A Windows API call returned error 1909 [0x00000070]

The fact it's affecting a number of computers, is the issue with the updating account in the policy as sent down from SEC?

What if you create a new domain user account, e.g.  SophosUpdate, so: Domain\SophosUpdate.  

Set this new account in the updating policy (in SEC), this will send down a new updating policy to all the clients.  Do they then all update OK?  If not, what is in the alupdate log [https://community.sophos.com/kb/en-us/36262#ALUpdate.log] of the failing client?

Regards,

Jak

Hello Faisal,

this is strange as the accounts mentioned are apparently the local SophosSAU accounts created by the installer (with User cannot change password and Password never expires set). Does this affect all endpoints and when did this start?

the account in local machines its not locked
As only AutoUpdate uses this account and should "know" the correct password I can't see why the lockout should occur in the first place. The lockout time is set with the Account Security Policy (minimum one minute) so they might get unlocked automatically.
AFAIK AutoUpdate nevertheless tries to make the connection and updates should succeed if there is no other issue. Are the endpoints shown as up to date in the Console? 

Christian

Hello QC,

This is not affecting all users at same time but its affecting most of the users timely. The account gets locked out itself and throws an error. With some users its working fine with the default installer created.

This is strange why the account works sometimes and then gets locked itself. Is there any policy modification required through GPO ?

Regards

Faisal

Hello Jak,

I am afraid if the issue remains the same as its happening with default user. What's the effect if we use a domain user ? Also what permissions would be required for that account.

Thanks

Regards

Faisal.

Hello QC,

Regarding the endpoints update, please find attached screen shoot.

Regards

Faisal

When you say the account is locked out, can you confirm that this is the case for the locally created account, i.e. the sophossau... one?

Hello Jak,

How to confirm, if this is the case for default / system created acct ? Also see the log of one of the PC for example.

Regards

Faisal

Hello Faisal,

How to confirm
Start → Computer, right-click → Manage, Local Users and Groups → Users → click the SophosSAU... user.

Christian

Hello QC,

This is what I know but how to check whether its the same account is locking or some other is getting locked. 

The issue is why its getting locked and then itself getting active.

Regards

Faisal

Hello Faisal,

why it's getting locked
that's the puzzling part. AutoUpdate either has the correct password or not. In the latter case it should report the 1909 (or a 1326 - incorrect password) for every update attempt.

It looks like an account lockout policy is in effect with a finite lockout duration that causes the accounts to get unlocked. This does not explain what gets them locked though. By default workstations don't audit failures, if failure auditing is turned on the Security Event Log should show which process is responsible.

Christian