Guest VM Agent Installation Failure

Question

The Guest VM Agent installation fails with the error "sophos gvm management service failed to start". It looks like the account the installer creates does not have sufficient rights to start the service. This is a new Windows Server 2016 VM. Has anyone experienced this issue?

This thread was automatically locked due to age.

IT Manager2 · Answer

Tyler Caldwell said: 
 I eventually had to modify our domain GPOs to give the logon as a service permissions throughout my domain to the accounts above. I understand modifying GPOs is not quick and easy in most environments but I am not sure of any other way, at least in my domain.

Based on Tyler's comment about GPOs I have figured out a crude way to get the install to go through and setup all the necessary service accounts. Here are the steps I took: 
 1. Create an OU in AD and set GPO to block inheritance on that folder. 2. Create and apply a GPO to that folder: Computer Configuration>Windows Settings>Security Settings>User Rights Assignment>Log On as a Service Enable "Define These Policy Settings" and Add the "Everyone" Group (just type in Everyone). 
 3. Move DC to that OU. Force Update on DC (gpupdate /force). 4. Run installer and confirmed services are setup and running (with the correct Log On As service accounts created). 5. Test Eicar file. 6. Move DC back to original OU. Force Update on DC (gpupdate /force). 7. Restart DC (for good measure more than anything) - double-check services and Eicar file. 
 Obviously creating GPOs and moving DCs between sets of policies is NOT best practice but it's a workaround until Sophos figure it out. Hope that helps someone!

DavidRabenberg · Answer

I don't know if this will help others since I'm using Windows 7, and it seems like most others are using Windows Server. But I found that if I go in and do a full uninstall of MVC++ 2015, and then restart, I can then successfully install the VM agent with no issues. I don't know why this has anything to do with services not able to start due to permissions issues, but it has worked for me on 3 straight machines that had the issue.