This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

"Restart needed for updates to take effect"

We are seeing large numbers of devices with this error on our network on the Enterprise console

What is the solution because when I remotely reboot the devices - the error remains !!



This thread was automatically locked due to age.
Parents
  • Hello Weeboo,

    there's this one article about a persistent restart message.  Has there been an upgrade or some other change recently?

    Christian

  • No - nothing has changed - just the ever increasing numbers of endpoints with this error

    I first noticed the error about a month ago - the numbers are increasing daily now !

    Enterprise console 5.5.0

    Endpoints 10.7

  • Hello Weeboo,

    might or might not actually be a Sophos issue, Windows does not show that a reboot is required, does it? In this case there'd be the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired key.

    If you can identify an endpoint that has "just" started to display this message please check the ALUpdate logs, this will perhaps indicate what triggers this status. IIRC the log will mention the VolatileFlags key if it's involved.
    Also check the PendingFileRenameOperations value under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager though AFAIK it isn't taken into account on "minor" updates. When a Sophos component (e.g. SAVXP) "recommends" a reboot it should appear around the same time for all endpoints, but nevertheless you could also check the installation logs in %windir%\Temp.

    Christian

  • I had a similar problem after Every Hitman Pro Update, However my scenario was 

    ==> Windows 10 Systems ==> Overall 4000+ Errors ==> Only Restart Event Fixed the error Whenever PC Was Shutdown and Turned Back On==> Error Stayed Back

    Then Someone was Kind enough to let me know the FAST START UP Option on Windows 10 and How it Conflicted With HITMAN PRO (HitmanPro uses a kernel mode driver) and Fast Startup Puts the PC ON Sleep Mode During Shutdown and not really Reload the OS from Scratch for kernel Drivers to Reload and HMPRO Upgrade to Complete

    https://support.microsoft.com/en-us/help/4011287/windows-updates-not-install-with-fast-startup

    https://www.wintips.org/how-to-turn-off-fast-startup-in-windows-10-8-and-8-1/

     

    I Disabled Fast Startup via GP on Systems and Errors were down to 10% from 70% and they are still going DOWN.

     

    I Hope This Helps In Case You have a Same problem.

     

    1. Please RESTART a SYSTEM From Start Menu and Check (Do Not SHUTDOWN & TURN ON)

    2. Check Sophos HitmanPro Alert install(%windir%\Temp\

  • OK Update time ...........

    Tried this :

    If the 'Restart needed' message does not disappear following a restart of the endpoint

    If the computer is still requesting a restart, then manually remove the following 'VolatileFlags' registry key and then force an 'Update now':

    •  
      • 32-bit: HKLM\Software\Sophos\AutoUpdate\UpdateStatus\VolatileFlags
      • 64-bit: HKLM\Software\Wow6432Node\Sophos\AutoUpdate\UpdateStatus\VolatileFlags

    Note: Removal of these registry keys does not remove the requirement for a reboot and should only be done if the 'Restart needed' message has not cleared following a restart of the computer.

     

    This doesn't work either - half of the devices that I am accessing to modify the registry (as Admin) on - are already missing this particular registry key (Volatileflags) !!

    What does this mean ?

  • Hello Weeboo,

    as mentioned if it stubbornly persists you'd have to check the logs.
    The (verbose) ALUpdate log might have an associated message, if it's not clear from it which component requests the restart you'd have to check the Install logs in %windir%\Temp\.

    Christian

Reply
  • Hello Weeboo,

    as mentioned if it stubbornly persists you'd have to check the logs.
    The (verbose) ALUpdate log might have an associated message, if it's not clear from it which component requests the restart you'd have to check the Install logs in %windir%\Temp\.

    Christian

Children
  • QC said:

    Hello Weeboo,

    as mentioned if it stubbornly persists you'd have to check the logs.
    The (verbose) ALUpdate log might have an associated message, if it's not clear from it which component requests the restart you'd have to check the Install logs in %windor%Temp\.

    Christian

     

     

    OK Have managed to run REGEDIT and have removed the VOLATILEFLAGS keys from 2 PCs and have run UPDATE with no change in the error state of either of them

    They are both still showing "Restart needed for updates to take effect............." after 24 hours of waiting !!

    What else can I try ?

  • Hello Weeboo,

    as said it's then necessary to check the install and uninstall logs in the Temp directory to determine which component is the cause.

    Christian

  • QC said:

    Hello Weeboo,

    as said it's then necessary to check the install and uninstall logs in the Temp directory to determine which component is the cause.

    Christian

     

    Do you mean running AlUpdate.exe ?

    Tried that - no effect !!

  • Hello Weeboo,

    you don't have to run anything - it has already run often enough. Please check the logs.
    In %ProgramData%\Sophos\AutoUpdate\Logs\ are the ALUpdate201803....logs. In some cases (e.g. when VolatileFlags is present) they can tell the reason for the Reboot required ... message. In other cases an installation log (e.g. Sophos Endpoint Defense Setup ....log in \Windows\Temp\) indicates this requirement (in SED's case it says: WARNING : A reboot is required for the upgrade/downgrade to take effect).

    Christian

  • OK Got them - Error=0 in all cases and no "Warnings" either

    This unfortunately doesn't really help

  • Hello Weeboo,

    I'm afraid I have run out of suggestions in this case. You'd have to open a ticket with Support so that they can rummage through the SDU logs, They should have some idea what else could be the cause of this message.

    Christian

  • Thanks Christian,

    I have submitted a case to Support

    Have a good day