Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 11 replies
  • Subscribers 1 subscriber
  • Views 41507 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos RMS update problem

Georg_Leitner

Hi,

i have a problem with the sophos rms component. there was a problem with rms on one server, so i completly uninstalled sophos. i rebooted the server and then reinstalled sophos with the enterprise console. everything was installed fine except rms.

i then installed rms by hand from the sophos autoupdate\cache\rms folder, which did work without problems. but when sophos tries to autoupdate itself, it uninstalled rms again and can't install it again.

here is the rms log:

Install from:[C:\ProgramData\Sophos\AutoUpdate\cache\rms]
Install to  :[(null)]
MsiPackagePath: [C:\ProgramData\Sophos\AutoUpdate\cache\rms\Sophos Remote Management System.msi].
Result of loading C:\Program Files (x86)\Sophos\AutoUpdate\SAUConfigDLL.dll is: [6b810000]
LOGIC: Installed version is less than 4 (minor upgrade is n/a).
LOGIC: Unistall needed
Uninstallation of installed RMS required
UNINSTALL: Using backup path C:\ProgramData\Sophos\AutoUpdate\cache\rms\installer_backup
RMS-BACKUP: Starting back up...
RMS-BACKUP: Get list of processes and services to stop.
RMS-BACKUP: Retrieved [].
RMS-BACKUP: Parsed WaitForProcesses and ListOfServices - OK.
RMS-BACKUP: Try to stop services.
RMS-BACKUP: Stopped services with ServiceController() - OK.
RMS-BACKUP: Waiting for processes to disappear.
RMS-BACKUP: Waited for processes - OK.
RMS-BACKUP: Retrieving the CommonAppData folder.
RMS-BACKUP: Retrieved source: [C:\ProgramData\Sophos\Remote Management System\3].
RMS-BACKUP: Retrieved backup: [C:\ProgramData\Sophos\AutoUpdate\cache\rms\installer_backup].
RMS-BACKUP: Directory: [C:\ProgramData\Sophos\AutoUpdate\cache\rms\installer_backup] existed.
RMS-BACKUP: Backing up registry content
Running Command: regedit /E "C:\ProgramData\Sophos\AutoUpdate\cache\rms\installer_backup_reg\rms_registry.reg" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\Remote Management System"
Command returned 0
Running Command: regedit /E "C:\ProgramData\Sophos\AutoUpdate\cache\rms\installer_backup_reg\messaging_registry.reg" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\Messaging System"
Command returned 0
UNINSTALL: Preserving cac.pem and mrinit.conf files
UNINSTALL: cac.pem and mrinit.conf files preserved
UNINSTALL: Removing RMS using cached msi with command: REBOOT=ReallySuppress SOPHOS_TP_TOKEN=1
UNINSTALL: removing RMS using package msi by running MsiInstallProduct(C:\ProgramData\Sophos\AutoUpdate\cache\rms\Sophos Remote Management System.msi, "REBOOT=ReallySuppress REMOVE=ALL SOPHOS_TP_TOKEN=1")
UNINSTALL: !RMS Setup plugin: Removal of old RMS returned exit code 1605

and autoupdate log:

Trace(2015-Apr-17 11:13:54): Sending message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSEndUpdate"><ErrorMessage><ID>Install.Failure</ID><StringID>103</StringID><Sender>ALUpdate</Sender><Insert>RMSNT</Insert><Insert>80041f09</Insert></ErrorMessage></Config>

greets

Georg

:56728


This thread was automatically locked due to age.
  • 0

    Hello Georg,

    perhaps an unfortunate moment as 10.3.13 with the new RMS 4.0 has just been released.

    everything was installed fine except rms ... i then installed rms by hand

    This is not recommended as setup.exe or ALUpdate.exe run some logic and set up a few things before calling the Installer. For whatever reason ALUpdate seems to think that an older version is installed (LOGIC: Installed version is less than 4) and attempts to uninstall it - which fails with 1605 (ERROR_UNKNOWN_PRODUCT, This action is only valid for products that are currently installed), the Sophos RMS uninstall log.txt might or might not help.

    everything was installed fine except rms ... there was a problem with rms on one server, so i completly uninstalled sophos

    The deployment from the console should have been a clean install and worked (actually AutoUpdate installs the components from the cache after downloading them). That the installed failed suggests that the initial problem with rms wasn't resolved by the uninstall/reinstall.

    I'd suggest to uninstall once again, retry the deployment and then tackle the install error (which now shouldn't be 1605).

    Christian

    P.S.: One ALUpdate.exe LOGIC: message contains a small typo :smileywink:

    :56730
  • 0

    HI, i have faced the same issue as well.

    You are saying of reinstallation the software, are you referring to reinstalling Sophos SEC or SAV?

    i have reinstalled SAV but the error code is still 1605.

    :56829
  • 0

    reinstalling the sophos antivirus from the console.

    i'm currently in talk with support (ccase [#5088084]), but no solution till now

    :56833
  • 0

    I've got the exact same issue on only one of my endpoints. Any update to this situation?

    :57123
  • 0

    Hello rsenio,

    doesn't seem to be a general issue but nevertheless might be related to the RMS 3.4->4.0 upgrade. You should open a ticket with Support (perhaps referring to the other cases mentioned here).

    I've had a different issue and to my surprise found a ClientMRInit log in C:\Windows\SysWOW64 - could you please check this location (which is rather uncommon for a log)?

    Christian

    :57137
  • 0

    currently not,  it was escalated further and i'm waiting for them to get back to me.

    currently only one endpoint is affected

    :57138
  • 0

    Yep, I have an open ticket as well. And same as yourself, it is only 1 of my endpoints with this problem. Strangely enough, I can uninstall anything Sophos related, AV, Autoupdate etc as well as scrub the registry and file locations on C: During the client push install it still complains of a previous version, at which point it cannot uninstall due to a MSI 1605 error 

    “This action is only valid for products that are currently installed”. Same error as what the logs are saying

    :57149
  • 0

    I've made some progress on this weird issue. Taking clues from other similar problems on the internet

    http://community.spiceworks.com/scripts/show/1601-sophos-9-5-10-removal-script?page=1

    I do not recommend running the script, since this appears to be for older versions. However I did use 'some' of it. Specifically the post by anthonyjohnson5 in which he mentions running with one msi switch causes the "This action is only valid for products that are currently installed." where as the other switch option does not.

    I ran this after the Enterprise Console pushed out the AV and AutoUpdate but failed on the RMS. This next part actually installs RMS and you'll see in the log that it states no previous version found, doing a clean install

    "\\SOPHOSSERVER\SophosUpdate\CIDs\S000\SAVSCFXP\rms\Sophos Remote Management System.msi" /qn REBOOT=SUPPRESS /l*v c:\RMSUninstall.log

    **replace SOPHOSSERVER with your server's netbios name

    This installed RMS, what seems without a hitch. Not surprising since I could manually install the MSI from the Cache folder on the client machine.

    Once it was installed, I then uninstalled Sophos AV, RMS and AutoUpdate. Rebooted, and then attempted a client push install from the Enterprise Console. It worked and for now at least this client is back to being managed but who knows what will happen on a new RMS version.

    :57153
  • 0

    I heard back from support regarding my open case. For those that still have the issue, they have verified that this is a problem since the release of the new RMS and it is with the developement team for a fix (I'm guessing there were more than just two of us that reported this) However, they were unable to tell me when that will be released, if it will be a pushed update, or if it will be included in the next version.

    :57204
  • 0

    i tried your fix with success, until now no problems. thanks!

    i heard back from support, but had in the meantime tried your fix, so i was not able to test their fix. it involved following:

    Navigate to C:\Windows\Installer
From the menu select view>Choose details
Select subject and click ok
Scroll down the list and locate the MSI that relates to the Sophos remote management system subject
Right click on the msi and select repair
This should re-add the registry - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D5001DEF8CBC5D542A88FF7CBB031412
With the registry key in place carry out the update and it should now remove RMS 3.4.1

    that could have possible worked, if the msi was there, but i cannot verify it anymore

    :57206
Unfiltered HTML