Thread Info
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failed to install Sophos Network Threat Protection Unexpected system error (0x00000067)

pdturbo80

 Hi,

 

Have a machine that fails at this point. Prior to this I followed the correct way to uninstall Sophos and followed it to the t, however it displays the following in the SEC. Any suggestions? I am unable to open the Sophos Client on the machine, it says "Internal Error 2719 . {788B9788-7F03-4A2B-8258-344C0278C33}

Thanks

SI (s) (C8:E0) [17:31:35:733]: Note: 1: 1708
MSI (s) (C8:E0) [17:31:35:733]: Transforming table Error.

MSI (s) (C8:E0) [17:31:35:733]: Transforming table Error.

MSI (s) (C8:E0) [17:31:35:733]: Produkt: Sophos Network Threat Protection -- Installation fehlgeschlagen.

MSI (s) (C8:E0) [17:31:35:734]: Das Produkt wurde durch Windows Installer installiert. Produktname: Sophos Network Threat Protection. Produktversion: 1.2.2.50. Produktsprache: 1031. Hersteller: Sophos Limited. Erfolg- bzw. Fehlerstatus der Installation: 1603.

MSI (s) (C8:E0) [17:31:35:734]: Deferring clean up of packages/files, if any exist
MSI (s) (C8:E0) [17:31:35:734]: MainEngineThread is returning 1603
MSI (s) (C8:7C) [17:31:35:735]: No System Restore sequence number for this installation.
=== Protokollierung beendet: 25.07.2017 17:31:35 ===
MSI (s) (C8:7C) [17:31:35:735]: User policy value 'DisableRollback' is 0
MSI (s) (C8:7C) [17:31:35:735]: Machine policy value 'DisableRollback' is 0
MSI (s) (C8:7C) [17:31:35:735]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (C8:7C) [17:31:35:735]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (C8:7C) [17:31:35:735]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (C8:7C) [17:31:35:736]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (C8:7C) [17:31:35:736]: Restoring environment variables
MSI (s) (C8:7C) [17:31:35:736]: Destroying RemoteAPI object.
MSI (s) (C8:84) [17:31:35:736]: Custom Action Manager thread ending.
MSI (c) (28:60) [17:31:35:736]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (28:60) [17:31:35:736]: MainEngineThread is returning 1603
=== Verbose logging stopped: 25.07.2017 17:31:35 ===

setup::MsiInstaller::installOrUpgrade: Install/upgrade returned 1603
`anonymous-namespace'::setResult: installation failed
ProductSetup::~ProductSetup: End product setup



This thread was automatically locked due to age.
  • 0

    Can you share the entire MSI log file?

    Regards,

    Jak

    • 0 in reply to jak

      As in the Network Threat Protection log file?

      • 0 in reply to pdturbo80

        Hello Peter,

        the whole log that contains Produkt: Sophos Network Threat Protection -- Installation fehlgeschlagen or the relevant part. Although the Troubleshooting using MSI logs article suggests reading the log bottom-up the first encounter with an error message is in the summary section, sometimes it gives just the unspecific 1603. The actual location of the error in the install sequence (along with some details) is farther above.

        Christian

        • 0 in reply to QC

          Multitasking here on both threads :)

          Here is the log Sophos Network Threat Protection Install Log.txt

           

          Thanks

          • 0 in reply to pdturbo80

            Hello Peter,

            as far as I can see it's a 0x8007054f (meaning: internal error) running the command "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man". Found another thread mentioning sntp.man but a different issue. Dunno how to proceed but maybe has some idea.

            Christian

            • 0 in reply to QC

              Hi Christian,

              Thanks, really odd one. I have done a full uninstall as per the Sophos KB a couple of times now. So kinda out of ideas on this.

              • 0 in reply to pdturbo80

                I would run Process Monitor during the install.

                Once captured, bring up the tree view and find the wevtutil.exe process.  I assume the process is created for the install command, i.e.

                wevtutil.exe im "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man

                Filter in that process id, scroll to the bottom to find the process exit event.  What is the return code?

                Regards,

                Jak

            Unfiltered HTML