Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 7 replies
  • Answers 2 answers
  • Subscribers 5 subscribers
  • Views 60137 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Uninstalling the Sophos Management Server

TomMaxwell

Hi,

I'm attempting to uninstall the Sophos Management Server 5.2.1 from Windows Server 2012 R2 but the uninstaller only gets so far and then rolls back on itself.

I had been following: https://www.sophos.com/en-us/support/knowledgebase/116912.aspx

I realise this is intended for version 5.1 but I was just loosely following the order in which to uninstall the separate components.  However, when I get to the Management Server component it fails there and I'm just left with a some events in the Event Viewer saying the services like the sophos patch server communicator, sophos patch endpoint orchestrator, sophos patch endpoint communicator "were unable to log on as Domain\Sophosadmin with the currently configured password due to the following error: The user name or password is incorrect." with other associated events such as these services failed to start and terminated unexpectedly. 

I've attempted to reset the password for the SophosAdmin account and restart them, and they start again fine but when I run the uninstaller again the same things happen, they seem to forget the password and around in a loop it goes again.

I've looked around the various support documents but am unable to find any more detailed information on to try next.  Any help would be much appreciated.

Thanks

Tom



This thread was automatically locked due to age.
  • 0
    Just to add a little more on the configuration of this server. It's a virtual server running under VMware ESXi 5.5, and I did have a fair amount of trouble actually getting The Sophos Enterprise Console to work and login when I first installed it. I did spend some time on the phone with Sophos technical support, supplying the logs from the Sophos Diagnostic Utility and while they didn't actually manage to fix the problem for me directly and the support on the issue eventually seemed to slow down and dry up, in the end I did manage to get it working only after fiddling around with things for a number of days, it eventually decided to login correctly. At the time it did appear to be some sort of network issue. Perhaps something to do with the hypervisor.

    I guess it's also worth mentioning that they do advise that it's not recommended to install the enterprise console on the server.

    I have again run the SDU and it collects a huge amount of logging information. Perhaps someone could just give me a hint of where to start with that? What log to start looking at first?

    Again, thanks for any help anyone might be able to provide.

    Tom
  • 0 in reply to TomMaxwell

    Hello Tom,

    the (Un-)Installer should (haven't uninstalled lately and can't test right now) write a log - usually in your %TEMP% directory. The details of the error which causes the uninstall to fail would be logged there. MSIxxxx.log logs are not collected by SDU.

    Christian

  • 0 in reply to QC
    I took a look through some of the MSI logs in the temp folder and they seemed to be pointing out that it was still the update manager that couldn't be uninstalled because its in use by the management server which is what I'm trying to uninstall. I was also looking around various program files directories and found a few where I needed to grant myself permission which I did. I ran the uninstaller again in order to see if I could get some updated log information but the particular MSI logs I'm looking at didn't seem to update at all so I'm not entirely sure I'm looking at the right ones. However, the uninstall process did seem to have progressed on slightly. I noticed that one service had been marked for deletion (The Sophos management service) and 2 others, ones I mentioned before (the patch endpoint communicator and the patch server communicator) have actually disabled themselves.

    I need to spend a bit more time looking for the correct logs that show the uninstaller info but I also have some other stuff pending on this server now and I'm waiting for a window to reboot it too. It will be a week or so until I can get to that.

    Hopefully I can just keep progressing with this slowly and eventually remove the software cleanly. As of now these 2 components aren't actually causing me problems, just something I'd like to remove as they aren't in use. Thanks for the help so far.
  • 0 in reply to TomMaxwell
    Hello, I had this problem too. Logging in as the 'administrator' account and then performing the uninstall worked for me. I guess that it was originally installed using that account.

    Hope that helps!
  • 0 in reply to TomMaxwell
    I ended up disabling all the services relating to Sophos restarting the servers and then it didn't say it was locked.. If you can restart the server this might be worth trying?
  • +1

    What ended up doing the trick for me was running the removal through an elevated command prompt.  

    You'll need to know the uninstall string beforehand though.  To get this (on 64-bit OS architecture):

    1. Launch and elevated command prompt, and open the registry editor (regedit.exe).  
    2. Navigate to the following registry key:   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall 
    3. Scroll through the keys, look looking for the "Display Name" string that has a value of "Sophos Management Server".  Open the "UninstallString" value and copy the contents.  
    4. Return or open a new elevated command prompt, and paste the string value copied from Step 2.  Validate the command is correct before execution!  Once validated, execute the removal and follow the on-screen prompt to complete the removal.  
    5. After completion, verify the program has been removed by launching the Programs and Features window through the Control Panel or appwiz.cpl at the command prompt. Once verified that it no longer appears on the list of programs, reboot the server to complete the removal.  
  • 0 in reply to NicBanks

    Just had a similar issue trying to uninstall Sophos Management Server 5.5 from Server 2012 R2. 

    Was failing with a Spring.NET 0x80040154 - Class not registered error. 

    Found a Sophos KB that recommended running a repair on .net but running the uninstall from an elevated command prompt resolved.

    Thanks

    Asim

Unfiltered HTML