Some sophos services not running after update

I need some help in tackling this issue with Sophos cloud endpoint protection. Whenever there is a component update with sophos, i can see atleast 5 -10 pc's in the cloud portal missing (not running) some services. Some services include Sophos System Protection Service, Sophos Web Control Service. What is the easiest way to get round this issue. Does sophos expect the sysadmin to go to the pc everytime whenever this occurs and take logs and send it to the tech team for resolution. I have tried remotely connecting to the pc and restarting the services but this doesnt seem to work always. Can someone throw some light on this so it makes life easy for people maintaining endpoints. 

  • If the services are lost/removed as part of the upgrade, the MSI log and if available, the associated custom action log file would need to be checked.

    These would be under \windows\temp\.

    Do you have any logs from a time where the services have been lost?

    As a recovery method, you could try deleting the file SophosUpdateStatus.xml from \programdata\sophos\autoupdate\data\status\ and then kick off an update or wait for the next scheduled one.

    Regards,

    Jak

  • This information would be very useful! I have many PC's that stop running a serive after updates, I have not noticed a trend, and the only way to get it back is a reinstall. There has to be something we can do!

  • In reply to skouki:

    Have a look at this thread, That is how I get around it 

    community.sophos.com/.../349490

  • In reply to skouki:

    What are the services that aren't running? 

    Presumably they are present when you run services.msc but not started?

    From there we know which install logs to check as we'll know what component is having the issue.

  • In reply to jak:

    They were installed and working, but shows up like this in our dashboard. 

    The two that seem to keep reappearing are

    •  Sophos System Protection Service
    •  Sophos Device Encryption Service

  • In reply to skouki:

    OK, When you look at the client's services in services.msc, is the service is present and starts fine?

    You can actually tell from Sophos Central if the service is missing or just stopped.  From the developer tools of the browser - F12.  If you filter to XHR requests and maybe add a filter for requests that contain:

    get_health_status=true

    With this setup, when you're on the device page that shows the services, refresh the page and you can see the API result for the computer details. 

    In the "Preview" tab you can expand the services status:



    Where:
    2 = the service is missing
    1 = the service is stopped
    0 = the service is started

    On the client, the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\[WOW6432Node]\Sophos\Health\Status has the same values as this is the state the Health service, Health.exe last recorded for the services.

    The log file of the SSP component is:

    C:\ProgramData\Sophos\Sophos System Protection\Logs\SSP.log

    that might be interesting to see as it has when the process started and stopped.

    I 10/10/2017 20:55:52 Process starting
    I 10/10/2017 20:55:52 Service start requested
    I 10/10/2017 20:55:52 Sophos System Protection 2.6.0.71
    I 10/10/2017 20:56:00 The service has been requested to stop
    I 10/10/2017 20:56:00 Process stopping
    I 10/10/2017 20:56:00 Sophos System Protection is shutting down (0)
    I 10/10/2017 20:56:00 The Sophos System Protection service has stopped

    When did it last stop?  What did that co-incide with?  Maybe an update to the component? The log file of the install for this component would be:

    \windows\temp\SophosSystemProtectionSetup_[timestamp]log

    Regards,

    Jak

  • In reply to jak:

    The services are there and they have just stopped. I am able to go in our console and manually start the service again. I make sure to set it back to automatic, but it would be nice to see why these services are stopping to prevent it happening in the future. Here are the logs I was able to grab from one of the machines that was having this issue. 

     

    I 21/08/2017 14:56:35 Process starting
    I 21/08/2017 14:56:35 Service start requested
    I 21/08/2017 14:56:35 Sophos System Protection 2.6.0.71
    I 21/08/2017 14:56:35 HST: Database not found, creating
    I 21/08/2017 14:56:37 HST: Created database
    I 21/08/2017 14:58:16 The service has been requested to stop
    I 21/08/2017 14:58:16 Process stopping
    I 21/08/2017 14:58:16 Sophos System Protection is shutting down (0)
    I 21/08/2017 14:58:16 The Sophos System Protection service has stopped
    I 21/08/2017 14:58:16 Process starting
    I 21/08/2017 14:58:16 Service start requested
    I 21/08/2017 14:58:16 Sophos System Protection 2.6.0.71
    I 21/08/2017 15:00:47 The service has been requested to stop
    I 21/08/2017 15:00:47 Process stopping
    I 21/08/2017 15:00:47 Sophos System Protection is shutting down (0)
    I 21/08/2017 15:00:47 The Sophos System Protection service has stopped
    I 21/08/2017 15:00:47 Process starting
    I 21/08/2017 15:00:47 Service start requested
    I 21/08/2017 15:00:47 Sophos System Protection 2.6.0.71
    I 21/08/2017 15:00:53 The service has been requested to stop
    I 21/08/2017 15:00:53 Process stopping
    I 21/08/2017 15:00:53 Sophos System Protection is shutting down (0)
    I 21/08/2017 15:00:53 The Sophos System Protection service has stopped
    I 21/08/2017 15:00:53 Process starting
    I 21/08/2017 15:00:53 Service start requested
    I 21/08/2017 15:00:53 Sophos System Protection 2.6.0.71
    I 15/09/2017 07:48:36 Process starting
    I 15/09/2017 07:48:36 Service start requested
    I 15/09/2017 07:48:38 Sophos System Protection 2.6.0.71
    I 15/09/2017 08:03:09 Process starting
    I 15/09/2017 08:03:09 Service start requested
    I 15/09/2017 08:03:11 Sophos System Protection 2.6.0.71
    I 15/09/2017 17:51:15 Process starting
    I 15/09/2017 17:51:15 Service start requested
    I 15/09/2017 17:51:19 Sophos System Protection 2.6.0.71
    I 05/10/2017 08:03:19 Process starting
    I 05/10/2017 08:03:19 Service start requested
    I 05/10/2017 08:03:23 Sophos System Protection 2.6.0.71

  • In reply to jak:

    This is the log for the install, it is a little longer....

     

     

    2017-08-21 14:56:32 Info: New MSI has product code: {934BEF80-B9D1-4A86-8B42-D8A6716A8D27} version: 2.6.0.71
    2017-08-21 14:56:32 Successfully requested Sophos Endpoint Defense disable tamper protection of SSP.
    2017-08-21 14:56:32 Info: SSP is not installed
    2017-08-21 14:56:32 Info: Installing C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\SophosSystemProtection.msi with command: INSTALLDIR="" INSTALLINGVERSION=2.6.0.71 REBOOT=ReallySuppress ARPSYSTEMCOMPONENT=1
    === Verbose logging started: 8/21/2017 14:56:32 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\SophosUpdate.exe ===
    MSI (c) (B0:8C) [14:56:32:643]: Resetting cached policy values
    MSI (c) (B0:8C) [14:56:32:643]: Machine policy value 'Debug' is 0
    MSI (c) (B0:8C) [14:56:32:643]: ******* RunEngine:
    ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\SophosSystemProtection.msi
    ******* Action:
    ******* CommandLine: **********
    MSI (c) (B0:8C) [14:56:32:643]: Client-side and UI is none or basic: Running entire install on the server.
    MSI (c) (B0:8C) [14:56:32:644]: Grabbed execution mutex.
    MSI (c) (B0:8C) [14:56:32:645]: Cloaking enabled.
    MSI (c) (B0:8C) [14:56:32:645]: Attempting to enable all disabled privileges before calling Install on Server
    MSI (c) (B0:8C) [14:56:32:645]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (BC:38) [14:56:32:649]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\SophosSystemProtection.msi
    MSI (s) (BC:38) [14:56:32:649]: Grabbed execution mutex.
    MSI (s) (BC:10) [14:56:32:651]: Resetting cached policy values
    MSI (s) (BC:10) [14:56:32:651]: Machine policy value 'Debug' is 0
    MSI (s) (BC:10) [14:56:32:651]: ******* RunEngine:
    ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\SophosSystemProtection.msi
    ******* Action:
    ******* CommandLine: **********
    MSI (s) (BC:10) [14:56:32:651]: Machine policy value 'DisableUserInstalls' is 0
    MSI (s) (BC:10) [14:56:32:651]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (BC:10) [14:56:32:651]: SRSetRestorePoint skipped for this transaction.
    MSI (s) (BC:10) [14:56:32:651]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2
    MSI (s) (BC:10) [14:56:32:651]: File will have security applied from OpCode.
    MSI (s) (BC:10) [14:56:32:651]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\SophosSystemProtection.msi' against software restriction policy
    MSI (s) (BC:10) [14:56:32:651]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\SophosSystemProtection.msi has a digital signature
    MSI (s) (BC:10) [14:56:32:651]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\SophosSystemProtection.msi is permitted to run because the user token authorizes execution (system or service token).
    MSI (s) (BC:10) [14:56:32:651]: MSCOREE not loaded loading copy from system32
    MSI (s) (BC:10) [14:56:32:651]: End dialog not enabled
    MSI (s) (BC:10) [14:56:32:651]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\SophosSystemProtection.msi
    MSI (s) (BC:10) [14:56:32:651]: Package we're running from ==> C:\WINDOWS\Installer\24e5c22b.msi
    MSI (s) (BC:10) [14:56:32:651]: APPCOMPAT: Compatibility mode property overrides found.
    MSI (s) (BC:10) [14:56:32:651]: APPCOMPAT: looking for appcompat database entry with ProductCode '{934BEF80-B9D1-4A86-8B42-D8A6716A8D27}'.
    MSI (s) (BC:10) [14:56:32:651]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (BC:10) [14:56:32:677]: Machine policy value 'TransformsSecure' is 0
    MSI (s) (BC:10) [14:56:32:677]: User policy value 'TransformsAtSource' is 0
    MSI (s) (BC:10) [14:56:32:677]: Machine policy value 'DisablePatch' is 0
    MSI (s) (BC:10) [14:56:32:677]: Machine policy value 'AllowLockdownPatch' is 0
    MSI (s) (BC:10) [14:56:32:677]: Machine policy value 'DisableLUAPatching' is 0
    MSI (s) (BC:10) [14:56:32:677]: Machine policy value 'DisableFlyWeightPatching' is 0
    MSI (s) (BC:10) [14:56:32:677]: APPCOMPAT: looking for appcompat database entry with ProductCode '{934BEF80-B9D1-4A86-8B42-D8A6716A8D27}'.
    MSI (s) (BC:10) [14:56:32:677]: APPCOMPAT: no matching ProductCode found in database.
    MSI (s) (BC:10) [14:56:32:677]: Transforms are not secure.
    MSI (s) (BC:10) [14:56:32:677]: Note: 1: 2205 2: 3: Control
    MSI (s) (BC:10) [14:56:32:677]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\WINDOWS\TEMP\SophosSystemProtectionSetup_170821_095632.log'.
    MSI (s) (BC:10) [14:56:32:677]: Command Line: INSTALLDIR= INSTALLINGVERSION=2.6.0.71 REBOOT=ReallySuppress ARPSYSTEMCOMPONENT=1 CURRENTDIRECTORY=C:\WINDOWS\system32 CLIENTUILEVEL=3 CLIENTPROCESSID=4016
    MSI (s) (BC:10) [14:56:32:677]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{87CFF70C-FF71-4317-897A-843822E95859}'.
    MSI (s) (BC:10) [14:56:32:677]: Product Code passed to Engine.Initialize: ''
    MSI (s) (BC:10) [14:56:32:677]: Product Code from property table before transforms: '{934BEF80-B9D1-4A86-8B42-D8A6716A8D27}'
    MSI (s) (BC:10) [14:56:32:677]: Product Code from property table after transforms: '{934BEF80-B9D1-4A86-8B42-D8A6716A8D27}'
    MSI (s) (BC:10) [14:56:32:677]: Product not registered: beginning first-time install
    MSI (s) (BC:10) [14:56:32:677]: Product {934BEF80-B9D1-4A86-8B42-D8A6716A8D27} is not managed.
    MSI (s) (BC:10) [14:56:32:677]: MSI_LUA: Credential prompt not required, user is an admin
    MSI (s) (BC:10) [14:56:32:677]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
    MSI (s) (BC:10) [14:56:32:677]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (s) (BC:10) [14:56:32:677]: User policy value 'SearchOrder' is 'nmu'
    MSI (s) (BC:10) [14:56:32:677]: Adding new sources is allowed.
    MSI (s) (BC:10) [14:56:32:677]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
    MSI (s) (BC:10) [14:56:32:677]: Package name extracted from package path: 'SophosSystemProtection.msi'
    MSI (s) (BC:10) [14:56:32:677]: Package to be registered: 'SophosSystemProtection.msi'
    MSI (s) (BC:10) [14:56:32:677]: Note: 1: 2262 2: AdminProperties 3: -2147287038
    MSI (s) (BC:10) [14:56:32:677]: Machine policy value 'DisableMsi' is 0
    MSI (s) (BC:10) [14:56:32:677]: Machine policy value 'AlwaysInstallElevated' is 0
    MSI (s) (BC:10) [14:56:32:677]: User policy value 'AlwaysInstallElevated' is 0
    MSI (s) (BC:10) [14:56:32:677]: Product installation will be elevated because user is admin and product is being installed per-machine.
    MSI (s) (BC:10) [14:56:32:677]: Running product '{934BEF80-B9D1-4A86-8B42-D8A6716A8D27}' with elevated privileges: Product is assigned.
    MSI (s) (BC:10) [14:56:32:677]: PROPERTY CHANGE: Adding INSTALLINGVERSION property. Its value is '2.6.0.71'.
    MSI (s) (BC:10) [14:56:32:693]: PROPERTY CHANGE: Adding REBOOT property. Its value is 'ReallySuppress'.
    MSI (s) (BC:10) [14:56:32:693]: PROPERTY CHANGE: Adding ARPSYSTEMCOMPONENT property. Its value is '1'.
    MSI (s) (BC:10) [14:56:32:693]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\WINDOWS\system32'.
    MSI (s) (BC:10) [14:56:32:693]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
    MSI (s) (BC:10) [14:56:32:693]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '4016'.
    MSI (s) (BC:10) [14:56:32:693]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
    MSI (s) (BC:10) [14:56:32:693]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
    MSI (s) (BC:10) [14:56:32:693]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
    MSI (s) (BC:10) [14:56:32:693]: TRANSFORMS property is now:
    MSI (s) (BC:10) [14:56:32:693]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favorites
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Documents
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\ProgramData
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Local
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Pictures
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
    MSI (s) (BC:10) [14:56:32:693]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
    MSI (s) (BC:10) [14:56:32:693]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
    MSI (s) (BC:10) [14:56:32:709]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
    MSI (s) (BC:10) [14:56:32:709]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
    MSI (s) (BC:10) [14:56:32:709]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
    MSI (s) (BC:10) [14:56:32:709]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (s) (BC:10) [14:56:32:709]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'bkiadmin'.
    MSI (s) (BC:10) [14:56:32:709]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
    MSI (s) (BC:10) [14:56:32:709]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\WINDOWS\Installer\24e5c22b.msi'.
    MSI (s) (BC:10) [14:56:32:709]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\SophosSystemProtection.msi'.
    MSI (s) (BC:10) [14:56:32:709]: Machine policy value 'MsiDisableEmbeddedUI' is 0
    MSI (s) (BC:10) [14:56:32:709]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
    MSI (s) (BC:10) [14:56:32:709]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (BC:10) [14:56:32:709]: Machine policy value 'DisableRollback' is 0
    MSI (s) (BC:10) [14:56:32:709]: User policy value 'DisableRollback' is 0
    MSI (s) (BC:10) [14:56:32:709]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
    === Logging started: 8/21/2017 14:56:32 ===
    MSI (s) (BC:10) [14:56:32:709]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (BC:10) [14:56:32:709]: APPCOMPAT: [DetectVersionLaunchCondition] Launch condition already passes.
    MSI (s) (BC:10) [14:56:32:709]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
    MSI (s) (BC:10) [14:56:32:709]: Doing action: INSTALL
    MSI (s) (BC:10) [14:56:32:709]: Note: 1: 2205 2: 3: ActionText
    Action start 14:56:32: INSTALL.
    MSI (s) (BC:10) [14:56:32:709]: Running ExecuteSequence
    MSI (s) (BC:10) [14:56:32:709]: Doing action: FindRelatedProducts
    MSI (s) (BC:10) [14:56:32:709]: Note: 1: 2205 2: 3: ActionText
    Action start 14:56:32: FindRelatedProducts.
    MSI (s) (BC:10) [14:56:32:709]: Doing action: LaunchConditions
    MSI (s) (BC:10) [14:56:32:709]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: FindRelatedProducts. Return value 1.
    Action start 14:56:32: LaunchConditions.
    MSI (s) (BC:10) [14:56:32:709]: Doing action: ValidateProductID
    MSI (s) (BC:10) [14:56:32:709]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: LaunchConditions. Return value 1.
    Action start 14:56:32: ValidateProductID.
    MSI (s) (BC:10) [14:56:32:709]: Skipping action: TamperProtectionCheckRemove (condition is false)
    MSI (s) (BC:10) [14:56:32:709]: Doing action: CostInitialize
    MSI (s) (BC:10) [14:56:32:709]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: ValidateProductID. Return value 1.
    MSI (s) (BC:10) [14:56:32:709]: Machine policy value 'MaxPatchCacheSize' is 10
    MSI (s) (BC:10) [14:56:32:709]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'C:\'.
    MSI (s) (BC:10) [14:56:32:709]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'.
    MSI (s) (BC:10) [14:56:32:714]: Note: 1: 2205 2: 3: Patch
    MSI (s) (BC:10) [14:56:32:714]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (BC:10) [14:56:32:714]: Note: 1: 2205 2: 3: MsiPatchHeaders
    MSI (s) (BC:10) [14:56:32:714]: Note: 1: 2205 2: 3: __MsiPatchFileList
    MSI (s) (BC:10) [14:56:32:714]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (BC:10) [14:56:32:714]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId`
    MSI (s) (BC:10) [14:56:32:714]: Note: 1: 2205 2: 3: Patch
    Action start 14:56:32: CostInitialize.
    MSI (s) (BC:10) [14:56:32:714]: Doing action: FileCost
    MSI (s) (BC:10) [14:56:32:714]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: CostInitialize. Return value 1.
    MSI (s) (BC:10) [14:56:32:715]: Note: 1: 2205 2: 3: MsiAssembly
    MSI (s) (BC:10) [14:56:32:715]: Note: 1: 2205 2: 3: Class
    MSI (s) (BC:10) [14:56:32:715]: Note: 1: 2205 2: 3: Extension
    MSI (s) (BC:10) [14:56:32:715]: Note: 1: 2205 2: 3: TypeLib
    Action start 14:56:32: FileCost.
    MSI (s) (BC:10) [14:56:32:715]: Doing action: CostFinalize
    MSI (s) (BC:10) [14:56:32:715]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: FileCost. Return value 1.
    MSI (s) (BC:10) [14:56:32:715]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'.
    MSI (s) (BC:10) [14:56:32:715]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'.
    MSI (s) (BC:10) [14:56:32:715]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'.
    MSI (s) (BC:10) [14:56:32:715]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'.
    MSI (s) (BC:10) [14:56:32:715]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'.
    MSI (s) (BC:10) [14:56:32:715]: Note: 1: 2205 2: 3: Patch
    MSI (s) (BC:10) [14:56:32:715]: Note: 1: 2205 2: 3: Condition
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'C:\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 property. Its value is 'C:\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding Sophos property. Its value is 'C:\Program Files\Sophos\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding INSTALLDIRSDR property. Its value is 'C:\Program Files\Sophos\Sophos Data Recorder\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\Sophos\Sophos System Protection\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding AppDataSophos property. Its value is 'C:\ProgramData\Sophos\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding AppDataSDR property. Its value is 'C:\ProgramData\Sophos\Sophos Data Recorder\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding DataTempSDR property. Its value is 'C:\ProgramData\Sophos\Sophos Data Recorder\temp\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding DataOutboundSDR property. Its value is 'C:\ProgramData\Sophos\Sophos Data Recorder\outbound\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding DataLogsSDR property. Its value is 'C:\ProgramData\Sophos\Sophos Data Recorder\logs\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding DataDataSDR property. Its value is 'C:\ProgramData\Sophos\Sophos Data Recorder\data\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding DataConfigurationSDR property. Its value is 'C:\ProgramData\Sophos\Sophos Data Recorder\configuration\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding DataCommandsSDR property. Its value is 'C:\ProgramData\Sophos\Sophos Data Recorder\commands\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding AppDataSsp property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding Logs property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Logs\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding Config property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Config\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding Rules property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding Data property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding Events property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data\Events\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding EventsCloudIncomingQueue property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data\Events\CloudIncomingQueue\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding EventsCloudOutgoingQueue property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data\Events\CloudOutgoingQueue\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding EventsStaging property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data\Events\Staging\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding DataSavedData property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data\Saved Data\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding Datasnapshot property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data\Snapshots\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding DataRCA property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data\RCA\'.
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding DataHealth property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data\Health\'.
    MSI (s) (BC:10) [14:56:32:716]: Target path resolution complete. Dumping Directory table...
    MSI (s) (BC:10) [14:56:32:716]: Note: target paths subject to change (via custom actions or browsing)
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: TARGETDIR , Object: C:\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: WindowsFolder , Object: C:\WINDOWS\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: ProgramFilesFolder , Object: C:\Program Files (x86)\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: ProgramFiles64Folder , Object: C:\Program Files\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: Sophos , Object: C:\Program Files\Sophos\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: INSTALLDIRSDR , Object: C:\Program Files\Sophos\Sophos Data Recorder\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: INSTALLDIR , Object: C:\Program Files\Sophos\Sophos System Protection\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: CommonAppDataFolder , Object: C:\ProgramData\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: AppDataSophos , Object: C:\ProgramData\Sophos\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: AppDataSDR , Object: C:\ProgramData\Sophos\Sophos Data Recorder\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: DataTempSDR , Object: C:\ProgramData\Sophos\Sophos Data Recorder\temp\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: DataOutboundSDR , Object: C:\ProgramData\Sophos\Sophos Data Recorder\outbound\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: DataLogsSDR , Object: C:\ProgramData\Sophos\Sophos Data Recorder\logs\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: DataDataSDR , Object: C:\ProgramData\Sophos\Sophos Data Recorder\data\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: DataConfigurationSDR , Object: C:\ProgramData\Sophos\Sophos Data Recorder\configuration\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: DataCommandsSDR , Object: C:\ProgramData\Sophos\Sophos Data Recorder\commands\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: AppDataSsp , Object: C:\ProgramData\Sophos\Sophos System Protection\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: Logs , Object: C:\ProgramData\Sophos\Sophos System Protection\Logs\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: Config , Object: C:\ProgramData\Sophos\Sophos System Protection\Config\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: Rules , Object: C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: Data , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: Events , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\Events\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: EventsCloudIncomingQueue , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\Events\CloudIncomingQueue\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: EventsCloudOutgoingQueue , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\Events\CloudOutgoingQueue\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: EventsStaging , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\Events\Staging\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: DataSavedData , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\Saved Data\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: Datasnapshot , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\Snapshots\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: DataRCA , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\RCA\
    MSI (s) (BC:10) [14:56:32:716]: Dir (target): Key: DataHealth , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\Health\
    MSI (s) (BC:10) [14:56:32:716]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'.
    MSI (s) (BC:10) [14:56:32:716]: Note: 1: 2205 2: 3: MsiAssembly
    MSI (s) (BC:10) [14:56:32:716]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?
    Action start 14:56:32: CostFinalize.
    MSI (s) (BC:10) [14:56:32:717]: Doing action: SetRegisterWithAutoUpdate
    MSI (s) (BC:10) [14:56:32:717]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: CostFinalize. Return value 1.
    MSI (s) (BC:10) [14:56:32:717]: PROPERTY CHANGE: Adding RegisterWithAutoUpdate property. Its value is '{F8FFD42E-47AC-4CFF-9E27-EC84ED62128E};ssp;'.
    Action start 14:56:32: SetRegisterWithAutoUpdate.
    MSI (s) (BC:10) [14:56:32:717]: Doing action: MigrateFeatureStates
    MSI (s) (BC:10) [14:56:32:717]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: SetRegisterWithAutoUpdate. Return value 1.
    Action start 14:56:32: MigrateFeatureStates.
    MSI (s) (BC:10) [14:56:32:718]: Doing action: InstallValidate
    MSI (s) (BC:10) [14:56:32:718]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: MigrateFeatureStates. Return value 0.
    MSI (s) (BC:10) [14:56:32:718]: Note: 1: 2205 2: 3: Dialog
    MSI (s) (BC:10) [14:56:32:718]: Feature: ProductFeature; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: CreateProgramFilesFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: ServiceComponent; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: scfdat; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: AdapterComponent; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: NoticeTxtComponent; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: Integrity; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: CreateProgramFilesFolderSDR; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: ServiceComponentSDR; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: RandomRegistry; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: CreateLoggingRegentry; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: CreateConfigFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: SSPconf; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: PIAconf; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: SXAconf; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: EPHconf; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: CreateRulesFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:718]: Component: ClpRulesBinary; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: ClpScript; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateLogsFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateDataFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateDataHealthFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateDataRCAFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateDatasnapshotFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateSavedDataFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateEventsStagingFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateEventsCloudOutgoingQueueFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateEventsCloudIncomingQueueFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateDataCommandsSDRFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateDataConfigurationSDRFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: SDRConfigFile; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateDataDataSDRFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateDataLogsSDRFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateDataOutboundSDRFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: CreateDataTempSDRFolder; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: TelemetryPluginExeComponent; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: TelemetryPluginPathComponent; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: TelemetryPluginCmdComponent; Installed: Absent; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: __RandomRegistry65; Installed: Null; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: __CreateLoggingRegentry65; Installed: Null; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: __TelemetryPluginPathComponent65; Installed: Null; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Component: __TelemetryPluginCmdComponent65; Installed: Null; Request: Local; Action: Local
    MSI (s) (BC:10) [14:56:32:719]: Note: 1: 2205 2: 3: BindImage
    MSI (s) (BC:10) [14:56:32:719]: Note: 1: 2205 2: 3: ProgId
    MSI (s) (BC:10) [14:56:32:719]: Note: 1: 2205 2: 3: PublishComponent
    MSI (s) (BC:10) [14:56:32:719]: Note: 1: 2205 2: 3: SelfReg
    MSI (s) (BC:10) [14:56:32:719]: Note: 1: 2205 2: 3: Extension
    MSI (s) (BC:10) [14:56:32:719]: Note: 1: 2205 2: 3: Font
    MSI (s) (BC:10) [14:56:32:719]: Note: 1: 2205 2: 3: Shortcut
    MSI (s) (BC:10) [14:56:32:719]: Note: 1: 2205 2: 3: Class
    MSI (s) (BC:10) [14:56:32:719]: Note: 1: 2205 2: 3: TypeLib
    Action start 14:56:32: InstallValidate.
    MSI (s) (BC:10) [14:56:32:719]: Note: 1: 2205 2: 3: _RemoveFilePath
    MSI (s) (BC:10) [14:56:32:724]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'.
    MSI (s) (BC:10) [14:56:32:725]: Note: 1: 2205 2: 3: BindImage
    MSI (s) (BC:10) [14:56:32:725]: Note: 1: 2205 2: 3: ProgId
    MSI (s) (BC:10) [14:56:32:725]: Note: 1: 2205 2: 3: PublishComponent
    MSI (s) (BC:10) [14:56:32:725]: Note: 1: 2205 2: 3: SelfReg
    MSI (s) (BC:10) [14:56:32:725]: Note: 1: 2205 2: 3: Extension
    MSI (s) (BC:10) [14:56:32:725]: Note: 1: 2205 2: 3: Font
    MSI (s) (BC:10) [14:56:32:725]: Note: 1: 2205 2: 3: Shortcut
    MSI (s) (BC:10) [14:56:32:725]: Note: 1: 2205 2: 3: Class
    MSI (s) (BC:10) [14:56:32:725]: Note: 1: 2205 2: 3: TypeLib
    MSI (s) (BC:10) [14:56:32:725]: Note: 1: 2727 2:
    MSI (s) (BC:10) [14:56:32:727]: Note: 1: 2727 2:
    MSI (s) (BC:10) [14:56:32:727]: Doing action: RemoveExistingProducts
    MSI (s) (BC:10) [14:56:32:727]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: InstallValidate. Return value 1.
    Action start 14:56:32: RemoveExistingProducts.
    MSI (s) (BC:10) [14:56:32:728]: Doing action: InstallInitialize
    MSI (s) (BC:10) [14:56:32:728]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: RemoveExistingProducts. Return value 1.
    MSI (s) (BC:10) [14:56:32:729]: Machine policy value 'AlwaysInstallElevated' is 0
    MSI (s) (BC:10) [14:56:32:729]: User policy value 'AlwaysInstallElevated' is 0
    MSI (s) (BC:10) [14:56:32:729]: BeginTransaction: Locking Server
    MSI (s) (BC:10) [14:56:32:729]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (BC:10) [14:56:32:729]: SRSetRestorePoint skipped for this transaction.
    MSI (s) (BC:10) [14:56:32:729]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
    MSI (s) (BC:10) [14:56:32:729]: Server not locked: locking for product {934BEF80-B9D1-4A86-8B42-D8A6716A8D27}
    Action start 14:56:32: InstallInitialize.
    MSI (s) (BC:10) [14:56:32:735]: Doing action: ProcessComponents
    MSI (s) (BC:10) [14:56:32:735]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: InstallInitialize. Return value 1.
    MSI (s) (BC:10) [14:56:32:735]: Note: 1: 2205 2: 3: MsiPatchCertificate
    MSI (s) (BC:10) [14:56:32:735]: LUA patching is disabled: missing MsiPatchCertificate table
    MSI (s) (BC:10) [14:56:32:735]: Resolving source.
    MSI (s) (BC:10) [14:56:32:735]: Resolving source to launched-from source.
    MSI (s) (BC:10) [14:56:32:735]: Setting launched-from source as last-used.
    MSI (s) (BC:10) [14:56:32:735]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\'.
    MSI (s) (BC:10) [14:56:32:735]: PROPERTY CHANGE: Adding SOURCEDIR property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\'.
    MSI (s) (BC:10) [14:56:32:736]: PROPERTY CHANGE: Adding SourcedirProduct property. Its value is '{934BEF80-B9D1-4A86-8B42-D8A6716A8D27}'.
    MSI (s) (BC:10) [14:56:32:736]: SOURCEDIR ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\
    MSI (s) (BC:10) [14:56:32:736]: SOURCEDIR product ==> {934BEF80-B9D1-4A86-8B42-D8A6716A8D27}
    MSI (s) (BC:10) [14:56:32:736]: Determining source type
    MSI (s) (BC:10) [14:56:32:736]: Source type from package 'SophosSystemProtection.msi': 0
    MSI (s) (BC:10) [14:56:32:736]: SECREPAIR: Hash Database: C:\WINDOWS\Installer\SourceHash{934BEF80-B9D1-4A86-8B42-D8A6716A8D27}
    MSI (s) (BC:10) [14:56:32:737]: Note: 1: 2262 2: SourceHash 3: -2147287038
    MSI (s) (BC:10) [14:56:32:739]: SECREPAIR: New Hash Database creation complete.
    MSI (s) (BC:10) [14:56:32:794]: Source path resolution complete. Dumping Directory table...
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: TARGETDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\ , LongSubPath: , ShortSubPath:
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: WindowsFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\ , LongSubPath: , ShortSubPath:
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\ , LongSubPath: , ShortSubPath:
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: ProgramFilesFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\ , LongSubPath: , ShortSubPath:
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: ProgramFiles64Folder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\ , LongSubPath: , ShortSubPath:
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: Sophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\ , LongSubPath: Sophos\ , ShortSubPath:
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: INSTALLDIRSDR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos Data Recorder\ , LongSubPath: Sophos\Sophos Data Recorder\ , ShortSubPath: Sophos\lwbmt7kp\
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: INSTALLDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\ , LongSubPath: Sophos\Sophos System Protection\ , ShortSubPath: Sophos\qgiys5c8\
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: CommonAppDataFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\ , LongSubPath: , ShortSubPath:
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: AppDataSophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\ , LongSubPath: Sophos\ , ShortSubPath:
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: AppDataSDR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos Data Recorder\ , LongSubPath: Sophos\Sophos Data Recorder\ , ShortSubPath: Sophos\uhnieivo\
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: DataTempSDR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos Data Recorder\temp\ , LongSubPath: Sophos\Sophos Data Recorder\temp\ , ShortSubPath: Sophos\uhnieivo\temp\
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: DataOutboundSDR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos Data Recorder\outbound\ , LongSubPath: Sophos\Sophos Data Recorder\outbound\ , ShortSubPath: Sophos\uhnieivo\outbound\
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: DataLogsSDR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos Data Recorder\logs\ , LongSubPath: Sophos\Sophos Data Recorder\logs\ , ShortSubPath: Sophos\uhnieivo\logs\
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: DataDataSDR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos Data Recorder\data\ , LongSubPath: Sophos\Sophos Data Recorder\data\ , ShortSubPath: Sophos\uhnieivo\data\
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: DataConfigurationSDR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos Data Recorder\configuration\ , LongSubPath: Sophos\Sophos Data Recorder\configuration\ , ShortSubPath: Sophos\uhnieivo\bm35knwx\
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: DataCommandsSDR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos Data Recorder\commands\ , LongSubPath: Sophos\Sophos Data Recorder\commands\ , ShortSubPath: Sophos\uhnieivo\commands\
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: AppDataSsp , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\ , LongSubPath: Sophos\Sophos System Protection\ , ShortSubPath: Sophos\vouvuy1l\
    MSI (s) (BC:10) [14:56:32:794]: Dir (source): Key: Logs , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Logs\ , LongSubPath: Sophos\Sophos System Protection\Logs\ , ShortSubPath: Sophos\vouvuy1l\Logs\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: Config , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Config\ , LongSubPath: Sophos\Sophos System Protection\Config\ , ShortSubPath: Sophos\vouvuy1l\Config\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: Rules , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Config\Rules\ , LongSubPath: Sophos\Sophos System Protection\Config\Rules\ , ShortSubPath: Sophos\vouvuy1l\Config\Rules\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: Data , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Data\ , LongSubPath: Sophos\Sophos System Protection\Data\ , ShortSubPath: Sophos\vouvuy1l\Data\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: Events , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Data\Events\ , LongSubPath: Sophos\Sophos System Protection\Data\Events\ , ShortSubPath: Sophos\vouvuy1l\Data\Events\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: EventsCloudIncomingQueue , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Data\Events\CloudIncomingQueue\ , LongSubPath: Sophos\Sophos System Protection\Data\Events\CloudIncomingQueue\ , ShortSubPath: Sophos\vouvuy1l\Data\Events\a7cbrp2j\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: EventsCloudOutgoingQueue , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Data\Events\CloudOutgoingQueue\ , LongSubPath: Sophos\Sophos System Protection\Data\Events\CloudOutgoingQueue\ , ShortSubPath: Sophos\vouvuy1l\Data\Events\8w-574s4\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: EventsStaging , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Data\Events\Staging\ , LongSubPath: Sophos\Sophos System Protection\Data\Events\Staging\ , ShortSubPath: Sophos\vouvuy1l\Data\Events\Staging\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: DataSavedData , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Data\Saved Data\ , LongSubPath: Sophos\Sophos System Protection\Data\Saved Data\ , ShortSubPath: Sophos\vouvuy1l\Data\c_h4aoyt\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: Datasnapshot , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Data\Snapshots\ , LongSubPath: Sophos\Sophos System Protection\Data\Snapshots\ , ShortSubPath: Sophos\vouvuy1l\Data\hofxgm07\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: DataRCA , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Data\RCA\ , LongSubPath: Sophos\Sophos System Protection\Data\RCA\ , ShortSubPath: Sophos\vouvuy1l\Data\RCA\
    MSI (s) (BC:10) [14:56:32:795]: Dir (source): Key: DataHealth , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Data\Health\ , LongSubPath: Sophos\Sophos System Protection\Data\Health\ , ShortSubPath: Sophos\vouvuy1l\Data\Health\
    MSI (s) (BC:10) [14:56:32:795]: Note: 1: 2205 2: 3: ActionText
    MSI (s) (BC:10) [14:56:32:795]: Note: 1: 2205 2: 3: ActionText
    MSI (s) (BC:10) [14:56:32:796]: Note: 1: 2205 2: 3: ActionText
    Action start 14:56:32: ProcessComponents.
    MSI (s) (BC:10) [14:56:32:800]: Doing action: UnpublishFeatures
    MSI (s) (BC:10) [14:56:32:800]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: ProcessComponents. Return value 1.
    Action start 14:56:32: UnpublishFeatures.
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: DisableAndUnloadMcsAdapterRollback.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: DisableAndUnloadMcsAdapterRollback (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: DisableAndUnloadMcsAdapter.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: DisableAndUnloadMcsAdapter (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: StopSspServiceRollback.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: StopSspServiceRollback (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: StopSspService.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: StopSspService (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: StopSdrServiceRollback.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: StopSdrServiceRollback (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: StopSdrService.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Skipping action: StopSdrService (condition is false)
    MSI (s) (BC:10) [14:56:32:801]: Doing action: StopServices
    MSI (s) (BC:10) [14:56:32:801]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: UnpublishFeatures. Return value 1.
    Action start 14:56:32: StopServices.
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: CleanUpShsUserAccountRollback.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: CleanUpShsUserAccountRollback (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: CleanUpShsUserAccount.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: CleanUpShsUserAccount (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLater (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: CleanUpSsspUserAccountRollback.SetPropertyXp (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: CleanUpSsspUserAccountRollback (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: CleanUpSsspUserAccount.SetPropertyVistaOrLater (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: CleanUpSsspUserAccount.SetPropertyXp (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: CleanUpSsspUserAccount (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: ApplyPermissionsToSdrFoldersOnRollback.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: ApplyPermissionsToSdrFoldersOnRollback (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: ApplyPermissionsToSspFoldersOnRollback.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: ApplyPermissionsToSspFoldersOnRollback (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Skipping action: RequestUnrestrictedSSPSidOnRollback (condition is false)
    MSI (s) (BC:10) [14:56:32:802]: Doing action: DeleteServices
    MSI (s) (BC:10) [14:56:32:802]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: StopServices. Return value 1.
    Action start 14:56:32: DeleteServices.
    MSI (s) (BC:10) [14:56:32:803]: Doing action: RemoveRegistryValues
    MSI (s) (BC:10) [14:56:32:803]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: DeleteServices. Return value 1.
    Action start 14:56:32: RemoveRegistryValues.
    MSI (s) (BC:10) [14:56:32:804]: Doing action: RemoveFiles
    MSI (s) (BC:10) [14:56:32:804]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: RemoveRegistryValues. Return value 1.
    Action start 14:56:32: RemoveFiles.
    MSI (s) (BC:10) [14:56:32:805]: Skipping action: CleanupData.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:805]: Skipping action: CleanupData (condition is false)
    MSI (s) (BC:10) [14:56:32:805]: Skipping action: CleanupLogs.SetProperty (condition is false)
    MSI (s) (BC:10) [14:56:32:805]: Skipping action: CleanupLogs (condition is false)
    MSI (s) (BC:10) [14:56:32:805]: Doing action: RemoveFolders
    MSI (s) (BC:10) [14:56:32:805]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: RemoveFiles. Return value 1.
    Action start 14:56:32: RemoveFolders.
    MSI (s) (BC:10) [14:56:32:805]: Doing action: CreateFolders
    MSI (s) (BC:10) [14:56:32:805]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: RemoveFolders. Return value 1.
    Action start 14:56:32: CreateFolders.
    MSI (s) (BC:10) [14:56:32:806]: Using well known SID for Everyone
    MSI (s) (BC:10) [14:56:32:806]: Finished allocating new user SID
    MSI (s) (BC:10) [14:56:32:806]: Using well known SID for Administrators
    MSI (s) (BC:10) [14:56:32:806]: Finished allocating new user SID
    MSI (s) (BC:10) [14:56:32:806]: Using well known SID for System
    MSI (s) (BC:10) [14:56:32:806]: Finished allocating new user SID
    MSI (s) (BC:10) [14:56:32:807]: Doing action: InstallFiles
    MSI (s) (BC:10) [14:56:32:807]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: CreateFolders. Return value 1.
    Action start 14:56:32: InstallFiles.
    MSI (s) (BC:10) [14:56:32:809]: Note: 1: 2205 2: 3: Patch
    MSI (s) (BC:10) [14:56:32:809]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`
    MSI (s) (BC:10) [14:56:32:809]: Note: 1: 2205 2: 3: MsiSFCBypass
    MSI (s) (BC:10) [14:56:32:809]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?
    MSI (s) (BC:10) [14:56:32:809]: Note: 1: 2205 2: 3: MsiPatchHeaders
    MSI (s) (BC:10) [14:56:32:809]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?
    MSI (s) (BC:10) [14:56:32:809]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (BC:10) [14:56:32:809]: Note: 1: 2205 2: 3: MsiPatchHeaders
    MSI (s) (BC:10) [14:56:32:809]: Note: 1: 2205 2: 3: PatchPackage
    MSI (s) (BC:10) [14:56:32:811]: Doing action: RandomisePipeName
    MSI (s) (BC:10) [14:56:32:811]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: InstallFiles. Return value 1.
    MSI (s) (BC:AC) [14:56:32:814]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIF9DB.tmp, Entrypoint: GenerateRandString
    MSI (s) (BC:48) [14:56:32:814]: Generating random cookie.
    MSI (s) (BC:48) [14:56:32:816]: Created Custom Action Server with PID 13532 (0x34DC).
    MSI (s) (BC:B4) [14:56:32:830]: Running as a service.
    MSI (s) (BC:B4) [14:56:32:833]: Hello, I'm your 64bit Elevated Non-remapped custom action server.
    Action start 14:56:32: RandomisePipeName.
    MSI (s) (BC!0C) [14:56:32:849]: PROPERTY CHANGE: Adding GeneratedRandString property. Its value is 'phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpre'.
    GenerateRandString: Initialized.
    MSI (s) (BC:10) [14:56:32:850]: Doing action: WriteRegistryValues
    MSI (s) (BC:10) [14:56:32:850]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: RandomisePipeName. Return value 1.
    Action start 14:56:32: WriteRegistryValues.
    MSI (s) (BC:10) [14:56:32:851]: Doing action: InstallServices
    MSI (s) (BC:10) [14:56:32:851]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: WriteRegistryValues. Return value 1.
    Action start 14:56:32: InstallServices.
    MSI (s) (BC:10) [14:56:32:851]: Doing action: RequestUnrestrictedSSPSid
    MSI (s) (BC:10) [14:56:32:851]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: InstallServices. Return value 1.
    Action start 14:56:32: RequestUnrestrictedSSPSid.
    MSI (s) (BC:10) [14:56:32:851]: Doing action: ApplyPermissionsToSspFolders.SetProperty
    MSI (s) (BC:10) [14:56:32:851]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: RequestUnrestrictedSSPSid. Return value 1.
    MSI (s) (BC:10) [14:56:32:851]: PROPERTY CHANGE: Adding ApplyPermissionsToSspFolders property. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\|C:\ProgramData\Sophos\Sophos System Protection\Data\|C:\ProgramData\Sophos\Sophos System Protection\Data\Health|C:\ProgramData\Sophos\Sophos System Protection\Data\RCA|C:\ProgramData\Sophos\Sophos System Protection\Data\Snapshots|C:\ProgramData\Sophos\Sophos System Protection\Data\Saved Data'.
    Action start 14:56:32: ApplyPermissionsToSspFolders.SetProperty.
    MSI (s) (BC:10) [14:56:32:851]: Doing action: ApplyPermissionsToSspFolders
    MSI (s) (BC:10) [14:56:32:851]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: ApplyPermissionsToSspFolders.SetProperty. Return value 1.
    Action start 14:56:32: ApplyPermissionsToSspFolders.
    MSI (s) (BC:10) [14:56:32:851]: Doing action: ApplyPermissionsToSdrFolders.SetProperty
    MSI (s) (BC:10) [14:56:32:851]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: ApplyPermissionsToSspFolders. Return value 1.
    MSI (s) (BC:10) [14:56:32:851]: PROPERTY CHANGE: Adding ApplyPermissionsToSdrFolders property. Its value is 'C:\ProgramData\Sophos\Sophos Data Recorder\|C:\ProgramData\Sophos\Sophos Data Recorder\data\|C:\ProgramData\Sophos\Sophos Data Recorder\outbound\|C:\ProgramData\Sophos\Sophos Data Recorder\commands\'.
    Action start 14:56:32: ApplyPermissionsToSdrFolders.SetProperty.
    MSI (s) (BC:10) [14:56:32:851]: Doing action: ApplyPermissionsToSdrFolders
    MSI (s) (BC:10) [14:56:32:851]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: ApplyPermissionsToSdrFolders.SetProperty. Return value 1.
    Action start 14:56:32: ApplyPermissionsToSdrFolders.
    MSI (s) (BC:10) [14:56:32:851]: Doing action: SchedServiceConfig
    MSI (s) (BC:10) [14:56:32:851]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: ApplyPermissionsToSdrFolders. Return value 1.
    MSI (s) (BC:E8) [14:56:32:851]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIF9FB.tmp, Entrypoint: SchedServiceConfig
    MSI (s) (BC:48) [14:56:32:851]: Generating random cookie.
    MSI (s) (BC:48) [14:56:32:866]: Created Custom Action Server with PID 14596 (0x3904).
    MSI (s) (BC:B4) [14:56:32:882]: Running as a service.
    MSI (s) (BC:B4) [14:56:32:882]: Hello, I'm your 32bit Elevated Non-remapped custom action server.
    MSI (s) (BC!84) [14:56:32:898]: PROPERTY CHANGE: Adding RollbackServiceConfig property. Its value is 'SchedServiceConfig'.
    Action start 14:56:32: SchedServiceConfig.
    MSI (s) (BC!84) [14:56:32:898]: Doing action: RollbackServiceConfig
    MSI (s) (BC!84) [14:56:32:898]: Note: 1: 2205 2: 3: ActionText
    Action start 14:56:32: RollbackServiceConfig.
    MSI (s) (BC!84) [14:56:32:898]: PROPERTY CHANGE: Adding ExecServiceConfig property. Its value is 'SchedServiceConfig€sophossps€1€restart€restart€none€1€120€€€SophosDataRecorderService€1€restart€restart€none€1€120€€'.
    Action ended 14:56:32: RollbackServiceConfig. Return value 1.
    MSI (s) (BC!84) [14:56:32:898]: Doing action: ExecServiceConfig
    MSI (s) (BC!84) [14:56:32:898]: Note: 1: 2205 2: 3: ActionText
    Action start 14:56:32: ExecServiceConfig.
    Action ended 14:56:32: ExecServiceConfig. Return value 1.
    MSI (s) (BC:10) [14:56:32:898]: Doing action: CreateDefaultPolicyConfig.SetProperty
    MSI (s) (BC:10) [14:56:32:898]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: SchedServiceConfig. Return value 1.
    MSI (s) (BC:10) [14:56:32:898]: PROPERTY CHANGE: Adding CreateDefaultPolicyConfig property. Its value is 'NT SERVICE\sophossps'.
    Action start 14:56:32: CreateDefaultPolicyConfig.SetProperty.
    MSI (s) (BC:10) [14:56:32:898]: Doing action: CreateDefaultPolicyConfig
    MSI (s) (BC:10) [14:56:32:898]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: CreateDefaultPolicyConfig.SetProperty. Return value 1.
    Action start 14:56:32: CreateDefaultPolicyConfig.
    MSI (s) (BC:10) [14:56:32:898]: Doing action: SetupSspUserAccountRollback.SetPropertyVistaOrLater
    MSI (s) (BC:10) [14:56:32:898]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: CreateDefaultPolicyConfig. Return value 1.
    MSI (s) (BC:10) [14:56:32:898]: PROPERTY CHANGE: Adding SetupSspUserAccountRollback property. Its value is 'NT SERVICE\sophossps'.
    Action start 14:56:32: SetupSspUserAccountRollback.SetPropertyVistaOrLater.
    MSI (s) (BC:10) [14:56:32:898]: Skipping action: SetupSspUserAccountRollback.SetPropertyXp (condition is false)
    MSI (s) (BC:10) [14:56:32:898]: Doing action: SetupSspUserAccountRollback
    MSI (s) (BC:10) [14:56:32:898]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: SetupSspUserAccountRollback.SetPropertyVistaOrLater. Return value 1.
    Action start 14:56:32: SetupSspUserAccountRollback.
    MSI (s) (BC:10) [14:56:32:898]: Doing action: SetupSspUserAccount.SetPropertyVistaOrLater
    MSI (s) (BC:10) [14:56:32:898]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: SetupSspUserAccountRollback. Return value 1.
    MSI (s) (BC:10) [14:56:32:898]: PROPERTY CHANGE: Adding SetupSspUserAccount property. Its value is 'NT SERVICE\sophossps'.
    Action start 14:56:32: SetupSspUserAccount.SetPropertyVistaOrLater.
    MSI (s) (BC:10) [14:56:32:898]: Skipping action: SetupSspUserAccount.SetPropertyXp (condition is false)
    MSI (s) (BC:10) [14:56:32:898]: Doing action: SetupSspUserAccount
    MSI (s) (BC:10) [14:56:32:898]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: SetupSspUserAccount.SetPropertyVistaOrLater. Return value 1.
    Action start 14:56:32: SetupSspUserAccount.
    MSI (s) (BC:10) [14:56:32:898]: Doing action: SetupShsUserAccountRollback.SetProperty
    MSI (s) (BC:10) [14:56:32:898]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: SetupSspUserAccount. Return value 1.
    MSI (s) (BC:10) [14:56:32:898]: PROPERTY CHANGE: Adding SetupShsUserAccountRollback property. Its value is 'NT SERVICE\sophossps'.
    Action start 14:56:32: SetupShsUserAccountRollback.SetProperty.
    MSI (s) (BC:10) [14:56:32:898]: Doing action: SetupShsUserAccountRollback
    MSI (s) (BC:10) [14:56:32:898]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: SetupShsUserAccountRollback.SetProperty. Return value 1.
    Action start 14:56:32: SetupShsUserAccountRollback.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: SetupShsUserAccount.SetProperty
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: SetupShsUserAccountRollback. Return value 1.
    MSI (s) (BC:10) [14:56:32:913]: PROPERTY CHANGE: Adding SetupShsUserAccount property. Its value is 'NT SERVICE\sophossps;GENERIC_READ'.
    Action start 14:56:32: SetupShsUserAccount.SetProperty.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: SetupShsUserAccount
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: SetupShsUserAccount.SetProperty. Return value 1.
    Action start 14:56:32: SetupShsUserAccount.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: CreateSnapshotTriggerRegKey.SetProperty
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: SetupShsUserAccount. Return value 1.
    MSI (s) (BC:10) [14:56:32:913]: PROPERTY CHANGE: Adding CreateSnapshotTriggerRegKey property. Its value is 'NT SERVICE\sophossps'.
    Action start 14:56:32: CreateSnapshotTriggerRegKey.SetProperty.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: CreateSnapshotTriggerRegKey
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: CreateSnapshotTriggerRegKey.SetProperty. Return value 1.
    Action start 14:56:32: CreateSnapshotTriggerRegKey.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: CreateTelemetryStorage.SetProperty
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: CreateSnapshotTriggerRegKey. Return value 1.
    MSI (s) (BC:10) [14:56:32:913]: PROPERTY CHANGE: Adding CreateTelemetryStorage property. Its value is 'NT SERVICE\sophossps'.
    Action start 14:56:32: CreateTelemetryStorage.SetProperty.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: CreateTelemetryStorage
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: CreateTelemetryStorage.SetProperty. Return value 1.
    Action start 14:56:32: CreateTelemetryStorage.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: StartServices
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: CreateTelemetryStorage. Return value 1.
    Action start 14:56:32: StartServices.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: EnableAndLoadMcsAdapterRollback.SetProperty
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: StartServices. Return value 1.
    MSI (s) (BC:10) [14:56:32:913]: PROPERTY CHANGE: Adding EnableAndLoadMcsAdapterRollback property. Its value is 'C:\Program Files\Sophos\Sophos System Protection\SspAdapter.dll'.
    Action start 14:56:32: EnableAndLoadMcsAdapterRollback.SetProperty.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: EnableAndLoadMcsAdapterRollback
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: EnableAndLoadMcsAdapterRollback.SetProperty. Return value 1.
    Action start 14:56:32: EnableAndLoadMcsAdapterRollback.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: EnableAndLoadMcsAdapter.SetProperty
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: EnableAndLoadMcsAdapterRollback. Return value 1.
    MSI (s) (BC:10) [14:56:32:913]: PROPERTY CHANGE: Adding EnableAndLoadMcsAdapter property. Its value is 'C:\Program Files\Sophos\Sophos System Protection\SspAdapter.dll'.
    Action start 14:56:32: EnableAndLoadMcsAdapter.SetProperty.
    MSI (s) (BC:10) [14:56:32:913]: Doing action: EnableAndLoadMcsAdapter
    MSI (s) (BC:10) [14:56:32:913]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: EnableAndLoadMcsAdapter.SetProperty. Return value 1.
    Action start 14:56:32: EnableAndLoadMcsAdapter.
    MSI (s) (BC:10) [14:56:32:929]: Doing action: StartSdrServiceRollback.SetProperty
    MSI (s) (BC:10) [14:56:32:929]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: EnableAndLoadMcsAdapter. Return value 1.
    MSI (s) (BC:10) [14:56:32:929]: PROPERTY CHANGE: Adding StartSdrServiceRollback property. Its value is 'SophosDataRecorderService'.
    Action start 14:56:32: StartSdrServiceRollback.SetProperty.
    MSI (s) (BC:10) [14:56:32:929]: Doing action: StartSdrServiceRollback
    MSI (s) (BC:10) [14:56:32:929]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: StartSdrServiceRollback.SetProperty. Return value 1.
    Action start 14:56:32: StartSdrServiceRollback.
    MSI (s) (BC:10) [14:56:32:929]: Doing action: StartSdrService.SetProperty
    MSI (s) (BC:10) [14:56:32:929]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: StartSdrServiceRollback. Return value 1.
    MSI (s) (BC:10) [14:56:32:929]: PROPERTY CHANGE: Adding StartSdrService property. Its value is 'SophosDataRecorderService'.
    Action start 14:56:32: StartSdrService.SetProperty.
    MSI (s) (BC:10) [14:56:32:929]: Doing action: StartSdrService
    MSI (s) (BC:10) [14:56:32:929]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: StartSdrService.SetProperty. Return value 1.
    Action start 14:56:32: StartSdrService.
    MSI (s) (BC:10) [14:56:32:929]: Doing action: StartSspServiceRollback.SetProperty
    MSI (s) (BC:10) [14:56:32:929]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: StartSdrService. Return value 1.
    MSI (s) (BC:10) [14:56:32:929]: PROPERTY CHANGE: Adding StartSspServiceRollback property. Its value is 'sophossps'.
    Action start 14:56:32: StartSspServiceRollback.SetProperty.
    MSI (s) (BC:10) [14:56:32:929]: Doing action: StartSspServiceRollback
    MSI (s) (BC:10) [14:56:32:929]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: StartSspServiceRollback.SetProperty. Return value 1.
    Action start 14:56:32: StartSspServiceRollback.
    MSI (s) (BC:10) [14:56:32:929]: Doing action: StartSspService.SetProperty
    MSI (s) (BC:10) [14:56:32:929]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: StartSspServiceRollback. Return value 1.
    MSI (s) (BC:10) [14:56:32:929]: PROPERTY CHANGE: Adding StartSspService property. Its value is 'sophossps'.
    Action start 14:56:32: StartSspService.SetProperty.
    MSI (s) (BC:10) [14:56:32:929]: Doing action: StartSspService
    MSI (s) (BC:10) [14:56:32:929]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: StartSspService.SetProperty. Return value 1.
    Action start 14:56:32: StartSspService.
    MSI (s) (BC:10) [14:56:32:945]: Doing action: RegisterUser
    MSI (s) (BC:10) [14:56:32:945]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: StartSspService. Return value 1.
    Action start 14:56:32: RegisterUser.
    MSI (s) (BC:10) [14:56:32:945]: Doing action: RegisterProduct
    MSI (s) (BC:10) [14:56:32:945]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: RegisterUser. Return value 1.
    Action start 14:56:32: RegisterProduct.
    MSI (s) (BC:10) [14:56:32:945]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'.
    MSI (s) (BC:10) [14:56:32:945]: Doing action: PublishFeatures
    MSI (s) (BC:10) [14:56:32:945]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: RegisterProduct. Return value 1.
    Action start 14:56:32: PublishFeatures.
    MSI (s) (BC:10) [14:56:32:945]: Doing action: PublishProduct
    MSI (s) (BC:10) [14:56:32:945]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: PublishFeatures. Return value 1.
    Action start 14:56:32: PublishProduct.
    MSI (s) (BC:10) [14:56:32:945]: Skipping action: WixFailWhenDeferred (condition is false)
    MSI (s) (BC:10) [14:56:32:945]: Doing action: InstallFinalize
    MSI (s) (BC:10) [14:56:32:945]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:32: PublishProduct. Return value 1.
    MSI (s) (BC:10) [14:56:32:945]: Running Script: C:\WINDOWS\Installer\MSIF9BA.tmp
    MSI (s) (BC:10) [14:56:32:945]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'.
    MSI (s) (BC:10) [14:56:33:159]: Note: 1: 2265 2: 3: -2147287035
    MSI (s) (BC:10) [14:56:33:159]: Machine policy value 'DisableRollback' is 0
    MSI (s) (BC:10) [14:56:33:161]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
    MSI (s) (BC:10) [14:56:33:161]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1259697937,LangId=1033,Platform=589824,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
    Action start 14:56:32: InstallFinalize.
    MSI (s) (BC:10) [14:56:33:161]: Executing op: ProductInfo(ProductKey={934BEF80-B9D1-4A86-8B42-D8A6716A8D27},ProductName=Sophos System Protection,PackageName=SophosSystemProtection.msi,Language=1033,Version=33947648,Assignment=1,ObsoleteArg=0,ProductIcon=sspIcon.ico,,PackageCode={87CFF70C-FF71-4317-897A-843822E95859},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)
    MSI (s) (BC:10) [14:56:33:161]: Executing op: DialogInfo(Type=0,Argument=1033)
    MSI (s) (BC:10) [14:56:33:161]: Executing op: DialogInfo(Type=1,Argument=Sophos System Protection)
    MSI (s) (BC:10) [14:56:33:161]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action: [1],,CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files File: [1],)
    MSI (s) (BC:10) [14:56:33:161]: Executing op: SetBaseline(Baseline=0,)
    MSI (s) (BC:10) [14:56:33:161]: Executing op: SetBaseline(Baseline=1,)
    MSI (s) (BC:10) [14:56:33:161]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,)
    MSI (s) (BC:10) [14:56:33:162]: Executing op: ProgressTotal(Total=37,Type=1,ByteEquivalent=24000)
    MSI (s) (BC:10) [14:56:33:162]: Executing op: ComponentRegister(ComponentId={96CAB1A6-E3C3-42BC-B1AC-57552F6DE27B},KeyPath=C:\Program Files\Sophos\Sophos System Protection\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:162]: Executing op: ComponentRegister(ComponentId={EE372818-51C3-4B29-B0AD-9AA8740EAA1F},KeyPath=C:\Program Files\Sophos\Sophos System Protection\ssp.exe,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:162]: Executing op: ComponentRegister(ComponentId={EFB99B6F-FB73-4F3E-9FE6-A64F479DF970},KeyPath=C:\Program Files\Sophos\Sophos System Protection\scf.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:197]: Executing op: ComponentRegister(ComponentId={B5035075-0236-4604-BA1B-5D387147A9F4},KeyPath=C:\Program Files\Sophos\Sophos System Protection\SspAdapter.dll,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:197]: Executing op: ComponentRegister(ComponentId={7ECB1684-230B-47C7-82D6-8D75FFA9A385},KeyPath=C:\Program Files\Sophos\Sophos System Protection\NOTICE.txt,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:198]: Executing op: ComponentRegister(ComponentId={0B9F042F-5953-4DF4-967B-50F1EB90B9D9},KeyPath=C:\Program Files\Sophos\Sophos System Protection\integrity.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:198]: Executing op: ComponentRegister(ComponentId={5D7F2527-1AD2-4A35-8E46-F86B7086D5BF},KeyPath=C:\Program Files\Sophos\Sophos Data Recorder\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:199]: Executing op: ComponentRegister(ComponentId={1443B8D2-D0E7-4CC4-A32E-1C3F240BCDBF},KeyPath=C:\Program Files\Sophos\Sophos Data Recorder\SDRService.exe,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:199]: Executing op: ComponentRegister(ComponentId={AEA712C0-6555-4FB1-A4CC-1806B1F94B45},KeyPath=02:\Software\Sophos\SystemProtection\PipeName,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
    MSI (s) (BC:10) [14:56:33:199]: Executing op: ComponentRegister(ComponentId={CD73DBF6-732F-4699-A9B6-968BDB1BC054},KeyPath=02:\Software\Sophos\SystemProtection\LOG\File,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
    MSI (s) (BC:10) [14:56:33:199]: Executing op: ComponentRegister(ComponentId={5F071C66-51B7-4406-8165-4E3D9E70C42F},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:200]: Executing op: ComponentRegister(ComponentId={46D9C339-FF13-4CE0-B519-E5BFE7F2BC77},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\SSP.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:200]: Executing op: ComponentRegister(ComponentId={F56BEF81-6CB2-4FEE-930F-6C93D6A28E0C},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\PIA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:200]: Executing op: ComponentRegister(ComponentId={F2B22387-9B39-4788-AEB6-B9551324FF17},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\SXA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:200]: Executing op: ComponentRegister(ComponentId={BAAE170A-5F93-4FF6-9782-3F017EC4C4B1},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\EPH.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:201]: Executing op: ComponentRegister(ComponentId={AB316AD5-E2AE-4193-A4E9-D521B448B2AB},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:201]: Executing op: ComponentRegister(ComponentId={B357F4B1-BB0A-4F82-9F47-3F61CD6BC87B},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\rules.bin,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:201]: Executing op: ComponentRegister(ComponentId={DA5237EF-B590-4AE3-BD5B-887A84A9733A},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\RCA-binary-load.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:201]: Executing op: ComponentRegister(ComponentId={216A2A33-1146-472F-9635-107BFE94723A},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Logs\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:202]: Executing op: ComponentRegister(ComponentId={EF1063A8-7B97-4CD0-A2CC-4BA27645908D},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:202]: Executing op: ComponentRegister(ComponentId={4F1C4647-D152-4137-85AB-ACF0F201F7F1},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\Health\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:202]: Executing op: ComponentRegister(ComponentId={65C09B4A-7E4B-46EB-91F6-F237B16B621B},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\RCA\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:202]: Executing op: ComponentRegister(ComponentId={7A812E21-0C42-4E3F-99E4-D3A0ED47302C},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\Snapshots\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:203]: Executing op: ComponentRegister(ComponentId={0ED83FFD-D9FE-430F-AEFB-3D7385329A57},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\Saved Data\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:203]: Executing op: ComponentRegister(ComponentId={6E78F812-484D-41CE-8EC5-250098231145},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\Events\Staging\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:203]: Executing op: ComponentRegister(ComponentId={AB3BA284-7CE5-4EE0-9F60-D7C10B704685},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\Events\CloudOutgoingQueue\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:203]: Executing op: ComponentRegister(ComponentId={89F350E0-D2E0-466F-B715-6F07187C0E07},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\Events\CloudIncomingQueue\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:204]: Executing op: ComponentRegister(ComponentId={3E71DF64-4865-4F0F-B7B2-492B12C46396},KeyPath=C:\ProgramData\Sophos\Sophos Data Recorder\commands\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:204]: Executing op: ComponentRegister(ComponentId={CDCF9122-1634-4779-92D0-9607A005A52F},KeyPath=C:\ProgramData\Sophos\Sophos Data Recorder\configuration\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:204]: Executing op: ComponentRegister(ComponentId={58F54949-C56C-4E32-96A9-38591EE1B6F6},KeyPath=C:\ProgramData\Sophos\Sophos Data Recorder\configuration\config.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:204]: Executing op: ComponentRegister(ComponentId={3526D5DB-25AE-4BE8-9C8B-A4AB4B40620F},KeyPath=C:\ProgramData\Sophos\Sophos Data Recorder\data\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:205]: Executing op: ComponentRegister(ComponentId={1297F3D4-1BC7-4792-8213-E3E7736576F3},KeyPath=C:\ProgramData\Sophos\Sophos Data Recorder\logs\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:205]: Executing op: ComponentRegister(ComponentId={BD402322-CB4B-4385-87EC-51EC1C531041},KeyPath=C:\ProgramData\Sophos\Sophos Data Recorder\outbound\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:205]: Executing op: ComponentRegister(ComponentId={B894312E-F805-4F16-90B5-0A3F60BB53B6},KeyPath=C:\ProgramData\Sophos\Sophos Data Recorder\temp\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:205]: Executing op: ComponentRegister(ComponentId={C9AB4B0D-42E0-45AD-ABDC-9BDAB2D36C6C},KeyPath=C:\Program Files\Sophos\Sophos System Protection\TelemetryPlugin.exe,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1)
    MSI (s) (BC:10) [14:56:33:205]: Executing op: ComponentRegister(ComponentId={6E0F14EF-879B-475B-A8E3-82CC7F4DD910},KeyPath=02:\SOFTWARE\Sophos\Telemetry\Plugins\SSP\Path,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
    MSI (s) (BC:10) [14:56:33:206]: Executing op: ComponentRegister(ComponentId={9D2F1920-0664-4808-828D-07B888845D61},KeyPath=02:\SOFTWARE\Sophos\Telemetry\Plugins\SSP\Cmd,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)
    MSI (s) (BC:10) [14:56:33:206]: Executing op: ActionStart(Name=StopServices,Description=Stopping services Service: [1],)
    MSI (s) (BC:10) [14:56:33:206]: Executing op: ProgressTotal(Total=2,Type=1,ByteEquivalent=1300000)
    MSI (s) (BC:10) [14:56:33:206]: Executing op: ServiceControl(,Name=sophossps,Action=2,Wait=1,)
    MSI (s) (BC:10) [14:56:33:206]: Executing op: ServiceControl(,Name=SophosDataRecorderService,Action=2,Wait=1,)
    MSI (s) (BC:10) [14:56:33:206]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values Key: [1], Name: [2],)
    MSI (s) (BC:10) [14:56:33:206]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
    MSI (s) (BC:10) [14:56:33:206]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\AutoUpdate\Products\SSP,,BinaryType=0,,)
    MSI (s) (BC:10) [14:56:33:206]: Executing op: RegRemoveKey()
    MSI (s) (BC:10) [14:56:33:207]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\Software\Sophos\AutoUpdate\Products\SSP 3: 2
    MSI (s) (BC:10) [14:56:33:207]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders Folder: [1],)
    MSI (s) (BC:10) [14:56:33:207]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:33:207]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos System Protection\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (BC:10) [14:56:33:209]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos Data Recorder\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Logs\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\Health\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\RCA\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\Snapshots\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\Saved Data\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\Events\Staging\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\Events\CloudOutgoingQueue\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\Events\CloudIncomingQueue\,Foreign=0,,)
    MSI (s) (BC:10) [14:56:34:136]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Data Recorder\commands\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (BC:10) [14:56:34:151]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Data Recorder\configuration\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (BC:10) [14:56:34:151]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Data Recorder\data\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (BC:10) [14:56:34:151]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Data Recorder\logs\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (BC:10) [14:56:34:151]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Data Recorder\outbound\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (BC:10) [14:56:34:151]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Data Recorder\temp\,Foreign=0,SecurityDescriptor=BinaryData,)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files File: [1], Directory: [9], Size: Devil,)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: ProgressTotal(Total=7639700,Type=0,ByteEquivalent=1)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos Data Recorder\configuration\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetSourceFolder(Folder=1\Sophos\uhnieivo\bm35knwx\|Sophos\Sophos Data Recorder\configuration\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=65536,CopierType=0,,,,,,IsFirstPhysicalMedia=1)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: FileCopy(SourceName=config.dat,SourceCabKey=config.dat,DestName=config.dat,Attributes=512,FileSize=27,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-2012064643,HashPart2=1545533108,HashPart3=1089532698,HashPart4=134795930,,)
    MSI (s) (BC:10) [14:56:34:167]: File: C:\ProgramData\Sophos\Sophos Data Recorder\configuration\config.dat; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:167]: Source for file 'config.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos Data Recorder\configuration\'.
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: FileCopy(SourceName=b3y1tuan.con|EPH.conf,SourceCabKey=EPH.conf,DestName=EPH.conf,Attributes=512,FileSize=144,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=2084153094,HashPart2=-883415695,HashPart3=-2041716469,HashPart4=1976284214,,)
    MSI (s) (BC:10) [14:56:34:167]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\EPH.conf; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:167]: Source for file 'EPH.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Config\'.
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: FileCopy(SourceName=o-7ajprv.dat|integrity.dat,SourceCabKey=IntegrityFile,DestName=integrity.dat,Attributes=512,FileSize=1754,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-878156171,HashPart2=1060031141,HashPart3=1055174259,HashPart4=-1678213212,,)
    MSI (s) (BC:10) [14:56:34:167]: File: C:\Program Files\Sophos\Sophos System Protection\integrity.dat; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:167]: Source for file 'integrity.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\'.
    MSI (s) (BC:10) [14:56:34:167]: Executing op: FileCopy(SourceName=NOTICE.txt,SourceCabKey=NoticeTxtFile,DestName=NOTICE.txt,Attributes=512,FileSize=19523,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-368355152,HashPart2=1133605151,HashPart3=1490697061,HashPart4=156029312,,)
    MSI (s) (BC:10) [14:56:34:167]: File: C:\Program Files\Sophos\Sophos System Protection\NOTICE.txt; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:167]: Source for file 'NOTICE.txt' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\'.
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: FileCopy(SourceName=gxaaofii.con|PIA.conf,SourceCabKey=PIA.conf,DestName=PIA.conf,Attributes=512,FileSize=184,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=587898439,HashPart2=1822813661,HashPart3=227107488,HashPart4=-1758655495,,)
    MSI (s) (BC:10) [14:56:34:167]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\PIA.conf; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:167]: Source for file 'PIA.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Config\'.
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\Rules\|Sophos\Sophos System Protection\Config\Rules\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: FileCopy(SourceName=t5ay0o9z.dat|RCA-binary-load.dat,SourceCabKey=RCA_binary_load.dat,DestName=RCA-binary-load.dat,Attributes=512,FileSize=1054,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-803629082,HashPart2=-990153319,HashPart3=-1774366188,HashPart4=-1601948881,,)
    MSI (s) (BC:10) [14:56:34:167]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\RCA-binary-load.dat; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:167]: Source for file 'RCA-binary-load.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Config\Rules\'.
    MSI (s) (BC:10) [14:56:34:167]: Executing op: FileCopy(SourceName=rules.bin,SourceCabKey=rules.bin,DestName=rules.bin,Attributes=512,FileSize=229872,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=1844965816,HashPart2=-773098928,HashPart3=983327505,HashPart4=2111936348,,)
    MSI (s) (BC:10) [14:56:34:167]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\rules.bin; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:167]: Source for file 'rules.bin' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Config\Rules\'.
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: FileCopy(SourceName=scf.dat,SourceCabKey=scf.dat,DestName=scf.dat,Attributes=512,FileSize=2871,PerTick=65536,,VerifyMedia=1,,,,SecurityDescriptor=BinaryData,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-932056164,HashPart2=-193454290,HashPart3=-1105345413,HashPart4=594394187,,)
    MSI (s) (BC:10) [14:56:34:167]: File: C:\Program Files\Sophos\Sophos System Protection\scf.dat; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:167]: Source for file 'scf.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\'.
    MSI (s) (BC:10) [14:56:34:167]: File will have security applied from OpCode.
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Data Recorder\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: SetSourceFolder(Folder=1\Sophos\lwbmt7kp\|Sophos\Sophos Data Recorder\)
    MSI (s) (BC:10) [14:56:34:167]: Executing op: FileCopy(SourceName=zgb0myrk.exe|SDRService.exe,SourceCabKey=SDRService.exe,DestName=SDRService.exe,Attributes=512,FileSize=996240,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.0.0.10,Language=1033,InstallMode=58982400,,,,,,,)
    MSI (s) (BC:10) [14:56:34:167]: File: C:\Program Files\Sophos\Sophos Data Recorder\SDRService.exe; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:167]: Source for file 'SDRService.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos Data Recorder\'.
    MSI (s) (BC:10) [14:56:34:183]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)
    MSI (s) (BC:10) [14:56:34:183]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)
    MSI (s) (BC:10) [14:56:34:183]: Executing op: FileCopy(SourceName=fpw3kto9.con|SSP.conf,SourceCabKey=SSP.conf,DestName=SSP.conf,Attributes=512,FileSize=386,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-905323240,HashPart2=689144556,HashPart3=-792280567,HashPart4=1800642703,,)
    MSI (s) (BC:10) [14:56:34:183]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\SSP.conf; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:183]: Source for file 'SSP.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Config\'.
    MSI (s) (BC:10) [14:56:34:183]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)
    MSI (s) (BC:10) [14:56:34:183]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)
    MSI (s) (BC:10) [14:56:34:183]: Executing op: FileCopy(SourceName=ssp.exe,SourceCabKey=ssp.exe,DestName=ssp.exe,Attributes=512,FileSize=5366040,PerTick=65536,,VerifyMedia=1,,,,SecurityDescriptor=BinaryData,CheckCRC=0,Version=2.6.0.71,Language=2057,InstallMode=58982400,,,,,,,)
    MSI (s) (BC:10) [14:56:34:183]: File: C:\Program Files\Sophos\Sophos System Protection\ssp.exe; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:183]: Source for file 'ssp.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\'.
    MSI (s) (BC:10) [14:56:34:183]: File will have security applied from OpCode.
    MSI (s) (BC:10) [14:56:34:198]: Executing op: FileCopy(SourceName=n47spcl4.dll|SspAdapter.dll,SourceCabKey=SspAdapter.dll,DestName=SspAdapter.dll,Attributes=512,FileSize=635936,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=2.6.0.71,Language=2057,InstallMode=58982400,,,,,,,)
    MSI (s) (BC:10) [14:56:34:198]: File: C:\Program Files\Sophos\Sophos System Protection\SspAdapter.dll; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:198]: Source for file 'SspAdapter.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\'.
    MSI (s) (BC:10) [14:56:34:214]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)
    MSI (s) (BC:10) [14:56:34:214]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)
    MSI (s) (BC:10) [14:56:34:214]: Executing op: FileCopy(SourceName=hy6kgivw.con|SXA.conf,SourceCabKey=SXA.conf,DestName=SXA.conf,Attributes=512,FileSize=117,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=1443997366,HashPart2=1950740203,HashPart3=-1509326715,HashPart4=-1802581291,,)
    MSI (s) (BC:10) [14:56:34:214]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\SXA.conf; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:214]: Source for file 'SXA.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\Config\'.
    MSI (s) (BC:10) [14:56:34:214]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)
    MSI (s) (BC:10) [14:56:34:214]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)
    MSI (s) (BC:10) [14:56:34:214]: Executing op: FileCopy(SourceName=sfegal9r.exe|TelemetryPlugin.exe,SourceCabKey=TelemetryPluginFile,DestName=TelemetryPlugin.exe,Attributes=9728,FileSize=385552,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=2.6.0.71,Language=2057,InstallMode=58982400,,,,,,,)
    MSI (s) (BC:10) [14:56:34:214]: File: C:\Program Files\Sophos\Sophos System Protection\TelemetryPlugin.exe; To be installed; Won't patch; No existing file
    MSI (s) (BC:10) [14:56:34:214]: Source for file 'TelemetryPlugin.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\Sophos\Sophos System Protection\'.
    MSI (s) (BC:10) [14:56:34:214]: Executing op: CacheSizeFlush(,)
    MSI (s) (BC:10) [14:56:34:214]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values Key: [1], Name: [2], Value: [3],)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: ProgressTotal(Total=5,Type=1,ByteEquivalent=13200)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\SystemProtection,SecurityDescriptor=BinaryData,BinaryType=0,,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: RegAddValue(Name=PipeName,Value=\\.\Pipe\phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpre,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\SystemProtection\LOG,SecurityDescriptor=BinaryData,BinaryType=0,,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: RegAddValue(Name=File,Value=C:\ProgramData\Sophos\Sophos System Protection\Logs\,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: RegAddValue(Name=Level,Value=1,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Sophos\Telemetry\Plugins\SSP,,BinaryType=0,,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: RegAddValue(Name=Path,Value=C:\Program Files\Sophos\Sophos System Protection\TelemetryPlugin.exe,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: RegAddValue(Name=Cmd,Value=TelemetryPlugin.exe,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: ActionStart(Name=InstallServices,Description=Installing new services Service: [2],)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: ProgressTotal(Total=2,Type=1,ByteEquivalent=1300000)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: ServiceInstall(Name=sophossps,DisplayName=Sophos System Protection Service,ImagePath="C:\Program Files\Sophos\Sophos System Protection\ssp.exe",ServiceType=16,StartType=2,ErrorControl=32769,,Dependencies=Movie,,StartName=NT AUTHORITY\NetworkService,Password=**********,Description=Sophos System Protection Service,,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: ServiceInstall(Name=SophosDataRecorderService,DisplayName=Sophos Data Recorder,ImagePath="C:\Program Files\Sophos\Sophos Data Recorder\SDRService.exe",ServiceType=16,StartType=2,ErrorControl=32769,,Dependencies=Movie,,,Password=**********,Description=Sophos Data Recorder,,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: ActionStart(Name=RequestUnrestrictedSSPSid,,)
    MSI (s) (BC:10) [14:56:34:229]: Executing op: CustomActionSchedule(Action=RequestUnrestrictedSSPSid,ActionType=1025,Source=BinaryData,Target=RequestUnrestrictedSSPSid,)
    MSI (s) (BC:F0) [14:56:34:229]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIFF5C.tmp, Entrypoint: RequestUnrestrictedSSPSid
    MSI (s) (BC:10) [14:56:34:320]: Executing op: ActionStart(Name=ApplyPermissionsToSspFolders,,)
    RequestUnrestrictedSSPSid: Initialized.
    MSI (s) (BC:10) [14:56:34:320]: Executing op: CustomActionSchedule(Action=ApplyPermissionsToSspFolders,ActionType=1025,Source=BinaryData,Target=ApplyPermissionsToSspFolders,CustomActionData=C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\|C:\ProgramData\Sophos\Sophos System Protection\Data\|C:\ProgramData\Sophos\Sophos System Protection\Data\Health|C:\ProgramData\Sophos\Sophos System Protection\Data\RCA|C:\ProgramData\Sophos\Sophos System Protection\Data\Snapshots|C:\ProgramData\Sophos\Sophos System Protection\Data\Saved Data)
    MSI (s) (BC:08) [14:56:34:320]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIFFBB.tmp, Entrypoint: ApplyPermissionsToSspFolders
    MSI (s) (BC:10) [14:56:34:550]: Executing op: ActionStart(Name=ApplyPermissionsToSdrFolders,,)
    ApplyPermissionsToSspFolders: Initialized.
    MSI (s) (BC:10) [14:56:34:550]: Executing op: CustomActionSchedule(Action=ApplyPermissionsToSdrFolders,ActionType=1025,Source=BinaryData,Target=ApplyPermissionsToSdrFolders,CustomActionData=C:\ProgramData\Sophos\Sophos Data Recorder\|C:\ProgramData\Sophos\Sophos Data Recorder\data\|C:\ProgramData\Sophos\Sophos Data Recorder\outbound\|C:\ProgramData\Sophos\Sophos Data Recorder\commands\)
    MSI (s) (BC:94) [14:56:34:550]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIA6.tmp, Entrypoint: ApplyPermissionsToSdrFolders
    MSI (s) (BC:10) [14:56:34:659]: Executing op: ActionStart(Name=RollbackServiceConfig,,)
    ApplyPermissionsToSdrFolders: Initialized.
    MSI (s) (BC:10) [14:56:34:659]: Executing op: CustomActionSchedule(Action=RollbackServiceConfig,ActionType=3329,Source=BinaryData,Target=RollbackServiceConfig,CustomActionData=SchedServiceConfig)
    MSI (s) (BC:10) [14:56:34:659]: Executing op: ActionStart(Name=ExecServiceConfig,,)
    MSI (s) (BC:10) [14:56:34:659]: Executing op: CustomActionSchedule(Action=ExecServiceConfig,ActionType=3073,Source=BinaryData,Target=ExecServiceConfig,CustomActionData=SchedServiceConfig€sophossps€1€restart€restart€none€1€120€€€SophosDataRecorderService€1€restart€restart€none€1€120€€)
    MSI (s) (BC:88) [14:56:34:659]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI114.tmp, Entrypoint: ExecServiceConfig
    MSI (s) (BC:10) [14:56:34:768]: Executing op: ActionStart(Name=CreateDefaultPolicyConfig,,)
    MSI (s) (BC:10) [14:56:34:768]: Executing op: CustomActionSchedule(Action=CreateDefaultPolicyConfig,ActionType=1025,Source=BinaryData,Target=CreateDefaultPolicyConfig,CustomActionData=NT SERVICE\sophossps)
    MSI (s) (BC:5C) [14:56:34:768]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI183.tmp, Entrypoint: CreateDefaultPolicyConfig
    CreateDefaultPolicyConfig: Initialized.
    CreateDefaultPolicyConfig: About to create default policy configuration
    CreateDefaultPolicyConfig: Creating new empty value for: rca_upload_uri
    CreateDefaultPolicyConfig: Creating new empty value for: rca_upload_header_names
    CreateDefaultPolicyConfig: Creating new empty value for: rca_upload_header_values
    CreateDefaultPolicyConfig: Creating new empty value for: snapshot_upload_uri
    CreateDefaultPolicyConfig: Creating new empty value for: snapshot_upload_header_names
    CreateDefaultPolicyConfig: Creating new empty value for: snapshot_upload_header_values
    MSI (s) (BC:10) [14:56:35:036]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,)
    CreateDefaultPolicyConfig: Created default policy configuration
    MSI (s) (BC:10) [14:56:35:036]: Executing op: CustomActionSchedule(Action=SetupSspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sophossps)
    MSI (s) (BC:10) [14:56:35:037]: Executing op: ActionStart(Name=SetupSspUserAccount,,)
    MSI (s) (BC:10) [14:56:35:037]: Executing op: CustomActionSchedule(Action=SetupSspUserAccount,ActionType=1025,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sophossps)
    MSI (s) (BC:70) [14:56:35:039]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI28D.tmp, Entrypoint: SetupSspUserAccount
    SetupSspUserAccount: Initialized.
    SetupSspUserAccount: LoadAccount(SophosSSPUser) failed (error 1332)
    SetupSspUserAccount: Granting permissions to user "NT SERVICE\sophossps"
    MSI (s) (BC:10) [14:56:35:100]: Executing op: ActionStart(Name=SetupShsUserAccountRollback,,)
    SetupSspUserAccount: Service is not running (current state is 1).
    MSI (s) (BC:10) [14:56:35:100]: Executing op: CustomActionSchedule(Action=SetupShsUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpShsUserAccount,CustomActionData=NT SERVICE\sophossps)
    MSI (s) (BC:10) [14:56:35:100]: Executing op: ActionStart(Name=SetupShsUserAccount,,)
    MSI (s) (BC:10) [14:56:35:100]: Executing op: CustomActionSchedule(Action=SetupShsUserAccount,ActionType=1025,Source=BinaryData,Target=SetupShsUserAccount,CustomActionData=NT SERVICE\sophossps;GENERIC_READ)
    MSI (s) (BC:DC) [14:56:35:116]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI2CD.tmp, Entrypoint: SetupShsUserAccount
    SetupShsUserAccount: Initialized.
    MSI (s) (BC:10) [14:56:35:147]: Executing op: ActionStart(Name=CreateSnapshotTriggerRegKey,,)
    SetupShsUserAccount: Granting permissions to user "NT SERVICE\sophossps"
    MSI (s) (BC:10) [14:56:35:147]: Executing op: CustomActionSchedule(Action=CreateSnapshotTriggerRegKey,ActionType=1025,Source=BinaryData,Target=CreateSnapshotTriggerRegKey,CustomActionData=NT SERVICE\sophossps)
    MSI (s) (BC:D8) [14:56:35:162]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI2FD.tmp, Entrypoint: CreateSnapshotTriggerRegKey
    CreateSnapshotTriggerRegKey: Initialized.
    CreateSnapshotTriggerRegKey: About to create snapshot trigger registry key
    MSI (s) (BC:10) [14:56:35:225]: Executing op: ActionStart(Name=CreateTelemetryStorage,,)
    CreateSnapshotTriggerRegKey: Created snapshot trigger registry key
    MSI (s) (BC:10) [14:56:35:225]: Executing op: CustomActionSchedule(Action=CreateTelemetryStorage,ActionType=1025,Source=BinaryData,Target=CreateTelemetryStorage,CustomActionData=NT SERVICE\sophossps)
    MSI (s) (BC:34) [14:56:35:225]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI34C.tmp, Entrypoint: CreateTelemetryStorage
    CreateTelemetryStorage: Initialized.
    CreateTelemetryStorage: About to create telemetry registry key
    MSI (s) (BC:10) [14:56:35:319]: Executing op: ActionStart(Name=StartServices,Description=Starting services Service: [1],)
    CreateTelemetryStorage: Created telemetry registry key
    MSI (s) (BC:10) [14:56:35:319]: Executing op: ProgressTotal(Total=2,Type=1,ByteEquivalent=1300000)
    MSI (s) (BC:10) [14:56:35:319]: Executing op: ServiceControl(,Name=sophossps,Action=1,Wait=1,)
    MSI (s) (BC:10) [14:56:38:728]: Executing op: ServiceControl(,Name=SophosDataRecorderService,Action=1,Wait=1,)
    MSI (s) (BC:10) [14:56:39:821]: Executing op: ActionStart(Name=EnableAndLoadMcsAdapterRollback,,)
    MSI (s) (BC:10) [14:56:39:821]: Executing op: CustomActionSchedule(Action=EnableAndLoadMcsAdapterRollback,ActionType=1281,Source=BinaryData,Target=DisableAndUnloadMcsAdapter,CustomActionData=C:\Program Files\Sophos\Sophos System Protection\SspAdapter.dll)
    MSI (s) (BC:10) [14:56:39:821]: Executing op: ActionStart(Name=EnableAndLoadMcsAdapter,,)
    MSI (s) (BC:10) [14:56:39:821]: Executing op: CustomActionSchedule(Action=EnableAndLoadMcsAdapter,ActionType=1025,Source=BinaryData,Target=EnableAndLoadMcsAdapter,CustomActionData=C:\Program Files\Sophos\Sophos System Protection\SspAdapter.dll)
    MSI (s) (BC:24) [14:56:39:821]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI153F.tmp, Entrypoint: EnableAndLoadMcsAdapter
    EnableAndLoadMcsAdapter: Initialized.
    MSI (s) (BC:10) [14:56:39:914]: Executing op: ActionStart(Name=StartSdrServiceRollback,,)
    EnableAndLoadMcsAdapter: Created SSP adapter key
    MSI (s) (BC:10) [14:56:39:914]: Executing op: CustomActionSchedule(Action=StartSdrServiceRollback,ActionType=1281,Source=BinaryData,Target=StopService,CustomActionData=SophosDataRecorderService)
    MSI (s) (BC:10) [14:56:39:914]: Executing op: ActionStart(Name=StartSdrService,,)
    MSI (s) (BC:10) [14:56:39:914]: Executing op: CustomActionSchedule(Action=StartSdrService,ActionType=1025,Source=BinaryData,Target=StartServiceAndWait,CustomActionData=SophosDataRecorderService)
    MSI (s) (BC:10) [14:56:39:914]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI159D.tmp, Entrypoint: StartServiceAndWait
    MSI (s) (BC:10) [14:56:40:088]: Executing op: ActionStart(Name=StartSspServiceRollback,,)
    StartService: Initialized.
    MSI (s) (BC:10) [14:56:40:088]: Executing op: CustomActionSchedule(Action=StartSspServiceRollback,ActionType=1281,Source=BinaryData,Target=StopService,CustomActionData=sophossps)
    MSI (s) (BC:10) [14:56:40:088]: Executing op: ActionStart(Name=StartSspService,,)
    MSI (s) (BC:10) [14:56:40:088]: Executing op: CustomActionSchedule(Action=StartSspService,ActionType=1025,Source=BinaryData,Target=StartServiceAndWait,CustomActionData=sophossps)
    MSI (s) (BC:DC) [14:56:40:197]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI16B8.tmp, Entrypoint: StartServiceAndWait
    MSI (s) (BC:10) [14:56:40:322]: Executing op: ActionStart(Name=RegisterProduct,Description=Registering product [1],)
    StartService: Initialized.
    MSI (s) (BC:10) [14:56:40:322]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=0,CopierType=0,,,,,,IsFirstPhysicalMedia=1)
    MSI (s) (BC:10) [14:56:40:322]: Executing op: DatabaseCopy(DatabasePath=C:\WINDOWS\Installer\24e5c22b.msi,ProductCode={934BEF80-B9D1-4A86-8B42-D8A6716A8D27},,,)
    MSI (s) (BC:10) [14:56:40:322]: Note: 1: 1402 2: UNKNOWN\Products\08FEB4391D9B68A4B8248D6A17A6D872\InstallProperties 3: 2
    MSI (s) (BC:10) [14:56:40:322]: File will have security applied from OpCode.
    MSI (s) (BC:10) [14:56:40:322]: Executing op: ProductRegister(UpgradeCode={54AA7E32-35B0-46F6-B2BD-8540035852FF},VersionString=2.6.0.71,HelpLink=www.sophos.com/.../contacting,,InstallSource=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\,Publisher=Sophos Limited,URLInfoAbout=www.sophos.com,URLUpdateInfo=http:/.../updates,,NoModify=1,NoRepair=1,,Comments=Sophos System Protection helps protect your system from threats.,Contact=Sophos Technical Support,,,SystemComponent=1,EstimatedSize=7480,,,,)
    MSI (s) (BC:10) [14:56:40:338]: Executing op: ProductCPDisplayInfoRegister()
    MSI (s) (BC:10) [14:56:40:338]: Executing op: ActionStart(Name=PublishFeatures,Description=Publishing Product Features Feature: [1],)
    MSI (s) (BC:10) [14:56:40:338]: Executing op: FeaturePublish(Feature=ProductFeature,,Absent=2,Component=3QOOXzF5N9.@OLCytHnO5VkWu]hC1@uq)4_un%3--x$'v{avOAO@![Ax'FBLQ9)3cUkhR==Rl,6%Fs^wcSqhPfpt(?*}MkMP`syR[WPg&mY^'A~YMWv47!}nQ17'F?V=q?bH]dJ`)d`faJ[S)GC8b@UB+@860l_fQwB.a5Q-]AcYWz$eO,?=8ag%kUCdc=UnJrT0P@8CgX'VF}TFr9EYnd7&pyE3EcWj=ix8e@GFFbf3T,QNP%`sw+(_cAvjJHW8*'&'yR3!wx_6~=GXwVCwhWe*^pt~db1QdA(4+J!3ZM.bEHm$`5CS)9XpEs-)AW3`*mO_bk40WAZ?c9GP!]kO~t@2oGDu(@DmNHOY@pk6gQqg-KOas=%)zVOiQfk60!{ouX0Qc@+gh1]WZFRUwp5LAp4cz8LczEv[*6jv0lidHzSNl=+cO}5n[,m+tccGOY1[0Aq}^c[e[352L%Vj'St'W9)L@&M~u41Dpx}RKy$h09L]%'!6ko4=2(u%`eUoEAm*UAgp$xoR'Y`DT8h9_=lF*I%~-k=%rPw(80!oJA]'Yv1NqPDXzST0k.sW{=$hCM%MqZB3_98ZD+m@.AOJLbD&xz@x1t&*5+dcI@Kb*2`{l=y'E7z{(6p7!?08uTsld-9wlm,oe^e_d9+.!zt={Ov8%fQCd2f_KAcn7=8Nm{ZcK(Hni=wQI=~t0=o-Z'qJTOcGKCjJx=Yt$gj0l@K()r*TZ4Ln0?M$Q0dIWv@G)
    MSI (s) (BC:10) [14:56:40:338]: Executing op: ActionStart(Name=PublishProduct,Description=Publishing product information,)
    MSI (s) (BC:10) [14:56:40:338]: Executing op: IconCreate(Icon=sspIcon.ico,Data=BinaryData)
    MSI (s) (BC:10) [14:56:40:338]: Executing op: CleanupConfigData()
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\08FEB4391D9B68A4B8248D6A17A6D872\Patches 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Executing op: RegisterPatchOrder(Continue=0,SequenceType=1,Remove=0)
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Products\08FEB4391D9B68A4B8248D6A17A6D872\Patches 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Executing op: ProductPublish(PackageKey={87CFF70C-FF71-4317-897A-843822E95859})
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Executing op: UpgradeCodePublish(UpgradeCode={54AA7E32-35B0-46F6-B2BD-8540035852FF})
    MSI (s) (BC:10) [14:56:40:338]: Executing op: SourceListPublish(,,,,NumberOfDisks=1)
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 1402 2: UNKNOWN\Installer\Products\08FEB4391D9B68A4B8248D6A17A6D872\SourceList 3: 2
    MSI (s) (BC:10) [14:56:40:338]: Executing op: ProductPublishClient(,,)
    MSI (s) (BC:10) [14:56:40:338]: Executing op: SourceListRegisterLastUsed(SourceProduct={934BEF80-B9D1-4A86-8B42-D8A6716A8D27},LastUsedSource=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\)
    MSI (s) (BC:10) [14:56:40:338]: Entering CMsiConfigurationManager::SetLastUsedSource.
    MSI (s) (BC:10) [14:56:40:338]: Specifed source is already in a list.
    MSI (s) (BC:10) [14:56:40:338]: User policy value 'SearchOrder' is 'nmu'
    MSI (s) (BC:10) [14:56:40:338]: Adding new sources is allowed.
    MSI (s) (BC:10) [14:56:40:338]: Set LastUsedSource to: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\.
    MSI (s) (BC:10) [14:56:40:338]: Set LastUsedType to: n.
    MSI (s) (BC:10) [14:56:40:338]: Set LastUsedIndex to: 1.
    MSI (s) (BC:10) [14:56:40:338]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=18204948)
    MSI (s) (BC:10) [14:56:40:338]: Note: 1: 2265 2: 3: -2147287035
    MSI (s) (BC:10) [14:56:40:338]: User policy value 'DisableRollback' is 0
    MSI (s) (BC:10) [14:56:40:338]: Machine policy value 'DisableRollback' is 0
    MSI (s) (BC:10) [14:56:40:384]: Note: 1: 2265 2: 3: -2147287035
    MSI (s) (BC:10) [14:56:40:384]: Note: 1: 2318 2:
    MSI (s) (BC:10) [14:56:40:384]: No System Restore sequence number for this installation.
    MSI (s) (BC:10) [14:56:40:384]: Unlocking Server
    MSI (s) (BC:10) [14:56:40:384]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
    MSI (s) (BC:10) [14:56:40:384]: Doing action: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0
    MSI (s) (BC:10) [14:56:40:384]: Note: 1: 2205 2: 3: ActionText
    Action ended 14:56:40: InstallFinalize. Return value 1.
    MSI (s) (BC:8C) [14:56:40:384]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI1775.tmp, Entrypoint: RegisterWithAutoUpdateMSI
    Action start 14:56:40: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0.
    MSI (s) (BC:10) [14:56:40:402]: Skipping action: UnregisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 (condition is false)
    Action ended 14:56:40: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0. Return value 1.
    Action ended 14:56:40: INSTALL. Return value 1.
    Property(S): Data = C:\ProgramData\Sophos\Sophos System Protection\Data\
    Property(S): UpgradeCode = {54AA7E32-35B0-46F6-B2BD-8540035852FF}
    Property(S): INSTALLDIR = C:\Program Files\Sophos\Sophos System Protection\
    Property(S): INSTALLDIRSDR = C:\Program Files\Sophos\Sophos Data Recorder\
    Property(S): ProgramFilesFolder = C:\Program Files (x86)\
    Property(S): Config = C:\ProgramData\Sophos\Sophos System Protection\Config\
    Property(S): Rules = C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\
    Property(S): Logs = C:\ProgramData\Sophos\Sophos System Protection\Logs\
    Property(S): DataHealth = C:\ProgramData\Sophos\Sophos System Protection\Data\Health\
    Property(S): DataRCA = C:\ProgramData\Sophos\Sophos System Protection\Data\RCA\
    Property(S): Datasnapshot = C:\ProgramData\Sophos\Sophos System Protection\Data\Snapshots\
    Property(S): DataSavedData = C:\ProgramData\Sophos\Sophos System Protection\Data\Saved Data\
    Property(S): EventsStaging = C:\ProgramData\Sophos\Sophos System Protection\Data\Events\Staging\
    Property(S): EventsCloudOutgoingQueue = C:\ProgramData\Sophos\Sophos System Protection\Data\Events\CloudOutgoingQueue\
    Property(S): EventsCloudIncomingQueue = C:\ProgramData\Sophos\Sophos System Protection\Data\Events\CloudIncomingQueue\
    Property(S): DataCommandsSDR = C:\ProgramData\Sophos\Sophos Data Recorder\commands\
    Property(S): DataConfigurationSDR = C:\ProgramData\Sophos\Sophos Data Recorder\configuration\
    Property(S): DataDataSDR = C:\ProgramData\Sophos\Sophos Data Recorder\data\
    Property(S): DataLogsSDR = C:\ProgramData\Sophos\Sophos Data Recorder\logs\
    Property(S): DataOutboundSDR = C:\ProgramData\Sophos\Sophos Data Recorder\outbound\
    Property(S): DataTempSDR = C:\ProgramData\Sophos\Sophos Data Recorder\temp\
    Property(S): StartSspServiceRollback = sophossps
    Property(S): StartSspService = sophossps
    Property(S): StartSdrServiceRollback = SophosDataRecorderService
    Property(S): StartSdrService = SophosDataRecorderService
    Property(S): ApplyPermissionsToSspFolders = C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Config\Rules\|C:\ProgramData\Sophos\Sophos System Protection\Data\|C:\ProgramData\Sophos\Sophos System Protection\Data\Health|C:\ProgramData\Sophos\Sophos System Protection\Data\RCA|C:\ProgramData\Sophos\Sophos System Protection\Data\Snapshots|C:\ProgramData\Sophos\Sophos System Protection\Data\Saved Data
    Property(S): ApplyPermissionsToSdrFolders = C:\ProgramData\Sophos\Sophos Data Recorder\|C:\ProgramData\Sophos\Sophos Data Recorder\data\|C:\ProgramData\Sophos\Sophos Data Recorder\outbound\|C:\ProgramData\Sophos\Sophos Data Recorder\commands\
    Property(S): SetupSspUserAccount = NT SERVICE\sophossps
    Property(S): SetupSspUserAccountRollback = NT SERVICE\sophossps
    Property(S): SetupShsUserAccount = NT SERVICE\sophossps;GENERIC_READ
    Property(S): SetupShsUserAccountRollback = NT SERVICE\sophossps
    Property(S): CreateSnapshotTriggerRegKey = NT SERVICE\sophossps
    Property(S): RegisterWithAutoUpdate = {F8FFD42E-47AC-4CFF-9E27-EC84ED62128E};ssp;
    Property(S): CreateTelemetryStorage = NT SERVICE\sophossps
    Property(S): ExecServiceConfig = SchedServiceConfig€sophossps€1€restart€restart€none€1€120€€€SophosDataRecorderService€1€restart€restart€none€1€120€€
    Property(S): RollbackServiceConfig = SchedServiceConfig
    Property(S): EnableAndLoadMcsAdapterRollback = C:\Program Files\Sophos\Sophos System Protection\SspAdapter.dll
    Property(S): EnableAndLoadMcsAdapter = C:\Program Files\Sophos\Sophos System Protection\SspAdapter.dll
    Property(S): CreateDefaultPolicyConfig = NT SERVICE\sophossps
    Property(S): TARGETDIR = C:\
    Property(S): ProgramFiles64Folder = C:\Program Files\
    Property(S): CommonAppDataFolder = C:\ProgramData\
    Property(S): SourceDir = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\
    Property(S): Sophos = C:\Program Files\Sophos\
    Property(S): AppDataSsp = C:\ProgramData\Sophos\Sophos System Protection\
    Property(S): Events = C:\ProgramData\Sophos\Sophos System Protection\Data\Events\
    Property(S): AppDataSophos = C:\ProgramData\Sophos\
    Property(S): AppDataSDR = C:\ProgramData\Sophos\Sophos Data Recorder\
    Property(S): VersionNT = 603
    Property(S): VersionNT64 = 603
    Property(S): ALLUSERS = 1
    Property(S): ARPCOMMENTS = Sophos System Protection helps protect your system from threats.
    Property(S): ARPCONTACT = Sophos Technical Support
    Property(S): ARPPRODUCTICON = sspIcon.ico
    Property(S): ARPHELPLINK = http://www.sophos.com/support
    Property(S): ARPURLINFOABOUT = http://www.sophos.com
    Property(S): ARPURLUPDATEINFO = www.sophos.com/.../updates
    Property(S): ARPHELPTELEPHONE = www.sophos.com/.../contacting
    Property(S): ARPNOMODIFY = 1
    Property(S): ARPNOREPAIR = 1
    Property(S): MSIRESTARTMANAGERCONTROL = Disable
    Property(S): Manufacturer = Sophos Limited
    Property(S): ProductCode = {934BEF80-B9D1-4A86-8B42-D8A6716A8D27}
    Property(S): ProductLanguage = 1033
    Property(S): ProductName = Sophos System Protection
    Property(S): ProductVersion = 2.6.0.71
    Property(S): SecureCustomProperties = WIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTED
    Property(S): INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 = C:\
    Property(S): MsiLogFileLocation = C:\WINDOWS\TEMP\SophosSystemProtectionSetup_170821_095632.log
    Property(S): PackageCode = {87CFF70C-FF71-4317-897A-843822E95859}
    Property(S): ProductState = -1
    Property(S): PackagecodeChanging = 1
    Property(S): INSTALLINGVERSION = 2.6.0.71
    Property(S): REBOOT = ReallySuppress
    Property(S): ARPSYSTEMCOMPONENT = 1
    Property(S): CURRENTDIRECTORY = C:\WINDOWS\system32
    Property(S): CLIENTUILEVEL = 3
    Property(S): CLIENTPROCESSID = 4016
    Property(S): MsiSystemRebootPending = 1
    Property(S): VersionDatabase = 200
    Property(S): VersionMsi = 5.00
    Property(S): WindowsBuild = 9600
    Property(S): ServicePackLevel = 0
    Property(S): ServicePackLevelMinor = 0
    Property(S): MsiNTProductType = 1
    Property(S): WindowsFolder = C:\WINDOWS\
    Property(S): WindowsVolume = C:\
    Property(S): System64Folder = C:\WINDOWS\system32\
    Property(S): SystemFolder = C:\WINDOWS\SysWOW64\
    Property(S): RemoteAdminTS = 1
    Property(S): TempFolder = C:\WINDOWS\TEMP\
    Property(S): CommonFilesFolder = C:\Program Files (x86)\Common Files\
    Property(S): CommonFiles64Folder = C:\Program Files\Common Files\
    Property(S): AppDataFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\
    Property(S): FavoritesFolder = C:\WINDOWS\system32\config\systemprofile\Favorites\
    Property(S): NetHoodFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
    Property(S): PersonalFolder = C:\WINDOWS\system32\config\systemprofile\Documents\
    Property(S): PrintHoodFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
    Property(S): RecentFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\
    Property(S): SendToFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\
    Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
    Property(S): LocalAppDataFolder = C:\WINDOWS\system32\config\systemprofile\AppData\Local\
    Property(S): MyPicturesFolder = C:\WINDOWS\system32\config\systemprofile\Pictures\
    Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
    Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
    Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
    Property(S): DesktopFolder = C:\Users\Public\Desktop\
    Property(S): FontsFolder = C:\WINDOWS\Fonts\
    Property(S): GPTSupport = 1
    Property(S): OLEAdvtSupport = 1
    Property(S): ShellAdvtSupport = 1
    Property(S): MsiAMD64 = 6
    Property(S): Msix64 = 6
    Property(S): Intel = 6
    Property(S): PhysicalMemory = 7818
    Property(S): VirtualMemory = 16552
    Property(S): AdminUser = 1
    Property(S): MsiTrueAdminUser = 1
    Property(S): LogonUser = SYSTEM
    Property(S): UserSID = S-1-5-18
    Property(S): UserLanguageID = 1033
    Property(S): ComputerName = OAK-EE2015-LH
    Property(S): SystemLanguageID = 1033
    Property(S): ScreenX = 1024
    Property(S): ScreenY = 768
    Property(S): CaptionHeight = 23
    Property(S): BorderTop = 1
    Property(S): BorderSide = 1
    Property(S): MsiTabletPC = 1
    Property(S): TextHeight = 16
    Property(S): TextInternalLeading = 3
    Property(S): ColorBits = 32
    Property(S): TTCSupport = 1
    Property(S): Time = 14:56:40
    Property(S): Date = 8/21/2017
    Property(S): MsiNetAssemblySupport = 4.7.2046.0
    Property(S): MsiWin32AssemblySupport = 6.3.15063.0
    Property(S): RedirectedDllSupport = 2
    Property(S): MsiRunningElevated = 1
    Property(S): Privileged = 1
    Property(S): USERNAME = bkiadmin
    Property(S): DATABASE = C:\WINDOWS\Installer\24e5c22b.msi
    Property(S): OriginalDatabase = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\SophosSystemProtection.msi
    Property(S): UILevel = 2
    Property(S): ACTION = INSTALL
    Property(S): ROOTDRIVE = C:\
    Property(S): CostingComplete = 1
    Property(S): OutOfDiskSpace = 0
    Property(S): OutOfNoRbDiskSpace = 0
    Property(S): PrimaryVolumeSpaceAvailable = 0
    Property(S): PrimaryVolumeSpaceRequired = 0
    Property(S): PrimaryVolumeSpaceRemaining = 0
    Property(S): INSTALLLEVEL = 1
    Property(S): SOURCEDIR = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp64\
    Property(S): SourcedirProduct = {934BEF80-B9D1-4A86-8B42-D8A6716A8D27}
    Property(S): GeneratedRandString = phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpre
    Property(S): ProductToBeRegistered = 1
    MSI (s) (BC:10) [14:56:40:417]: Note: 1: 1707
    MSI (s) (BC:10) [14:56:40:417]: Product: Sophos System Protection -- Installation completed successfully.

    MSI (s) (BC:10) [14:56:40:417]: Windows Installer installed the product. Product Name: Sophos System Protection. Product Version: 2.6.0.71. Product Language: 1033. Manufacturer: Sophos Limited. Installation success or error status: 0.

    MSI (s) (BC:10) [14:56:40:420]: Deferring clean up of packages/files, if any exist
    MSI (s) (BC:10) [14:56:40:420]: MainEngineThread is returning 0
    MSI (s) (BC:38) [14:56:40:420]: No System Restore sequence number for this installation.
    === Logging stopped: 8/21/2017 14:56:40 ===
    MSI (s) (BC:38) [14:56:40:464]: User policy value 'DisableRollback' is 0
    MSI (s) (BC:38) [14:56:40:464]: Machine policy value 'DisableRollback' is 0
    MSI (s) (BC:38) [14:56:40:464]: Incrementing counter to disable shutdown. Counter after increment: 0
    MSI (s) (BC:38) [14:56:40:464]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
    MSI (s) (BC:38) [14:56:40:480]: Note: 1: 2265 2: 3: -2147287035
    MSI (s) (BC:38) [14:56:40:480]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
    MSI (s) (BC:38) [14:56:40:480]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
    MSI (s) (BC:38) [14:56:40:480]: Destroying RemoteAPI object.
    MSI (s) (BC:48) [14:56:40:480]: Custom Action Manager thread ending.
    MSI (c) (B0:8C) [14:56:40:480]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
    MSI (c) (B0:8C) [14:56:40:480]: MainEngineThread is returning 0
    === Verbose logging stopped: 8/21/2017 14:56:40 ===

    2017-08-21 14:56:40 Info: Exit code from MsiInstallProduct: ERROR_SUCCESS
    2017-08-21 14:56:40 Successfully registered for tamper protection with Sophos Endpoint Defense.

  • In reply to skouki:

    When you say:

    "I make sure to set it back to automatic"

    Has the startup type of the service been changed from the expected automatic to either disabled or manual?  If so that would be an issue.

    The MSI log suggests that the service would have been started and the SSP log backs that up.

    MSI log is from:
    2017-08-21 14:56:32 --> 2017-08-21 14:56:40
    So 8 seconds to install the SSP component which is fine.

    So after the install it seems that the SSP service was stopped at I 21/08/2017 14:58:16 and then started again in the same second.  So not a system restart and then again at 3PM

    I 21/08/2017 14:56:35 Process starting
    I 21/08/2017 14:56:35 Service start requested
    I 21/08/2017 14:56:35 Sophos System Protection 2.6.0.71
    I 21/08/2017 14:56:35 HST: Database not found, creating
    I 21/08/2017 14:56:37 HST: Created database


    I 21/08/2017 14:58:16 The service has been requested to stop
    I 21/08/2017 14:58:16 Process stopping
    I 21/08/2017 14:58:16 Sophos System Protection is shutting down (0)
    I 21/08/2017 14:58:16 The Sophos System Protection service has stopped
    I 21/08/2017 14:58:16 Process starting
    I 21/08/2017 14:58:16 Service start requested
    I 21/08/2017 14:58:16 Sophos System Protection 2.6.0.71

    I 21/08/2017 15:00:47 The service has been requested to stop
    I 21/08/2017 15:00:47 Process stopping
    I 21/08/2017 15:00:47 Sophos System Protection is shutting down (0)
    I 21/08/2017 15:00:47 The Sophos System Protection service has stopped
    I 21/08/2017 15:00:47 Process starting
    I 21/08/2017 15:00:47 Service start requested
    I 21/08/2017 15:00:47 Sophos System Protection 2.6.0.71

    I 21/08/2017 15:00:53 The service has been requested to stop
    I 21/08/2017 15:00:53 Process stopping
    I 21/08/2017 15:00:53 Sophos System Protection is shutting down (0)
    I 21/08/2017 15:00:53 The Sophos System Protection service has stopped
    I 21/08/2017 15:00:53 Process starting
    I 21/08/2017 15:00:53 Service start requested
    I 21/08/2017 15:00:53 Sophos System Protection 2.6.0.71

    I 15/09/2017 07:48:36 Process starting
    I 15/09/2017 07:48:36 Service start requested
    I 15/09/2017 07:48:38 Sophos System Protection 2.6.0.71

    I 15/09/2017 08:03:09 Process starting
    I 15/09/2017 08:03:09 Service start requested
    I 15/09/2017 08:03:11 Sophos System Protection 2.6.0.71

    I 15/09/2017 17:51:15 Process starting
    I 15/09/2017 17:51:15 Service start requested
    I 15/09/2017 17:51:19 Sophos System Protection 2.6.0.71

    I 05/10/2017 08:03:19 Process starting
    I 05/10/2017 08:03:19 Service start requested
    I 05/10/2017 08:03:23 Sophos System Protection 2.6.0.71

    These later times look as expected, I.e. perhaps when the computer was started.

    Without correlating events with either the event log or even other logs under \windows\temp, it's impossible to say why the service was stopped at the times it was but this log should at least give the times to consider.

    Regards,

    Jak

  • In reply to jak:

    This cannot happen every time there is a Windows Update!  This needs to be fixed.  Many of my PCs are remote and I have no way of manually starting up services that should start automatically!  I can't believe this cannot be controlled through the Sophos Central console.