Sophos for VE installation fails on Hyper-V (Windows Server 2019)

Hi Olaf,

As the install is failing on setting a mount point, what happens if you attempt to manually mount the vhd file?
Also check Local Security Policy > Local Policies > User Rights Assignment > Perform volume maintenance tasks to see what users/groups are assigned to this and the user running the installer is a part of this policy.

Which volume would have to be mounted - there are two in the package?

Best greetings from Germany
Olaf

Hi Olaf Engelke 

Please mount the package available for the SVM(Security VM).

Hi,

the installing user is the domain Administrator, so no lack of permissions. (The config file gets copied to the VHD folder and after that the error appears.)

If I mount the sav-sve-disk1.vhd file I can start the VM and arrive at the localhost login prompt. But the account password for sophos account, which I did set during the initial stage, did not make it to the image.

If I mount the config disk first and the sve disk second the system boots up also (one or more red item(s) hurry through too fast) and prompts me that I am in emergency mode and asks for a root password.

If I mount the sve disk first and the config disk second I see an error like "Failed to start script which configures the SVM post deployment."

The same happens also on a Hyper-V-Host with Windows Server 2012 R2 at another customer.

If I delete the VM after the error, remove the VHDs and repeat the installation with Start over the sequence is:

• VM gets created and powered on during disk validation.
• VM gets powered off.
• Configuration VHD file is copied to target location.
• Installation fails. (Eventually attempting to copy the SVE disk to the target location, since that never appears.)

The difference between the various attempts is the GUID in the failed mount point (i.e. C:\Users\ADMINI~1.domain\AppData\Local\Temp\2\f4c6d354-a75e-4569-ab5e-55b7a6bb5e5f)

There is nothing in that folder besides a much shorter folder name, which could be from first installation attempt (sfl-d7808b71), which seems to be empty.

Best greetings from Germany
Olaf

Hi Olaf Engelke 

Would you please perform the below steps and let us know how installation works for you and if gets failed, please share the installation logs as well.

1. Create and mount a new vhd using the Disk Management snap-in as described in:

https://docs.microsoft.com/en-us/windows-server/storage/disk-management/manage-virtual-hard-disks

2. Dismounted the newly created vhd and deleted it. then mounted again the 

D:\VHD\SOPHOSVM01\configureSVM.vhd using the same procedure as per pt1 (Actions->Mount VHD)

I would also suggest you to try to install the SVM on another host and check whether the installation works or gets failed.

Hi Jasmin,

thanks for replying. Regarding your suggestion: The second installation was on another customer, another Windows version (as mentioned before), another download.

Installation fails after copying the config VHD.

Deploying Security VM
Validating VHD disks before installation
Creating configuration disk
Copying configuration disk to datastore
Copying VHD from C:\install\Sophos\Sophos for Virtual\configureSVM.vhd to D:\VHD\DEHAMSOPVM01\configureSVM.vhd, this may take some time..
Failed to install Security VM

Install log:

2020-03-06_14-07-02 [INFO] Starting Sophos for Virtual Environments installer tool
2020-03-06_14-07-02 [INFO] Starting Sophos for Virtual Environments installer tool
2020-03-06_14-10-49 [INFO] Deploying Security VM
2020-03-06_14-10-49 [INFO] Validating VHD disks before installation
2020-03-06_14-11-46 [INFO] Creating configuration disk
2020-03-06_14-11-46 [INFO] Copying configuration disk to datastore
2020-03-06_14-11-46 [INFO] Copying VHD from C:\install\Sophos\Sophos for Virtual\configureSVM.vhd to D:\VHD\DEHAMSOPVM01\configureSVM.vhd, this may take some time..
2020-03-06_14-11-46 [WARN] Failed to set mount point for config VHD. Retrying...
2020-03-06_14-11-47 [WARN] Failed to set mount point for config VHD. Retrying...
2020-03-06_14-11-48 [WARN] Failed to set mount point for config VHD. Retrying...
2020-03-06_14-11-49 [WARN] Failed to set mount point for config VHD. Retrying...
2020-03-06_14-11-50 [WARN] Failed to set mount point for config VHD. Retrying...
2020-03-06_14-11-51 [ERROR] Failed to set mount point for C:\Users\ADMINI~1.WVE\AppData\Local\Temp\2\17ea90d2-f149-4684-80de-89b13bace508
2020-03-06_14-11-51 [INFO] Failed to install Security VM

There is no content on the mounted file besides System Volume Information (created 08/15/2018) and the new created Recycle.bin folder.

Eventually it seems the software attempts to mount the config VHD file from a location where it is not to be found (Admins temp folder) to inject the configuration script.

Do you think we can solve this through this forum or should I open a support ticket?

Best greetings from Germany
Olaf

Hi Olaf Engelke 

If you have a support case, then it will be good for the documentation and if needed it can be escalated further. 

Please let me know the support case number if you have already opened it or you can PM me the license number.

Support case is 9756501.

Last response was from 8th April after uploading the process monitor logs of an installation attempt promising a review by developement.

Best greetings from Germany
Olaf

Hi Olaf Engelke 

Sorry for the delay on the case but the Development team is working on your case currently. 

I'll check with the Global escalation engineer for this case as well.

Well i get further in installation with still failed at the Waiting to receive Security VM certificate from Sophos Central, this may take some time.

by changing with diskpart prompt,  “san policy=OnlineAll”.

See log at the end…i<m getting close but still no success

Andre

2020-04-26_13-17-47 [INFO] Starting Sophos for Virtual Environments installer tool

2020-04-26_13-17-47 [INFO] Starting Sophos for Virtual Environments installer tool

2020-04-26_13-19-59 [INFO] Deploying Security VM

2020-04-26_13-19-59 [INFO] Validating VHD disks before installation

2020-04-26_13-20-54 [INFO] Creating configuration disk

2020-04-26_13-20-54 [INFO] Copying configuration disk to datastore

2020-04-26_13-20-54 [INFO] Copying VHD from  C:\Sophos\configureSVM.vhd to D:\VMs\Sophos-VM\configureSVM.vhd, this may take some time..

2020-04-26_13-20-54 [INFO] Set Volume Mount point succeeded

2020-04-26_13-20-54 [INFO] Copying VHD from  C:\Sophos\sav-sve-disk1.vhd to D:\VMs\Sophos-VM\sav-sve-disk1.vhd, this may take some time..

2020-04-26_13-21-18 [INFO] Waiting for Security VM to start, this may take up to 10 minutes

2020-04-26_13-21-50 [INFO] Setting the timezone on the Security VM

2020-04-26_13-21-59 [INFO] Setting the support password on the Security VM

2020-04-26_13-21-59 [INFO] Setting the guest agent installer password on the Security VM

2020-04-26_13-22-00 [INFO] Configuring the migration IP addresses

2020-04-26_13-22-00 [INFO] Configuring Sophos Central management and performing update on the Security VM, this may take some time..

2020-04-26_13-22-02 [INFO] Waiting to receive Security VM certificate from Sophos Central, this may take some time.

2020-04-26_13-32-03 [ERROR] Traceback (most recent call last):

2020-04-26_13-32-03 [ERROR]   File "/build/opt-sophox/vmrun/decode_and_run.py", line 30, in <module>

2020-04-26_13-32-03 [ERROR]   File "/build/opt-sophox/vmrun/decode_and_run.py", line 25, in main

2020-04-26_13-32-03 [ERROR]   File "/build/opt-sophox/vmrun/vmrun_utils.py", line 147, in run_process

2020-04-26_13-32-03 [ERROR] subprocess.CalledProcessError: Command '/opt/sophox/vmrun/wait_for_central_generated_certificates' returned non-zero exit status 1.

2020-04-26_13-32-03 [ERROR] [INFO:vmrun_utils.py:65]: > [ERROR:wait_for_central_generated_certificates:53]: Failed to configure SVM with Cloud Certificates - Waiting for Cloud Certificates pem file timed out.

2020-04-26_13-32-03 [ERROR] [ERROR:vmrun_utils.py:65]: > Traceback (most recent call last):

2020-04-26_13-32-03 [ERROR] [ERROR:vmrun_utils.py:65]: >   File "/opt/sophox/vmrun/wait_for_central_generated_certificates", line 51, in <module>

2020-04-26_13-32-03 [ERROR] [ERROR:vmrun_utils.py:65]: >     main()

2020-04-26_13-32-03 [ERROR] [ERROR:vmrun_utils.py:65]: >   File "/opt/sophox/vmrun/wait_for_central_generated_certificates", line 34, in main

2020-04-26_13-32-03 [ERROR] [ERROR:vmrun_utils.py:65]: >     raise TimeoutError("Waiting for Cloud Certificates pem file timed out.")

2020-04-26_13-32-03 [ERROR] [ERROR:vmrun_utils.py:65]: > __main__.TimeoutError: Waiting for Cloud Certificates pem file timed out.

2020-04-26_13-32-03 [ERROR] [ERROR:decode_and_run.py:32]: Failed to execute command

2020-04-26_13-32-03 [INFO] Writing Security VM logs to configuration disk

2020-04-26_13-32-09 [ERROR] remote command returned error(s)

2020-04-26_13-32-09 [INFO] Failed to install Security VM

Unknown said:

by changing with diskpart prompt,  “san policy=OnlineAll”.

Thanks. This did indeed solve the issue for me. (Although its unclear, why I could mount the virtual disks or attach them to the VM manually without issue.)

As for your problem: Network configuration for your Sophos for Virtual Environments allows Internet communication and the firewall does not interfer?

Meanwhile I am stuck again - the VM Agent cannot be installed.

[63C0:5CD0][2020-04-27T13:31:35]i301: Applying execute package: SGVMManagementService64.msi, action: Install, path: C:\ProgramData\Package Cache\{379DE57E-6BAC-4F29-9AB0-1B73819CFE3A}v1.3.3.8\SGVMManagementService64.msi, arguments: ' ARPSYSTEMCOMPONENT="1" MSIFASTINSTALL="7" SOPHOS_SVM_ADDRESS="192.168.xxx.yyy" AVAILABLE_SVM_ADDRESS="" SOPHOS_DIR="C:\Program Files\Sophos"'
[63C0:5CD0][2020-04-27T13:31:37]e000: Error 0x80070643: Failed to install MSI package.
[63C0:5CD0][2020-04-27T13:31:37]e000: Error 0x80070643: Failed to execute MSI package.
[718C:61E0][2020-04-27T13:31:37]e000: Error 0x80070643: Failed to configure per-machine MSI package.
 

Best greetings from Germany

Olaf

Indeed Problem was at the Firewall Gateway that blocked the installation completion. Setup completed in the end successfully :)

Glad that the Diskpart command fixed the SVE installation on your side as for the VM Agent Guess worked well on my side. Hope you find the solution for that issue

Andre

Indeed Problem was at the Firewall Gateway that blocked the installation completion. Setup completed in the end successfully :)

Glad that the Diskpart command fixed the SVE installation on your side as for the VM Agent Guess worked well on my side. Hope you find the solution for that issue

Andre