Package Deployer : cliënts keep showing up in Unassigned group

Hello Mark,

have the packages been built with 10.6.4 already? RMS in the package or downloaded by AutoUpdate (shouldn't really make a difference though). My endpoints drop to the correct group - it might be setup.exe (which is responsible for storing the information fro RMS) and I'll check if my packages contain already the latest versions.

Christian

The switch -G as detailed here needs to be quite specific:

https://community.sophos.com/kb/en-us/12570

Note:

The path:

• is case sensitive
• must not end in a backslash
• must include the management server
• must be enclosed in "double quotes" if switches (backslashes) are used

Example:

"\[SecServerName]\TopLevelGroup\Group"

Do you have a screenshot of the SEC group tree and the switch actually being passed by the Deployment packager to setup.exe to ensure they line up with the above conditions?  To get this I would suggest running Process Monitor (technet.microsoft.com/.../processmonitor.aspx): Then look at the process tree to see the full command line.

Regards,
Jak

Hi Jak,

Checked that article several times and tested with various otions of the ". I am sure the SEC group tree is correct. I will check with process monitor as soon as i can.

Thank you for your reply!

Mark

QC said:

Hello Mark,

have the packages been built with 10.6.4 already? RMS in the package or downloaded by AutoUpdate (shouldn't really make a difference though). My endpoints drop to the correct group - it might be setup.exe (which is responsible for storing the information fro RMS) and I'll check if my packages contain already the latest versions.

Christian

 

Hi Christian,

I will check the version later today. I also have to check with our application administrator if updates were installed recently. If i recon this was not the case, but i will check again.

Thank you for your reply.

Mark

Hi Christian,

Just downloaded the newest release of the Sophos Deployment Packager (1.3.0). We were using 1.2.1. Unfortunately this made no difference.

The packages are build with 1.6.4.1150 and RMS is downloaded by AutoUpdate. While creating a package I triple checked the parameters:

–G "\Servername\subfolder\subfolder\subfolder\DomainController_Server"

Still no luck..

Hi Jak,

I did not run processmonitor yet, but have tested the installation by using the command line. And that works!

The command I used:

setup.exe -mng yes -updp http://Updatepath/SophosUpdate/CIDs/S000/SAVSCFXP -ouser ObfuscatedUsername -opwd ObfuscatedPassword –G "\Subfolder\Subfolder\Subfolder" -s -ni

So at least I know that it is not on my serverside, but probably in the packages that we build with Deployment Packager. Strange thing is that i already downloaded the most recent version of that (1.3.1).

Any Clue?

Thanks,

Mark

Well the -G switch and the value passed to setup.exe with it, just gets stored in the registry temporarily before the Sophos Agent Service (part of RMS - ManagementAgentNT.exe) can get installed, start-up, read the key, delete the key and create a message for the management server to move the computer to the specified group.

You could check that the GroupPath value under HKLM\Software\[wow6432node]\Sophos\Remote Management System\ManagementAgent is being written before the Sophos Agent service starts up, reads it and deletes it. 

I think the PML log will show all of this taking place.

Regards,

Jak

Hi Jak,

Sorry for the delay!

A few days ago i performed an installation by using the commandline. I also used obfuscated credentials and the -G switch. This time the agent was put into the correct Group!

A few moments ago i installed an agent using the created package and i monitored (using F5) the registrypath you mentioned. I do not see the key GroupPath appear in this folder. I realise that it might process so fast that i might have missed it. So i am now going to try and use the PML. But that just gives so much output.

I attached a screenshot of the registry. From beginning to the end (it starts with installing RMS) these keys are created and present at the end of the install.

Thank you for your help so far.

Mark

Hi Jak,

Just used the procesmonitor. When i filter the log and search for "GroupPath" i get no result. Thats also the case when searching for specific words of the group string in the path colum.

Looks like the setup does not create the registry key during installation.

I check the setup.exe that is used during creation of the package. The File version is 3.4.0.271 and product version is 3.4.0.

Hope to hear from you. (Or somebody else who can help me out :) )

Mark

Hello Mark,

3.4.0.271 is current for 10.6.4.

As for Process Monitor - make sure you're capturing registry activity (well, of course you did), use a filter Path contains Sophos\Remote Management System\ManagementAgent. This should reduce the amount of output.

Do you build the package with the GUI or command line? The package can be unpacked e.g. with 7zip, there's a setup.vbs which calls setup.exe - you could check if it's called correctly. As far as I can see the GUI can handle blanks in the group names, could it be some "funny character" though?

Christian