This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failed to install Sophos Network Threat Protection Unexpected system error (0x00000067)

Hi,

Have a machine that fails at this point. Prior to this I followed the correct way to uninstall Sophos and followed it to the t, however it displays the following in the SEC. Any suggestions? I am unable to open the Sophos Client on the machine, it says "Internal Error 2719 . {788B9788-7F03-4A2B-8258-344C0278C33}

Thanks

SI (s) (C8:E0) [17:31:35:733]: Note: 1: 1708
MSI (s) (C8:E0) [17:31:35:733]: Transforming table Error.

MSI (s) (C8:E0) [17:31:35:733]: Transforming table Error.

MSI (s) (C8:E0) [17:31:35:733]: Produkt: Sophos Network Threat Protection -- Installation fehlgeschlagen.

MSI (s) (C8:E0) [17:31:35:734]: Das Produkt wurde durch Windows Installer installiert. Produktname: Sophos Network Threat Protection. Produktversion: 1.2.2.50. Produktsprache: 1031. Hersteller: Sophos Limited. Erfolg- bzw. Fehlerstatus der Installation: 1603.

MSI (s) (C8:E0) [17:31:35:734]: Deferring clean up of packages/files, if any exist
MSI (s) (C8:E0) [17:31:35:734]: MainEngineThread is returning 1603
MSI (s) (C8:7C) [17:31:35:735]: No System Restore sequence number for this installation.
=== Protokollierung beendet: 25.07.2017 17:31:35 ===
MSI (s) (C8:7C) [17:31:35:735]: User policy value 'DisableRollback' is 0
MSI (s) (C8:7C) [17:31:35:735]: Machine policy value 'DisableRollback' is 0
MSI (s) (C8:7C) [17:31:35:735]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (C8:7C) [17:31:35:735]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (C8:7C) [17:31:35:735]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (C8:7C) [17:31:35:736]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (C8:7C) [17:31:35:736]: Restoring environment variables
MSI (s) (C8:7C) [17:31:35:736]: Destroying RemoteAPI object.
MSI (s) (C8:84) [17:31:35:736]: Custom Action Manager thread ending.
MSI (c) (28:60) [17:31:35:736]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (28:60) [17:31:35:736]: MainEngineThread is returning 1603
=== Verbose logging stopped: 25.07.2017 17:31:35 ===

setup::MsiInstaller::installOrUpgrade: Install/upgrade returned 1603
`anonymous-namespace'::setResult: installation failed
ProductSetup::~ProductSetup: End product setup

This thread was automatically locked due to age.

0 jak over 6 years ago

Can you share the entire MSI log file?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 pdturbo80 over 6 years ago in reply to jak

As in the Network Threat Protection log file?
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to pdturbo80

Hello Peter,

the whole log that contains Produkt: Sophos Network Threat Protection -- Installation fehlgeschlagen or the relevant part. Although the Troubleshooting using MSI logs article suggests reading the log bottom-up the first encounter with an error message is in the summary section, sometimes it gives just the unspecific 1603. The actual location of the error in the install sequence (along with some details) is farther above.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 pdturbo80 over 6 years ago in reply to QC

Multitasking here on both threads :)

Here is the log Sophos Network Threat Protection Install Log.txt

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to pdturbo80

Hello Peter,

as far as I can see it's a 0x8007054f (meaning: internal error) running the command "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man". Found another thread mentioning sntp.man but a different issue. Dunno how to proceed but maybe jak has some idea.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 pdturbo80 over 6 years ago in reply to QC

Hi Christian,

Thanks, really odd one. I have done a full uninstall as per the Sophos KB a couple of times now. So kinda out of ideas on this.
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 6 years ago in reply to pdturbo80

I would run Process Monitor during the install.

Once captured, bring up the tree view and find the wevtutil.exe process. I assume the process is created for the install command, i.e.

wevtutil.exe im "C:\Program Files\Sophos\Sophos Network Threat Protection\bin\Sntp.man

Filter in that process id, scroll to the bottom to find the process exit event. What is the return code?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel