This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[Sophos Notification] Advisory: October 2018 Windows Update fails to install on Windows 8.1 with Fatal error C0000022.

Hi Community,

We have identified an issue in which the latest Windows Update KB4462926 will fail to install as the update attempts to change the security on the Image File Execution registry keys which we have protected using Sophos Endpoint Defense.

The error seen when the update fails is:

  • Fatal error C0000022 applying update operation 64948 of 66623 (\Regi...)

Applies to the following Sophos product(s) and version(s)

  • Central Windows Core Agent 2.1.2

The machine will fail to install the update and on a subsequent reboot, the machine will begin to boot loop.

Update: 12/10/2018

We have just released an update to Sophos Endpoint Defense with a fix for this issue. Sophos Core Agent will update to 2.1.3.

This update will trigger a reboot requirement however the reboot will not be required for the fix to be applied.

If you are using controlled or scheduled updating please ensure you amend this as per the below articles.

This is currently under investigation by Sophos Development

  • The only known workaround at this point in time is to boot the machine into Safe Mode and allow the update to complete. After the update completes in Safe Mode the issue will no longer occur.

This article will be updated when new information becomes available.



This thread was automatically locked due to age.
Parents
  • We have just released an update to Sophos Endpoint Defense with a fix for this issue. Sophos Core Agent will update to 2.1.3.

    This update will trigger a reboot requirement however the reboot will not be required for the fix to be applied.

    If you are using controlled or scheduled updating please ensure you amend this as per the below articles.

  • FWIW looks like this is back -- on a Windows 8.1 VM running the EDR EAP version of Sophos Endpoint / Intercept-X.  Is this a known issue?  Not sure of the version of Endpoint but it was updated earlier this month, that much I am sure of.  Attempting to fix the VM, will report back with specifics.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Sophos Platinum Partner

    --------------------------------------

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • Attached is a screenshot of where it's failing with the latest Windows 8.1 updates (this months)... different spot than the one in October (same thing happened to this VM in October and I repaired it then).

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Sophos Platinum Partner

    --------------------------------------

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • So more info; got into safe mode, update completed.  Version info of Sophos Endpoint:

    Updates that were installed that hung:

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Sophos Platinum Partner

    --------------------------------------

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • Just updated another VM (demo) with the same Beta Endpoint on it... same crash during reboot.

     

    Crashed in a different spot though (think it had a different stack of updates to install):

     

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Sophos Platinum Partner

    --------------------------------------

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • Hi  

    Thanks for following up to report your investigation. I'll raise this internally, but would it be possible to create a support case with the same information and PM me with your case ID for tracking.

    Regards,

    Flo


    Florentino
    Director, Global Community & Digital Support

    Are you a Sophos Partner? | Product Documentation@SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the 'Verify Answer' button.
    The Award-winning Home of Sophos Support Videos! - Visit Sophos Techvids
Reply Children