This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

"Restart needed for updates to take effect (0x000006d)"

We are seeing this error on 260 devices (increasing) on our network

Enterprise console 5.5.0

Has Sophos pumped out an update to cause this or is there some other reason ?

I have checked my own PC (Which is included in the ones at "error") and see absolutely no problem with my Sophos installation...

What is going on here ?



This thread was automatically locked due to age.
  • Hello Weeboo,

    10.8.1 would require a reboot (though I'd be surprised if they were already rolling it out). I'm not aware of any other reason for this status. What is the SAV version displayed (in the console or locally)?

    Christian

  • 10.8 by the looks of it !!

    Not 10.8.1 yet

  • Hello Weeboo,

    as expected (the status, not that's it already out [:D])

    Christian

  • So what should I do ?

    Bearing in mind that most devices are shut down overnight - but last time this error appeared (on about a dozen devices) - I was forced to do a reg mod to clear the error - there is no way that I can do this on 260 devices !!

  • Hello Weeboo,

    it's not really an error. Protection on the endpoint continues to work as it should (and did with 10.7.6) but new features or the latest version of a component might not be in effect until after the reboot. The messages will gradually go away - there's nothing you have to do.

    Christian

  • OK Fingers crossed that it clears some by tomorrow

    Thanks

  • We are down to 164 PC's today - showing the same error - after being switched off overnight

    I have selected ALL and "protected them" - a good hour ago and all are STILL showing a yellow cross on them on the console !!

    Something is up - but what is it ?

    And most importantly - are we protected ?

  • Hello Weeboo,

    a yellow cross - you mean the triangle  in the Alerts and errors column?
    If a previous update resulted in the warning Protect won't change the status, this warning is always issued after an install when there are certain new components or upgraded versions of them. Even if the Installer is repeatedly run it will detect that "old" components are still in use. In rare cases (but more than 100 doesn't count as rare) the VolatileFlags key isn't removed.
    Please note that Windows 8/10 computers with Fast Startup enabled don't actually reboot with a shutdown/start sequence.

    are we protected
    as said, yes - with the restriction that some components (e.g. HitmanPro.Alert) are not (fully) active after an initial install.

    Christian

  •  

    QC said:

    Hello Weeboo,

    a yellow cross - you mean the triangle  in the Alerts and errors column?
    If a previous update resulted in the warning Protect won't change the status, this warning is always issued after an install when there are certain new components or upgraded versions of them. Even if the Installer is repeatedly run it will detect that "old" components are still in use. In rare cases (but more than 100 doesn't count as rare) the VolatileFlags key isn't removed.
    Please note that Windows 8/10 computers with Fast Startup enabled don't actually reboot with a shutdown/start sequence.

    are we protected
    as said, yes - with the restriction that some components (e.g. HitmanPro.Alert) are not (fully) active after an initial install.

    Christian

     

    No - I meant in the status in the console - telling me that it is "updating" - when normally - when all is up-to-date and OK - It is Green !

  • Hello Weeboo,

    ah, I see.
    Some clarification: The green thingy  is not related to the up-to-date status, it means that to computer is connected, i.e. it's talking via RMS to the management server (naturally on order to send its update status the endpoint must connect thus you often see this icon and the Yes together - but a disconnected computer can be up to date as well). The yellow thingy  is an hourglass, you see it when SEC is trying to perform the Protect Computers steps on the endpoint, it does not indicate that the computer is updating. It stays for some time until either the endpoint calls in with its status indicating that Protect succeeded or the interval SEC is willing to wait has passed in which case you get an error message and the icon shows the disconnected  state.
    It's possible that these endpoints aren't switched on. If Fast Startup is enabled they will show as connected even if they are switched off as RMS isn't stopped by Windows and thus doesn't log off from the management server. You might want to check the Last message time shown in the Computer Details tab.

    Christian