16:45:02): Unable to read file master.upd (Remote)
Trace(2015-Feb-20 16:45:02): Unable to synchronise file root.upd.
Trace(2015-Feb-20 16:45:02): Unable to synchronise file escdp.dat.
Trace(2015-Feb-20 16:45:02): Unable to synchronise file ProductID.dat.
Trace(2015-Feb-20 16:45:02): Unable to recover file root.upd.
Trace(2015-Feb-20 16:45:02): Unable to recover file escdp.dat.
Trace(2015-Feb-20 16:45:02): Unable to recover file ProductID.dat.
Trace(2015-Feb-20 16:45:06): Error -2147217660 in ReadCustomerIDFile
Trace(2015-Feb-20 16:45:06): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Calling SyncProduct with {E17FE03B-0501-4aaa-BC69-0129D965F311}
Trace(2015-Feb-20 16:45:06): CIDUpdateLocation::SyncProduct - Updating Product: SAVXP
Trace(2015-Feb-20 16:45:06): CIDUpdate(SyncProduct.Start): SAVXP, \\HA-SOPHOS\SophosUpdate\CIDs\S000\SAVSCFXP\
Trace(2015-Feb-20 16:45:06): CIDUpdateLocation::Sync - Updating from local CID: \\HA-SOPHOS\SophosUpdate\CIDs\S000\SAVSCFXP\savxp
Trace(2015-Feb-20 16:45:06): CIDSync(CidSyncMessage):
Trace(2015-Feb-20 16:45:11): CIDSyncCallback, SynchronisationTerminated - Code = -2147024809
Trace(2015-Feb-20 16:45:11): CIDSyncCallback, SynchronisationTerminated - MapFile = C:\ProgramData\Sophos\AutoUpdate\cache\savxp.map
Trace(2015-Feb-20 16:45:11): CIDSync(CidSyncMessage): \\HA-SOPHOS\SophosUpdate\CIDs\S000\SAVSCFXP\savxp,
Trace(2015-Feb-20 16:45:11): CIDUpdateLocation::SyncProduct: Failed to update product (SAVXP) from "\\HA-SOPHOS\SophosUpdate\CIDs\S000\SAVSCFXP\", Error is :CIDSYNC_E_SRCNOTFOUND (Source not found.)
Trace(2015-Feb-20 16:45:11): CIDUpdate(CIDDownloadFailed):
Trace(2015-Feb-20 16:45:12): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, SyncProduct returned - 0
Trace(2015-Feb-20 16:45:12): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Ended - 0
Trace(2015-Feb-20 16:45:12): UpdateLocationFacade::SyncProduct: Last Update Mechanism = Unknown
Trace(2015-Feb-20 16:45:12): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Started:
Trace(2015-Feb-20 16:45:12): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, creating update location
Trace(2015-Feb-20 16:45:12): Calling package_source_init
Trace(2015-Feb-20 16:45:12): TrySyncProduct, Calling BeginSync

Cheers for any input.

Glenn

:55917


This thread was automatically locked due to age.
  • 0

    Hello Glenn,

    \\HA-SOPHOS\SophosUpdate, HASBS\administrator, 86

    says that the password for HASBS\administrator is incorrect - these should be the credentials from the updating policy.

    Christian 

    :55919
  • 0

    Ok thanks for that, I had a discussion about this user account with someone else.

    So its still able to push out the clients even if this password was incorrect?

    :55920
  • 0

    So I ran the update manager updater as per http://www.sophos.com/en-us/support/knowledgebase/112598.aspx

    It didn't seem to update on workstation so I removed the auto-updater and re-installed via the console and this time it has the updated username / password account.

    Attached is log file ALUpdate from the problem workstation, it still seems to output same issue.

    Regards,


    Glenn

    :55923
  • 0

    Hello Glenn,

    its still able to push out the clients even if this password was incorrect

    yes, it's able to push and the install will start but never complete. Please see How does the 'Protect computers wizard' perform an installation? Under 3.1. it says: Once complete it will then fetch the additional required packages by connecting to the Updating policy location. It's not obvious what this means so I'll try to rephrase the article with less technical detail but also  looking at the accounts involved.

    • The credentials you enter in the Protect prompt are used to
    • create the install task on the endpoint
    • run the task on the endpoint
    • access the install location from the endpoint
    • install AutoUpdate

    The installation (i.e. setup.exe) will create an updating policy pointing to the Primary CID (or Initial Install Location) and the credentials from the policy (not the ones from Protect) for Primary.  At this point only AutoUpdate is installed. As it will use the Policy's credentials download and thus installation of all other components will fail if these credentials are incorrect. It can't report this to the console though because the required RMS is not yet installed.

    Christian

    :55924
  • 0

    Ok well I'm a little lost here then, the account I've updated it with is correct I'm logged on to the VM with those very details which is a domain administrator account with full network access.

    I can see the task scheduler is creating but it seems to fall over at this point.

    On friday when I left it last after spending most of day on it the console was reporting this computer is not yet managed (0xfffffff) after doing the re-install update manager update I'm getting:-

    The installation could not be started: The system cannot find the file specified. The computer may need additional configuration before installation. See KB Article 29287.

    I got rid of that on Friday when I'd updated the domain policy to push out inbound firewall rules.

    Regards,

    Glenn

    :55925
  • 0

    Hello Glenn,

    please verify that you can access the CID (share) using the account from the policy (the other log you've posted has error 1326 which is more general invalid credentials). Perhaps this thread can give you some additional hint.

    Christian

    :55927
  • 0

    Well this was one of the issues I was investigating prior to this issue as I went through the pre-requisites and installation guide I double checked I could access this share.

    From workstation I can map drive to it, view it in explorer with UNC path.  I set the share like the gentlemen in the post you linked

    \\HA-SOPHOS\SophosUpdate\CIDs\S000\SAVSCFXP

    This folder has group "Everyone" and "Authenticated Users" and even my specific user account I use on my workstation (the one having the problem) as I just went gun-ho with given share just because ya know how it is with permissions sometimes !

    Thanks for the replies Christian.

    Cheers,

    Glenn

    :55929
  • 0

    I'm going down the route of re-installing this from scratch as I took over the install from another person so hopefully knowing what I know now and all the troubleshooting I'm confident this will work flawlessly :smileyhappy:

    Regards,

    Glenn

    :55985
  • 0

    No problem Sandy.

    So I have done a fresh install, some things I noticed now I was the one doing the install was the 2 user accounts weren't used which are specified and also UAC wasn't turned off during install.

    But I'd like to say hooray that it works and I nearly did but this time round its slightly different.  After install I did the computer discovery and then proceeded to install on my PC.

    This looked like it did it swimmingly and when I came back to console I had a green mark next to the PC and the console is now reporting its managing 2 devices where before it never did this only mentioned the server was protected.

    Then eventually it came back with a "Warning" under alerts and events tab, my sanity sank further but the error simply reported the computer needed a restart so I felt better thinking hooray but after restarting the PC it still reports the same error in consolse that the PC needs a restart.  Its been an emotional rollercoaster!

    The current log file is attached, I noticed I have a new number next to Windows Error now as 53.  As you can see in the log file it still indicates to me an issue with the share.

    The 2 user accounts (SophosManagement and SophosUpdateMgr) both have the same passwords and the user account I'm using to Protect the machines is a domain administrator account which has access to everything.

    I just cannot for the life of me understand why it doesn't like to access this share!

    Cheers,

    Glenn

    :56006
Unfiltered HTML