This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

User_account "sophos" in AD gone.

Hi
I use Sophos Enterprise Console which have two domain controller servers as clients (called "AD1" and "AD2")
One day I found that AD1(base on windows server 2008) didn't update and I cannot update it via Sophos Enterprise Console too.
So I start investigate on this issue ...and when I access AD1.. I've found that the sophos tray icon (almon.exe) had been disappeared .. furthermore I realize that my whole D:\Sophos\AutoUpdate are all gone and the log say that It was an error when sophos try to update itself....
I already try copy the AutoUpdate folder from temp folder and try to run almon.exe but it didn't work ... so I decided to re install Sophos Client on AD1... However I also found that my user_account "sophos" was deleted too... So i need to recreate this user manually and reinstall sophos client.

So my question is what really happened... why my autoupdate folder and my user account are all gone ?? Please help

...This is my log file MsiInstaller-ad1
-------------------------------------Start------------------------------------------------------
Beginning a Windows Installer transaction: {4320988A-7DE0-478D-A38B-CE9509BCE320}
Product: Sophos Anti-Virus -- Removal completed successfully
Windows Installer removed the product. Product Name: Sophos Anti-Virus. Product Version: 10.3.1. Product Language: 1033. Manufacturer: Sophos Limited. Removal success or error status: 0
Windows Installer requires a system restart. Product Name: Sophos Anti-Virus. Product Version: 10.3.1. Product Language: 1033. Manufacturer: Sophos Limited. Type of System Restart: 2. Reason for Restart: 4
Product: Sophos Anti-Virus. Restart required. The installation or update for the product required a restart for all changes to take effect. The restart was deferred to a later time
Ending a Windows Installer transaction: {4320988A-7DE0-478D-A38B-CE9509BCE320}
Beginning a Windows Installer transaction: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
Product: Sophos Anti-Virus -- Installation operation completed successfully
Windows Installer installed the product. Product Name: Sophos Anti-Virus. Product Version: 10.3.7. Product Language: 1033. Manufacturer: Sophos Limited. Installation success or error status: 0
Windows Installer requires a system restart. Product Name: Sophos Anti-Virus. Product Version: 10.3.7. Product Language: 1033. Manufacturer: Sophos Limited. Type of System Restart: 2. Reason for Restart: 2
Product: Sophos Anti-Virus. Restart required. The installation or update for the product required a restart for all changes to take effect. The restart was deferred to a later time
Ending a Windows Installer transaction: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
Windows Installer installed the product. Product Name: Sophos AutoUpdate. Product Version: 3.1.1.18. Product Language: 1033. Manufacturer: Sophos Limited. Installation success or error status: 0
Beginning a Windows Installer transaction: {15C418EB-7675-42be-B2B3-281952DA014D}
Product: Sophos AutoUpdate -- Removal completed successfully
Windows Installer removed the product. Product Name: Sophos AutoUpdate. Product Version: 2.9.0.344. Product Language: 1033. Manufacturer: Sophos Limited. Removal success or error status: 0
Ending a Windows Installer transaction: {15C418EB-7675-42be-B2B3-281952DA014D}
Beginning a Windows Installer transaction: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
Product: Sophos AutoUpdate -- Error 3051.An error occurred while trying to create the user account 'sophos'. System error: 2224. Contact your support personnel
Product: Sophos AutoUpdate -- Installation operation failed
Windows Installer installed the product. Product Name: Sophos AutoUpdate. Product Version: 3.1.1.18. Product Language: 1033. Manufacturer: Sophos Limited. Installation success or error status: 1603
Ending a Windows Installer transaction: C:\ProgramData\Sophos\AutoUpdate\cache\sau\Sophos AutoUpdate.msi
------------------------------------- End ------------------------------------------------------

Ps. If you want to have more information .. please tell me.

:50872


This thread was automatically locked due to age.
Parents
  • Hello Anonymoussss,

    yes, it looks like 2224 caused the install to fail. Still wonder whether the account is really 'sophos'? What are the contents of the registry key HKLM\SOFTWARE\Sophos\AutoUpdate\Service?

    Christian

    :51362
Reply
  • Hello Anonymoussss,

    yes, it looks like 2224 caused the install to fail. Still wonder whether the account is really 'sophos'? What are the contents of the registry key HKLM\SOFTWARE\Sophos\AutoUpdate\Service?

    Christian

    :51362
Children
No Data