Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 13 replies
  • Subscribers 4 subscribers
  • Views 30231 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Win 10 install endpoint occur Unexpected product state 1 for product

YuzenChen

Hi All, 

system OS: Win 10

SAV Version: v10.7

 

When i install endpoint with setup.exe , this machine will not going  install process.

It show error on %temp%/ESetup.txt  "Unexpected product state 1 for product with code {AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}"

So.. any idea with this case? 

 



This thread was automatically locked due to age.
  • 0

    Hello YuzenChen,

    it shouldn't have failed with this error on the very first attempt. Has an install been tried before (locally with setup.exe, a package, or with Protect computers from the console)?
    This is one of the few cases where using the tool to Fix problems that block programs from being installed or removed is perhaps your best option.

    Christian

  • 0 in reply to QC

    Hi QC, 

    Sorry late to reply , you are right , this machine is not first installed sophos endpoint .

    My customer uninstall sophos by himself. 

    If i using fix tool , any else need to know or important?

     

    Yuzen

  • 0 in reply to YuzenChen

    Hello Yuzen,

    please see here for some comments  regarding the tool.
    (customer uninstall (apparently not) sophos by himself in the light of this: Don't let your customer use this tool [:D], seriously -it's not for indiscriminate use) 

    Christian

  • 0 in reply to QC

    Hi QC, 

     

    OK, Today ,I'll try this tool and feedback the result .

    Thanks!

     

     

    Yuzen 

  • 0 in reply to YuzenChen

    Hi QC, 

     

    I delete all sophos component and re-install with SEC\SophosUpdate\CIDs\S001\SAVSCFXP\Setup.exe .

    then autoupdate agent will installed , but only SAVXP install failed. check Console is show this machine SAVXP install failed .

    I find log from temp sophos anti-virus major install log , the result is show:

    ==============================================================

    2017-06-14 12:04:37 ERROR: Installation failed
    2017-06-14 12:04:37 ERROR: SetupPlugin: Unable to get buffer size for Application registry key Path value.
    2017-06-14 12:04:37 ERROR: Failed to get current install location to register with tamper protection. Error 0x80070002

    ==============================================================

  • 0 in reply to YuzenChen

    Hello YuzenChen,

    this part of the log are just the final words, the last two are simply a consequence of the failed install.
    The install log is an MSI log, not too hard to understand but you'd have to read it correctly. If necessary please post the relevant parts, if you can't locate the error the complete log.  

    Christian

  • 0 in reply to QC

    2017-06-14 12:04:37 Unable to delete registry value: SOFTWARE\Sophos\AutoUpdate\UpdateStatus\CrtResult, assuming it does not exist
    2017-06-14 12:04:37 INFO: Unable to find the CRT directory, continuing with installation.
    2017-06-14 12:04:37 PROCESSOR_ARCHITECTURE environment variable is: AMD64
    2017-06-14 12:04:37 Info: Logging started: installing/upgrading Sophos Anti-Virus
    2017-06-14 12:04:37 Info: InstallFromPath is: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\
    2017-06-14 12:04:37 Info: InstallToPath is:
    2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {32C8E300-BDB4-4398-92C2-E9B7D8A233DB} with error code: 1608
    2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {2DBFEC23-B924-4B7A-A9DB-E08444E72C9B} with error code: 1608
    2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {6BADCD73-E925-46F7-A295-FF2448632728} with error code: 1608
    2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {9AC08E99-230B-47e8-9721-4577B7F124EA} with error code: 1608
    2017-06-14 12:04:37 Info: SAV is not installed. Installing to {InstallToPath}
    2017-06-14 12:04:37 INFO: Checking the validity of the VDL manifest file.
    2017-06-14 12:04:37 INFO: The manifest file has been successfully validated.
    2017-06-14 12:04:37 INFO: Checking the validity of the AppFeed manifest file.
    2017-06-14 12:04:37 INFO: The manifest file has been successfully validated.
    2017-06-14 12:04:37 Info: Managed install (from SAU)
    2017-06-14 12:04:37 Check for UI changes
    2017-06-14 12:04:37 Unable to QI IProductConfig
    2017-06-14 12:04:37 Info: productType: 0
    2017-06-14 12:04:37 Info: Performing major update of Sophos Anti-Virus using msi.
    2017-06-14 12:04:37 Info: Update is signalled.
    2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {32C8E300-BDB4-4398-92C2-E9B7D8A233DB} with error code: 1608
    2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {2DBFEC23-B924-4B7A-A9DB-E08444E72C9B} with error code: 1608
    2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {6BADCD73-E925-46F7-A295-FF2448632728} with error code: 1608
    2017-06-14 12:04:37 Call to MsiGetProductInfo failed for product {9AC08E99-230B-47e8-9721-4577B7F124EA} with error code: 1608
    2017-06-14 12:04:37 Info: Added SAVService to ServicesList.
    2017-06-14 12:04:37 Info: Added SAVAdminService to ServicesList.
    2017-06-14 12:04:37 Info: Added Sophos Device Control Service to ServicesList.
    2017-06-14 12:04:37 Info: Added SophosBootDriver to ServicesList.
    2017-06-14 12:04:37 Info: Added swi_service to ServicesList.
    2017-06-14 12:04:37 Info: Added swi_filter to ServicesList.
    2017-06-14 12:04:37 Info: Added Sophos Web Control Service to ServicesList.
    2017-06-14 12:04:37 Info: Added SAVOnAccess to ServicesList.
    2017-06-14 12:04:37 Info: component SAV is not registered - skipping.
    2017-06-14 12:04:37 Info: component SDC is not registered - skipping.
    2017-06-14 12:04:37 Info: component SCS is not registered - skipping.
    2017-06-14 12:04:37 Info: component SWI is not registered - skipping.
    2017-06-14 12:04:37 Info: component SWC is not registered - skipping.
    2017-06-14 12:04:37 UpdateVersionInfo(), SAU can't supply version info - using msi version
    2017-06-14 12:04:37 Info: PutSetupOptionsToRegistry
    2017-06-14 12:04:37 Info: Check MSXML
    2017-06-14 12:04:37 Info: Check boot driver and kms driver
    2017-06-14 12:04:37 Info: no existing installation of Sophos Anti-Virus was found
    2017-06-14 12:04:37 Info: Restart required for Data Control (clean managed full install)
    2017-06-14 12:04:37 Info: Transform file returned:
    2017-06-14 12:04:37 Info: SAV Setup plugin: running MsiInstallProduct (C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi, INSTALLDIR="" REBOOT=ReallySuppress UITYPE=full PRODUCTTYPE=0 UPDATEDRIVERS=1 UPDATECLASSFILTER=1 UPDATEBOOTDRIVERS=1 UPDATEKMSDRIVERS=1 SAVIONLY=0 MANAGED=1 RECOVERYMODE=0 DATACONTROL=1 DEVICECONTROL=1 WEBCONTROL=1)
    === Verbose logging started: 2017/6/14 12:04:37 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\ALUpdate.exe ===
    MSI (c) (6C:44) [12:04:37:863]: Resetting cached policy values
    MSI (c) (6C:44) [12:04:37:863]: Machine policy value 'Debug' is 0
    MSI (c) (6C:44) [12:04:37:863]: ******* RunEngine:
    ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
    ******* Action:
    ******* CommandLine: **********
    MSI (c) (6C:44) [12:04:37:863]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (6C:44) [12:04:37:863]: Grabbed execution mutex.
    MSI (c) (6C:44) [12:04:37:863]: Cloaking enabled.
    MSI (c) (6C:44) [12:04:37:863]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (6C:44) [12:04:37:879]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (78:58) [12:04:37:879]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
    MSI (s) (78:58) [12:04:37:879]: Grabbed execution mutex.
    MSI (s) (78:48) [12:04:37:879]: Resetting cached policy values
    MSI (s) (78:48) [12:04:37:879]: Machine policy value 'Debug' is 0
    MSI (s) (78:48) [12:04:37:879]: ******* RunEngine:
    ******* Product: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
    ******* Action:
    ******* CommandLine: **********
    MSI (s) (78:48) [12:04:37:879]: Machine policy value 'DisableUserInstalls' is 0
    MSI (s) (78:48) [12:04:37:879]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (78:48) [12:04:37:879]: SRSetRestorePoint skipped for this transaction.
    MSI (s) (78:48) [12:04:37:894]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
    MSI (s) (78:48) [12:04:37:894]: File will have security applied from OpCode.
    MSI (s) (78:48) [12:04:37:894]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi' against software restriction policy
    MSI (s) (78:48) [12:04:37:894]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi has a digital signature
    MSI (s) (78:48) [12:04:37:894]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi is permitted to run because the user token authorizes execution (system or service token).
    MSI (s) (78:48) [12:04:37:894]: MSCOREE not loaded loading copy from system32
    MSI (s) (78:48) [12:04:37:894]: End dialog not enabled
    MSI (s) (78:48) [12:04:37:894]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
    MSI (s) (78:48) [12:04:37:894]: Package we're running from ==> C:\WINDOWS\Installer\1967c.msi
    MSI (s) (78:48) [12:04:37:894]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2DBFEC23-B924-4B7A-A9DB-E08444E72C9B}'.
    MSI (s) (78:48) [12:04:37:894]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (78:48) [12:04:37:910]: Machine policy value 'DisablePatch' is 0
    MSI (s) (78:48) [12:04:37:910]: Machine policy value 'AllowLockdownPatch' is 0
    MSI (s) (78:48) [12:04:37:910]: Machine policy value 'DisableLUAPatching' is 0
    MSI (s) (78:48) [12:04:37:910]: Machine policy value 'DisableFlyWeightPatching' is 0
    MSI (s) (78:48) [12:04:37:910]: Looking for storage transform: 1028
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2205 2: 3: Patch
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _Tables 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _Columns 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Media 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: File 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: TRANSFORM: 'PatchPackage' table is missing or empty. No pre-transform fixup necessary.
    MSI (s) (78:48) [12:04:37:910]: TRANSFORM: Applying regular transform to database.
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _Tables 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _Columns 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _Validation 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: AdminExecuteSequence 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: AdminUISequence 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: AdvtExecuteSequence 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: AppId 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Binary 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Component 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Directory 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: CreateFolder 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: CustomAction 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: DuplicateFile 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: File 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: EventManifest 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: FeatureComponents 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Icon 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: InstallExecuteSequence 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: InstallUISequence 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Media 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: MsiFileHash 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: MsiServiceConfig 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: MsiShortcutProperty 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Registry 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: RemoveFile 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: RemoveRegistry 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: SecureObjects 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: ServiceControl 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: TextStyle 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: XmlFile 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: AppSearch 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: ModuleSignature 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: CompLocator 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: ModuleComponents 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: Signature 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: #_PatchCache 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: #_BaselineData 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: #_BaselineFile 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: #_BaselineCost 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2262 2: _MsiPatchTransformView 3: -2147287038
    MSI (s) (78:48) [12:04:37:910]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2DBFEC23-B924-4B7A-A9DB-E08444E72C9B}'.
    MSI (s) (78:48) [12:04:37:910]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (78:48) [12:04:37:910]: Transforms are not secure.
    MSI (s) (78:48) [12:04:37:910]: Transforming table Property.

    MSI (s) (78:48) [12:04:37:910]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\Sophos Anti-Virus Major Install Log_170614_040437.txt'.
    MSI (s) (78:48) [12:04:37:910]: Command Line: INSTALLDIR= REBOOT=ReallySuppress UITYPE=full PRODUCTTYPE=0 UPDATEDRIVERS=1 UPDATECLASSFILTER=1 UPDATEBOOTDRIVERS=1 UPDATEKMSDRIVERS=1 SAVIONLY=0 MANAGED=1 RECOVERYMODE=0 DATACONTROL=1 DEVICECONTROL=1 WEBCONTROL=1 CURRENTDIRECTORY=C:\WINDOWS\system32 CLIENTUILEVEL=3 MSICLIENTUSESEXTERNALUI=1 CLIENTPROCESSID=3692
    MSI (s) (78:48) [12:04:37:910]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{B11B63E0-A3EB-478A-AF04-AAE0B577AEB2}'.
    MSI (s) (78:48) [12:04:37:910]: Product Code passed to Engine.Initialize: '{2DBFEC23-B924-4B7A-A9DB-E08444E72C9B}'
    MSI (s) (78:48) [12:04:37:910]: Product Code from property table before transforms: '{2DBFEC23-B924-4B7A-A9DB-E08444E72C9B}'
    MSI (s) (78:48) [12:04:37:910]: Product Code from property table after transforms: '{2DBFEC23-B924-4B7A-A9DB-E08444E72C9B}'
    MSI (s) (78:48) [12:04:37:910]: Product not registered: beginning first-time install
    MSI (s) (78:48) [12:04:37:910]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
    MSI (s) (78:48) [12:04:37:910]: Product {2DBFEC23-B924-4B7A-A9DB-E08444E72C9B} is admin assigned: LocalSystem owns the publish key.
    MSI (s) (78:48) [12:04:37:910]: Product {2DBFEC23-B924-4B7A-A9DB-E08444E72C9B} is managed.
    MSI (s) (78:48) [12:04:37:910]: MSI_LUA: Credential prompt not required, user is an admin
    MSI (s) (78:48) [12:04:37:910]: PROPERTY CHANGE: Adding ProductState property. Its value is '1'.
    MSI (s) (78:48) [12:04:37:910]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (s) (78:48) [12:04:37:910]: Note: 1: 2720 2: 2
    MSI (s) (78:48) [12:04:37:910]: MSI_LUA: Elevation prompt disabled for silent installs
    MSI (s) (78:48) [12:04:37:910]: MainEngineThread is returning 1625
    MSI (s) (78:58) [12:04:37:910]: No System Restore sequence number for this installation.
    安裝被系統原則拒絕。請連絡您的系統管理員。
    C:\ProgramData\Sophos\AutoUpdate\cache\savxp\Sophos Anti-Virus.msi
    MSI (s) (78:58) [12:04:37:910]: User policy value 'DisableRollback' is 0
    MSI (s) (78:58) [12:04:37:910]: Machine policy value 'DisableRollback' is 0
    MSI (s) (78:58) [12:04:37:910]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (78:58) [12:04:37:910]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
    MSI (s) (78:58) [12:04:37:910]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
    MSI (s) (78:58) [12:04:37:910]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
    MSI (c) (6C:44) [12:04:37:910]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
    MSI (c) (6C:44) [12:04:37:910]: MainEngineThread is returning 1625
    === Verbose logging stopped: 2017/6/14 12:04:37 ===

    2017-06-14 12:04:37 ERROR: Installation failed
    2017-06-14 12:04:37 ERROR: SetupPlugin: Unable to get buffer size for Application registry key Path value.
    2017-06-14 12:04:37 ERROR: Failed to get current install location to register with tamper protection. Error 0x80070002

  • 0 in reply to YuzenChen

    Hello YuzenChen,

    the error is 1625, ERROR_INSTALL_PACKAGE_REJECTED and MSDN offers as description: with This installation is forbidden by system policy. Contact your system administrator.
    Apparently AutoUpdate and RMS did install, it's only SAV that fails? The MSI should correctly handle elevation, but there seems to be an issue with UAC/LUA, can't say why. Guess it does install on other PCs. Please contact Support directly, I've no idea what to do at the moment (but perhaps or have one). One more question - is UAC completely turned off (if it is turn it on)?

    Christian

  • 0 in reply to QC

    Hi QC, 

    Yes, Only SAV not installed, I've take a ticket with this case, UAC is not turned on . 

    Any update i will post here.

  • 0 in reply to YuzenChen

    Hello YuzenChen,

    likely won't resolve the issue and requires reboots but I'd try with at least the lowest level of UAC enabled.

    Christian

Unfiltered HTML