Its current value is 'C:\Program Files\Sophos\Sophos System Protection'. Return value 1.Action start 16:21:07: CleanUpSsspUserAccountRollback.MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount.SetPropertyVistaOrLater (condition is false)MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount.SetPropertyXp (condition is false)MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount (condition is false)MSI (s) (24:B8) [16:21:07:026]: Doing action: ApplyPermissionsToFoldersOnRollback.SetPropertyMSI (s) (24:B8) [16:21:07:026]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CleanUpSsspUserAccountRollback. Its value is 'C:\Windows\system32'.MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. And they are all running fine. Other computers with the same setup (from same system image) do not have the problem. DLL: C:\Windows\Installer\MSI67CA.tmp, Entrypoint: SetupSspUserAccountSetupSspUserAccount: Initialized.SetupSspUserAccount: LoadAccount(SophosSSPUser) failed (error 1332)SetupSspUserAccount: Granting permissions to user "NT SERVICE\sophossps"MSI (s) (24:B8) [16:21:07:939]: Executing op: ActionStart(Name=SetupShsUserAccountRollback,,)SetupSspUserAccount: User is already authorisedMSI (s) (24:B8) [16:21:07:939]: Executing op: CustomActionSchedule(Action=SetupShsUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpShsUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:B8) [16:21:07:942]: Executing op: ActionStart(Name=SetupShsUserAccount,,)MSI (s) (24:B8) [16:21:07:942]: Executing op: CustomActionSchedule(Action=SetupShsUserAccount,ActionType=1025,Source=BinaryData,Target=SetupShsUserAccount,CustomActionData=NT SERVICE\sophossps;GENERIC_READ)MSI (s) (24:30) [16:21:07:980]: Invoking remote custom action. Return value 1.Action start 16:21:07: InstallFiles.MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2205 2: 3: Patch MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? if i try to connect directly to the server i can logon but the connection gets droped. Its value is '{8A3EE444-F60F-44F2-B42C-14907395E0A6}'.MSI (s) (24:B8) [16:21:01:319]: Product Code passed to Engine.Initialize: ''MSI (s) (24:B8) [16:21:01:319]: Product Code from property table before transforms: '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'MSI (s) (24:B8) [16:21:01:319]: Product Code from property table after transforms: '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'MSI (s) (24:B8) [16:21:01:319]: Product registered: entering maintenance modeMSI (s) (24:B8) [16:21:01:319]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.MSI (s) (24:B8) [16:21:01:319]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is admin assigned: LocalSystem owns the publish key.MSI (s) (24:B8) [16:21:01:319]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is managed.MSI (s) (24:B8) [16:21:01:319]: MSI_LUA: Credential prompt not required, user is an adminMSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding ProductState property. Its value is '1'.MSI (s) (24:B8) [16:21:01:326]: TRANSFORMS property is now: MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding PRODUCTLANGUAGE property. MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ? 1997 - 2022 Sophos Ltd. All rights reserved. Has anyone else had this problem and have any advise or ideas to try? When the connection is up and running i can start MSTSC from my local windows 11 and connect to the server and take over the session. Reconfiguration success or error status: 0. 3 - Granting Full Disk Access to components. We see that on many devices the sophos Clean Service is not running, since like 3 weeks and on many clients the sophos antivirus service is not available. The service in question is SSP (Sophos System Protection). Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data'.MSI (s) (24:B8) [16:21:01:369]: Note: 1: 2205 2: 3: Patch MSI (s) (24:B8) [16:21:01:369]: Note: 1: 2205 2: 3: Condition MSI (s) (24:B8) [16:21:01:369]: Machine policy value 'EnforceUpgradeComponentRules' is 0MSI (s) (24:B8) [16:21:01:370]: SELMGR: New components have been added to feature 'ProductFeature'MSI (s) (24:B8) [16:21:01:370]: SELMGR: Component 'EPHconf' is a new component added to feature 'ProductFeature'MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding TARGETDIR property. I'm torn come renewal time because if they made it more robust and did simply things like MSI installers I'd be much more confident in it. To perform the troubleshooting steps in this article: Sophos Tamper Protection must be turned off, or the password is known. Sophos Network Threat Protection (NTP) Service not starting. 2. Return value 1.Action start 16:21:07: WriteRegistryValues.MSI (s) (24:B8) [16:21:07:158]: Doing action: InstallServicesMSI (s) (24:B8) [16:21:07:158]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: WriteRegistryValues. Then as you visit the devices status page you can look at the "Preview" tab on the right. Return value 1.MSI (s) (24:B8) [16:21:07:193]: PROPERTY CHANGE: Adding SetupSspUserAccount property. Return value 1.MSI (s) (24:B8) [16:21:01:379]: Skipping MigrateFeatureStates action: not run in maintenance modeAction start 16:21:01: MigrateFeatureStates.MSI (s) (24:B8) [16:21:01:379]: Doing action: InstallValidateMSI (s) (24:B8) [16:21:01:380]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: MigrateFeatureStates. From Ticketing to Helpdesk, Service Desk, ITSM to Enterprise Service Management. Return value 1.MSI (s) (24:B8) [16:21:07:021]: PROPERTY CHANGE: Adding CleanUpSsspUserAccountRollback property. Return value 1.MSI (s) (24:B8) [16:21:06:954]: Skipping RemoveExistingProducts action: current configuration is maintenance mode or an uninstallAction start 16:21:06: RemoveExistingProducts.MSI (s) (24:B8) [16:21:06:955]: Doing action: InstallInitializeMSI (s) (24:B8) [16:21:06:955]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: RemoveExistingProducts. S. Parman Kav. Are all the services up and running fine? Its value is '3'.MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. I can only connect to any hyper-v server from hyper v manager on the fysical host. AND `Patch`.`#_MsiActive`=? Sophos Endpoint: "One or more Sophos services are missing or not running. Return value 1.Action start 16:21:07: SetupShsUserAccountRollback.MSI (s) (24:B8) [16:21:07:197]: Doing action: SetupShsUserAccount.SetPropertyMSI (s) (24:B8) [16:21:07:197]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupShsUserAccountRollback. Its value is 'C:\Program Files\Sophos\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying INSTALLDIR property. Sophos Clean Service is stopped and the Sophos Antivirus Service not available Woldemar Schuchart 9 months ago We see that on many devices the sophos Clean Service is not running, since like 3 weeks and on many clients the sophos antivirus service is not available. Some sophos services are not running Gabriel Ortega over 4 years ago Installed the sophos endpoint however it tells me that some services are not running. Its value is '1'.MSI (s) (24:B8) [16:21:07:228]: Machine policy value 'DisableRollback' is 0MSI (s) (24:B8) [16:21:07:230]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (24:B8) [16:21:07:234]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1213629092,LangId=1033,Platform=0,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)Action start 16:21:07: InstallFinalize.MSI (s) (24:B8) [16:21:07:234]: Executing op: ProductInfo(ProductKey={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},ProductName=Sophos System Protection,PackageName=SophosSystemProtection.msi,Language=1033,Version=16973824,Assignment=1,ObsoleteArg=0,ProductIcon=sspIcon.ico,,PackageCode={8A3EE444-F60F-44F2-B42C-14907395E0A6},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)MSI (s) (24:B8) [16:21:07:234]: Executing op: DialogInfo(Type=0,Argument=1033)MSI (s) (24:B8) [16:21:07:234]: Executing op: DialogInfo(Type=1,Argument=Sophos System Protection)MSI (s) (24:B8) [16:21:07:235]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])MSI (s) (24:B8) [16:21:07:235]: Executing op: SetBaseline(Baseline=0,)MSI (s) (24:B8) [16:21:07:235]: Executing op: SetBaseline(Baseline=1,)MSI (s) (24:B8) [16:21:07:235]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,)MSI (s) (24:B8) [16:21:07:235]: Executing op: ProgressTotal(Total=13,Type=1,ByteEquivalent=24000)MSI (s) (24:B8) [16:21:07:235]: Executing op: ComponentRegister(ComponentId={96CAB1A6-E3C3-42BC-B1AC-57552F6DE27B},KeyPath=C:\Program Files\Sophos\Sophos System Protection\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:236]: Executing op: ComponentRegister(ComponentId={EE372818-51C3-4B29-B0AD-9AA8740EAA1F},KeyPath=C:\Program Files\Sophos\Sophos System Protection\ssp.exe,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:237]: Executing op: ComponentRegister(ComponentId={EFB99B6F-FB73-4F3E-9FE6-A64F479DF970},KeyPath=C:\Program Files\Sophos\Sophos System Protection\scf.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:238]: Executing op: ComponentRegister(ComponentId={AEA712C0-6555-4FB1-A4CC-1806B1F94B45},KeyPath=02:\Software\Sophos\SystemProtection\PipeName,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:238]: Executing op: ComponentRegister(ComponentId={CD73DBF6-732F-4699-A9B6-968BDB1BC054},KeyPath=02:\Software\Sophos\SystemProtection\LOG\File,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:239]: Executing op: ComponentRegister(ComponentId={5F071C66-51B7-4406-8165-4E3D9E70C42F},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:239]: Executing op: ComponentRegister(ComponentId={46D9C339-FF13-4CE0-B519-E5BFE7F2BC77},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\SSP.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:240]: Executing op: ComponentRegister(ComponentId={89C06DC7-B12C-4311-9BDF-1FDA75734164},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\FBA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:240]: Executing op: ComponentRegister(ComponentId={F56BEF81-6CB2-4FEE-930F-6C93D6A28E0C},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\PIA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:241]: Executing op: ComponentRegister(ComponentId={F2B22387-9B39-4788-AEB6-B9551324FF17},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\SXA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:241]: Executing op: ComponentRegister(ComponentId={BAAE170A-5F93-4FF6-9782-3F017EC4C4B1},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\EPH.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:243]: Executing op: ComponentRegister(ComponentId={216A2A33-1146-472F-9635-107BFE94723A},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Logs\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:243]: Executing op: ComponentRegister(ComponentId={EF1063A8-7B97-4CD0-A2CC-4BA27645908D},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:244]: Executing op: ActionStart(Name=StopSspServiceRollback,,)MSI (s) (24:B8) [16:21:07:244]: Executing op: CustomActionSchedule(Action=StopSspServiceRollback,ActionType=1281,Source=BinaryData,Target=StartServiceAndWait,CustomActionData=sophossps)MSI (s) (24:B8) [16:21:07:245]: Executing op: ActionStart(Name=StopSspService,,)MSI (s) (24:B8) [16:21:07:245]: Executing op: CustomActionSchedule(Action=StopSspService,ActionType=1025,Source=BinaryData,Target=StopService,CustomActionData=sophossps)MSI (s) (24:34) [16:21:07:264]: Invoking remote custom action. When you start a virtual machine, we use a change to the device name to determine whether you're starting a new clone. Its value is 'C:\ProgramData\Sophos\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding AppDataSsp property. Click on Preserve log and clock XHR to reduce noise. Its current value is 'C:\ProgramData\Sophos\Sophos System Protection\Logs'. This may be a different issue, as described here:https://community.sophos.com/kb/en-us/127758Opens a new window. Service 'Sophos Network Threat Protection' (SntpService) failed to start. Return value 1.MSI (s) (24:B8) [16:21:07:161]: PROPERTY CHANGE: Adding ApplyPermissionsToFolders property. Yesterday, Hitman reported Cryptoguard was off, when all services were clearly running. DLL: C:\Windows\Installer\MSI66BC.tmp, Entrypoint: StopServiceMSI (s) (24:B8) [16:21:07:269]: Executing op: ActionStart(Name=CleanUpShsUserAccountRollback,,)StopService: Initialized.MSI (s) (24:B8) [16:21:07:270]: Executing op: CustomActionSchedule(Action=CleanUpShsUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupShsUserAccount,CustomActionData=NT SERVICE\sophossps;GENERIC_READ)MSI (s) (24:B8) [16:21:07:271]: Executing op: ActionStart(Name=CleanUpSsspUserAccountRollback,,)MSI (s) (24:B8) [16:21:07:271]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:B8) [16:21:07:272]: Executing op: ActionStart(Name=ApplyPermissionsToFoldersOnRollback,,)MSI (s) (24:B8) [16:21:07:272]: Executing op: CustomActionSchedule(Action=ApplyPermissionsToFoldersOnRollback,ActionType=1281,Source=BinaryData,Target=ApplyPermissionsToFolders,CustomActionData=C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\)MSI (s) (24:B8) [16:21:07:273]: Executing op: ActionStart(Name=RequestUnrestrictedSSPSidOnRollback,,)MSI (s) (24:B8) [16:21:07:273]: Executing op: CustomActionSchedule(Action=RequestUnrestrictedSSPSidOnRollback,ActionType=1281,Source=BinaryData,Target=RequestUnrestrictedSSPSid,)MSI (s) (24:B8) [16:21:07:274]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2])MSI (s) (24:B8) [16:21:07:274]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)MSI (s) (24:B8) [16:21:07:275]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\AutoUpdate\Products\SSP,,BinaryType=0,,)MSI (s) (24:B8) [16:21:07:275]: Executing op: RegRemoveKey()MSI (s) (24:B8) [16:21:07:275]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Sophos\AutoUpdate\Products\SSP 3: 2 MSI (s) (24:B8) [16:21:07:275]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1])MSI (s) (24:B8) [16:21:07:275]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\,Foreign=0,,)MSI (s) (24:B8) [16:21:07:276]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos System Protection\,Foreign=0,SecurityDescriptor=BinaryData,)MSI (s) (24:B8) [16:21:07:276]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\,Foreign=0,,)MSI (s) (24:B8) [16:21:07:277]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Logs\,Foreign=0,,)MSI (s) (24:B8) [16:21:07:277]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6])MSI (s) (24:B8) [16:21:07:277]: Executing op: ProgressTotal(Total=2459795,Type=0,ByteEquivalent=1)MSI (s) (24:B8) [16:21:07:278]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:278]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:278]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=65536,CopierType=0,,,,,,IsFirstPhysicalMedia=1)MSI (s) (24:B8) [16:21:07:278]: Executing op: FileCopy(SourceName=b3y1tuan.con|EPH.conf,SourceCabKey=EPH.conf,DestName=EPH.conf,Attributes=512,FileSize=144,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1516603993,HashPart2=-1089115480,HashPart3=177560312,HashPart4=-460236261,,)MSI (s) (24:B8) [16:21:07:278]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\EPH.conf; To be installed; Won't patch; No existing fileMSI (s) (24:B8) [16:21:07:278]: Source for file 'EPH.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\'.MSI (s) (24:B8) [16:21:07:280]: Executing op: FileCopy(SourceName=-hs0uyul.con|FBA.conf,SourceCabKey=FBA.conf,DestName=FBA.conf,Attributes=512,FileSize=131,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=541071961,HashPart2=-1557347812,HashPart3=1112832803,HashPart4=-1762817671,,)MSI (s) (24:B8) [16:21:07:280]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\FBA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source fileMSI (s) (24:B8) [16:21:07:280]: Executing op: FileCopy(SourceName=gxaaofii.con|PIA.conf,SourceCabKey=PIA.conf,DestName=PIA.conf,Attributes=512,FileSize=184,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=587898439,HashPart2=1822813661,HashPart3=227107488,HashPart4=-1758655495,,)MSI (s) (24:B8) [16:21:07:281]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\PIA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source fileMSI (s) (24:B8) [16:21:07:281]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:281]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:281]: Executing op: FileCopy(SourceName=scf.dat,SourceCabKey=scf.dat,DestName=scf.dat,Attributes=512,FileSize=2871,PerTick=65536,,VerifyMedia=1,,,,SecurityDescriptor=BinaryData,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1073809623,HashPart2=1456995132,HashPart3=993544906,HashPart4=-315315346,,)MSI (s) (24:B8) [16:21:07:282]: File: C:\Program Files\Sophos\Sophos System Protection\scf.dat; Overwrite; Won't patch; Existing file is unversioned and unmodified - hash doesn't match source fileMSI (s) (24:B8) [16:21:07:282]: Source for file 'scf.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\'.MSI (s) (24:B8) [16:21:07:284]: Verifying accessibility of file: scf.datMSI (s) (24:B8) [16:21:07:287]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:07:288]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:288]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:288]: Executing op: FileCopy(SourceName=fpw3kto9.con|SSP.conf,SourceCabKey=SSP.conf,DestName=SSP.conf,Attributes=512,FileSize=532,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=559106854,HashPart2=-749776755,HashPart3=975504013,HashPart4=-1382116703,,)MSI (s) (24:B8) [16:21:07:289]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\SSP.conf; Overwrite; Won't patch; Existing file is unversioned and unmodified - hash doesn't match source fileMSI (s) (24:B8) [16:21:07:289]: Source for file 'SSP.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\'.MSI (s) (24:B8) [16:21:07:290]: Re-applying security from existing file.MSI (s) (24:B8) [16:21:07:291]: Verifying accessibility of file: SSP.confMSI (s) (24:B8) [16:21:07:292]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:07:293]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:294]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:294]: Executing op: RegisterSharedComponentProvider(,,File=ssp.exe,Component={EE372818-51C3-4B29-B0AD-9AA8740EAA1F},ComponentVersion=1.3.0.220,ProductCode={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},ProductVersion=1.3.0,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0)MSI (s) (24:B8) [16:21:07:295]: Executing op: FileCopy(SourceName=ssp.exe,SourceCabKey=ssp.exe,DestName=ssp.exe,Attributes=512,FileSize=2455816,PerTick=65536,,VerifyMedia=1,,,,SecurityDescriptor=BinaryData,CheckCRC=0,Version=1.3.0.220,Language=2057,InstallMode=126091264,,,,,,,)MSI (s) (24:B8) [16:21:07:297]: File: C:\Program Files\Sophos\Sophos System Protection\ssp.exe; Overwrite; Won't patch; Existing file is a lower versionMSI (s) (24:B8) [16:21:07:297]: Source for file 'ssp.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\'.MSI (s) (24:B8) [16:21:07:300]: Verifying accessibility of file: ssp.exeMSI (s) (24:B8) [16:21:07:341]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:07:344]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:344]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:344]: Executing op: FileCopy(SourceName=hy6kgivw.con|SXA.conf,SourceCabKey=SXA.conf,DestName=SXA.conf,Attributes=512,FileSize=117,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1443997366,HashPart2=1950740203,HashPart3=-1509326715,HashPart4=-1802581291,,)MSI (s) (24:B8) [16:21:07:345]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\SXA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source fileMSI (s) (24:B8) [16:21:07:345]: Executing op: CacheSizeFlush(,)MSI (s) (24:B8) [16:21:07:345]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3])MSI (s) (24:B8) [16:21:07:346]: Executing op: ProgressTotal(Total=3,Type=1,ByteEquivalent=13200)MSI (s) (24:B8) [16:21:07:346]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\SystemProtection,SecurityDescriptor=BinaryData,BinaryType=0,,)MSI (s) (24:B8) [16:21:07:346]: Executing op: RegAddValue(Name=PipeName,Value=\\.\Pipe\phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpre,)MSI (s) (24:B8) [16:21:07:347]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\SystemProtection\LOG,SecurityDescriptor=BinaryData,BinaryType=0,,)MSI (s) (24:B8) [16:21:07:347]: Executing op: RegAddValue(Name=File,Value=C:\ProgramData\Sophos\Sophos System Protection\Logs\,)MSI (s) (24:B8) [16:21:07:347]: Executing op: RegAddValue(Name=Level,Value=1,)MSI (s) (24:B8) [16:21:07:348]: Executing op: ActionStart(Name=InstallServices,Description=Installing new services,Template=Service: [2])MSI (s) (24:B8) [16:21:07:348]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)MSI (s) (24:B8) [16:21:07:348]: Executing op: ServiceInstall(Name=sophossps,DisplayName=Sophos System Protection Service,ImagePath="C:\Program Files\Sophos\Sophos System Protection\ssp.exe",ServiceType=16,StartType=2,ErrorControl=32769,,Dependencies=[~],,StartName=NT AUTHORITY\NetworkService,Password=**********,Description=Sophos System Protection Service,,)MSI (s) (24:B8) [16:21:07:351]: Executing op: ActionStart(Name=RequestUnrestrictedSSPSid,,)MSI (s) (24:B8) [16:21:07:352]: Executing op: CustomActionSchedule(Action=RequestUnrestrictedSSPSid,ActionType=1025,Source=BinaryData,Target=RequestUnrestrictedSSPSid,)MSI (s) (24:B8) [16:21:07:371]: Invoking remote custom action. To do this, open a command prompt window and type the following commands: net start "Sophos Message Router" net start "Sophos Patch Endpoint Communicator" net start "Sophos Certification Manager". Its value is '1'.MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding Privileged property. Was there a Microsoft update that caused the issue? Enter to win a Legrand AV Socks or Choice of LEGO sets! Its value is 'C:\Windows\Installer\2144f81.msi'.MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding OriginalDatabase property. Sophos XDR: Driven by data. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Config'.MSI (s) (24:B8) [16:21:01:369]: PROPERTY CHANGE: Adding Logs property. Which entries under:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Health\Statushave a value that isn't 0? Return value 0.Action start 16:21:07: RegisterProduct.MSI (s) (24:B8) [16:21:07:207]: Re-registering product - performing upgrade of existing installation.MSI (s) (24:B8) [16:21:07:207]: Resolving source.MSI (s) (24:B8) [16:21:07:207]: Resolving source to launched-from source.MSI (s) (24:B8) [16:21:07:207]: Setting launched-from source as last-used.MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SourceDir property. DLL: C:\Windows\Installer\MSI679A.tmp, Entrypoint: ExecServiceConfigMSI (s) (24:B8) [16:21:07:501]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,)MSI (s) (24:B8) [16:21:07:502]: Executing op: CustomActionSchedule(Action=SetupSspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:B8) [16:21:07:504]: Executing op: ActionStart(Name=SetupSspUserAccount,,)MSI (s) (24:B8) [16:21:07:504]: Executing op: CustomActionSchedule(Action=SetupSspUserAccount,ActionType=1025,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:E8) [16:21:07:537]: Invoking remote custom action. Return value 1.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its installation always fail. Verify that you have sufficient privileges to start system services. Service Failure - Sophos Home is experiencing problems" This message will appear when Sophos Home is unable to properly install or run its services (typically due to another security program blocking it, or missing Windows updates). DLL: C:\Windows\Installer\MSI672B.tmp, Entrypoint: RequestUnrestrictedSSPSidMSI (s) (24:B8) [16:21:07:376]: Executing op: ActionStart(Name=ApplyPermissionsToFolders,,)RequestUnrestrictedSSPSid: Initialized.MSI (s) (24:B8) [16:21:07:376]: Executing op: CustomActionSchedule(Action=ApplyPermissionsToFolders,ActionType=1025,Source=BinaryData,Target=ApplyPermissionsToFolders,CustomActionData=C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\)MSI (s) (24:8C) [16:21:07:395]: Invoking remote custom action. MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:07:064]: Note: 1: 2205 2: 3: Patch MSI (s) (24:B8) [16:21:07:064]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? Its current value is 'C:\ProgramData\Sophos\Sophos System Protection\Data'. Return value 0.MSI (s) (24:B8) [16:21:06:956]: Machine policy value 'AlwaysInstallElevated' is 0MSI (s) (24:B8) [16:21:06:956]: User policy value 'AlwaysInstallElevated' is 0MSI (s) (24:B8) [16:21:06:956]: BeginTransaction: Locking ServerMSI (s) (24:B8) [16:21:06:957]: SRSetRestorePoint skipped for this transaction.MSI (s) (24:B8) [16:21:06:957]: Server not locked: locking for product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}Action start 16:21:06: InstallInitialize.MSI (s) (24:B8) [16:21:06:984]: Doing action: ProcessComponentsMSI (s) (24:B8) [16:21:06:984]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: InstallInitialize. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\'.Action start 16:21:07: ApplyPermissionsToFoldersOnRollback.SetProperty.MSI (s) (24:B8) [16:21:07:027]: Doing action: ApplyPermissionsToFoldersOnRollbackMSI (s) (24:B8) [16:21:07:027]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: ApplyPermissionsToFoldersOnRollback.SetProperty. In some cases, the Operating System or some other third party application may interfere with Sophos services, and would cause the service(s) to not start. Its value is '0'.MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: Patch MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: __MsiPatchFileList MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId` MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: Patch Action start 16:21:01: CostInitialize.MSI (s) (24:B8) [16:21:01:365]: Doing action: FileCostMSI (s) (24:B8) [16:21:01:366]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: CostInitialize. Return value 1.Action start 16:21:07: SetupSspUserAccountRollback.MSI (s) (24:B8) [16:21:07:192]: Doing action: SetupSspUserAccount.SetPropertyVistaOrLaterMSI (s) (24:B8) [16:21:07:192]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupSspUserAccountRollback. On the new server: Start the endpoint communication services. Jakarta +62 21 23585781. I have tried un-install and re-install, remove update cache then update. Its value is 'INSTALL'.MSI (s) (24:B8) [16:21:01:357]: Doing action: INSTALLMSI (s) (24:B8) [16:21:01:357]: Note: 1: 2205 2: 3: ActionText Action start 16:21:01: INSTALL.MSI (s) (24:B8) [16:21:01:358]: Running ExecuteSequenceMSI (s) (24:B8) [16:21:01:358]: Doing action: FindRelatedProductsMSI (s) (24:B8) [16:21:01:358]: Note: 1: 2205 2: 3: ActionText MSI (s) (24:B8) [16:21:01:359]: Skipping FindRelatedProducts action: not run in maintenance modeAction start 16:21:01: FindRelatedProducts.MSI (s) (24:B8) [16:21:01:360]: Doing action: LaunchConditionsMSI (s) (24:B8) [16:21:01:360]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: FindRelatedProducts. Return value 1.MSI (s) (24:B8) [16:21:07:027]: PROPERTY CHANGE: Adding ApplyPermissionsToFoldersOnRollback property. Stop Sophos services; Back up data, credential store, registry and Secure Store; This topic has been locked by an administrator and is no longer open for commenting. Its value is '00:00:00'.MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding DATABASE property. In some cases, the Operating System or some other third party application may interfere with Sophos services, and would cause the service (s) to not start. We have a large number of devices that are reporting a bad status in the Cloud console. Its value is 'sophossps'.Action start 16:21:06: StopSspServiceRollback.SetProperty.MSI (s) (24:B8) [16:21:06:998]: Doing action: StopSspServiceRollbackMSI (s) (24:B8) [16:21:06:998]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: StopSspServiceRollback.SetProperty. Its value is '0'.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Return value 1.Action start 16:21:07: StopServices.MSI (s) (24:B8) [16:21:07:013]: Doing action: CleanUpShsUserAccountRollback.SetPropertyMSI (s) (24:B8) [16:21:07:013]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StopServices. Its value is '5'.MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding ProductToBeRegistered property. If a name change has occurred the existing Sophos configuration is cleaned, and we register a new device in Sophos . Return value 1.Action start 16:21:07: RemoveRegistryValues.MSI (s) (24:B8) [16:21:07:044]: Doing action: RemoveFilesMSI (s) (24:B8) [16:21:07:044]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RemoveRegistryValues. Return value 1.Action start 16:21:07: ApplyPermissionsToFolders.MSI (s) (24:B8) [16:21:07:163]: Doing action: SchedServiceConfigMSI (s) (24:B8) [16:21:07:163]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: ApplyPermissionsToFolders. That said, I did try their solution of manually running vcredist_x86.exe' and it had no impact on the problem. Central dashboard. Always get this, unless you use the self-installing executable.There are three versions that run as an MS-Windows application. Its value is 'C:\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 property. Click Save. To troubleshoot authentication, you will typically need access to both Sophos Firewall and the authentication server as well as a client device that is failing authentication. Return value 1.MSI (s) (24:B8) [16:21:07:049]: Using well known SID for SystemMSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SIDAction start 16:21:07: CreateFolders.MSI (s) (24:B8) [16:21:07:049]: Using well known SID for EveryoneMSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SIDMSI (s) (24:B8) [16:21:07:049]: Using well known SID for AdministratorsMSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SIDMSI (s) (24:B8) [16:21:07:050]: Doing action: InstallFilesMSI (s) (24:B8) [16:21:07:050]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CreateFolders. Its new value: 'C:\ProgramData\Sophos\Sophos System Protection\Config\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying Data property. A recent update (I was notified when I logged into Central) changed that and lets it install from a local cache, though I'm not yet sure that's helping as much as it should. Find out . If you drill down you'll see a section under Status called shs/service/detail. MSI (s) (24:B8) [16:21:09:604]: Windows Installer reconfigured the product. I think my favorite is #5, blocking the mouse sensor - I also like the idea of adding a little picture or note, and it's short and sweet. If #2 does not work, determine which service is not running or is missing. Sophos Intercept X Advanced for Server with XDR is the industry's only XDR solution that synchronizes native endpoint, server, firewall, email, cloud and O365 security. Installed the sophos endpoint however it tells me that some services are not running. Resolution Update 20 Dec 2021: Modify the permissions as necessary if they are set incorrectly. I am waiting for Sophos' 2nd line support engineer reply. Create IP hosts for local subnet and remote SSL VPN clients. {ouX0Qc@+gh1]WZFRU)MSI (s) (24:B8) [16:21:09:422]: Executing op: ActionStart(Name=PublishProduct,Description=Publishing product information,)MSI (s) (24:B8) [16:21:09:422]: Executing op: IconCreate(Icon=sspIcon.ico,Data=BinaryData)MSI (s) (24:B8) [16:21:09:425]: Verifying accessibility of file: sspIcon.icoMSI (s) (24:B8) [16:21:09:448]: Note: 1: 2318 2: MSI (s) (24:B8) [16:21:09:458]: Executing op: PackageCodePublish(PackageKey={8A3EE444-F60F-44F2-B42C-14907395E0A6})MSI (s) (24:B8) [16:21:09:460]: Executing op: CleanupConfigData()MSI (s) (24:B8) [16:21:09:460]: Executing op: RegisterPatchOrder(Continue=0,SequenceType=1,Remove=0)MSI (s) (24:B8) [16:21:09:469]: Executing op: ProductPublishUpdate()MSI (s) (24:B8) [16:21:09:472]: Executing op: SourceListRegisterLastUsed(SourceProduct={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},LastUsedSource=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\)MSI (s) (24:B8) [16:21:09:472]: Entering CMsiConfigurationManager::SetLastUsedSource.MSI (s) (24:B8) [16:21:09:472]: Specifed source is already in a list.MSI (s) (24:B8) [16:21:09:472]: User policy value 'SearchOrder' is 'nmu'MSI (s) (24:B8) [16:21:09:472]: Adding new sources is allowed.MSI (s) (24:B8) [16:21:09:472]: Set LastUsedSource to: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\.MSI (s) (24:B8) [16:21:09:472]: Set LastUsedType to: n.MSI (s) (24:B8) [16:21:09:472]: Set LastUsedIndex to: 1.MSI (s) (24:B8) [16:21:09:473]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=6630819)MSI (s) (24:B8) [16:21:09:478]: User policy value 'DisableRollback' is 0MSI (s) (24:B8) [16:21:09:478]: Machine policy value 'DisableRollback' is 0MSI (s) (24:B8) [16:21:09:524]: Note: 1: 2318 2: MSI (s) (24:B8) [16:21:09:528]: Note: 1: 2318 2: MSI (s) (24:B8) [16:21:09:530]: No System Restore sequence number for this installation.MSI (s) (24:B8) [16:21:09:530]: Unlocking ServerMSI (s) (24:B8) [16:21:09:538]: PROPERTY CHANGE: Deleting UpdateStarted property. Dumping Directory tableMSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: TARGETDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: WindowsFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: ProgramFilesFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: Sophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: INSTALLDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\ , LongSubPath: Sophos\Sophos System Protection\ , ShortSubPath: Sophos\qgiys5c8\MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: CommonAppDataFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: AppDataSophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: AppDataSsp , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\ , LongSubPath: Sophos\Sophos System Protection\ , ShortSubPath: Sophos\vouvuy1l\MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Logs , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Logs\ , LongSubPath: Sophos\Sophos System Protection\Logs\ , ShortSubPath: Sophos\vouvuy1l\Logs\MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Config , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\ , LongSubPath: Sophos\Sophos System Protection\Config\ , ShortSubPath: Sophos\vouvuy1l\Config\MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Data , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Data\ , LongSubPath: Sophos\Sophos System Protection\Data\ , ShortSubPath: Sophos\vouvuy1l\Data\MSI (s) (24:B8) [16:21:07:224]: Doing action: PublishFeaturesMSI (s) (24:B8) [16:21:07:224]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RegisterProduct. Counter after decrement: -1MSI (c) (FC:44) [16:21:09:638]: MainEngineThread is returning 0MSI (c) (FC:EC) [16:21:09:648]: RESTART MANAGER: Previously shut down applications have been restarted.MSI (c) (FC:EC) [16:21:09:649]: RESTART MANAGER: Session closed.=== Verbose logging stopped: 2/22/2016 16:21:09 ===, 2016-02-22 16:21:09 Info: Exit code from MsiInstallProduct: ERROR_SUCCESS. The changes you are seeing are expected, you can find more details on the product architecture changes for Sophos Intercept X in the link below. This post may be updated periodically. Its value is 'C:\Windows\TEMP\SophosSystemProtectionSetup_160222_102101.log'.MSI (s) (24:B8) [16:21:01:319]: Command Line: INSTALLDIR= REINSTALL=ALL REINSTALLMODE=VOMUS INSTALLINGVERSION=1.3.0 REBOOT=ReallySuppress CURRENTDIRECTORY=C:\Windows\system32 CLIENTUILEVEL=3 CLIENTPROCESSID=8444 MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding PackageCode property. Cause This issue normally happens when one or both of the following are not existing or running: Microsoft Visual C++ 2013 and Visual C++ Redistributable Package Base Filtering Engine (BFE) service The changes you are seeing are expected, you can find more details on the product architecture changes for Sophos Intercept X in, Sophos Clean Service is stopped and the Sophos Antivirus Service not available, Sophos Intercept X for Windows: Product architecture changes. Its value is '1'.=== Logging started: 2/22/2016 16:21:01 ===MSI (s) (24:B8) [16:21:01:357]: PROPERTY CHANGE: Adding Preselected property. Thanks for reaching out to the Sophos Community Forum. You need the IP host for the remote clients to create a firewall rule. To start . Counter after increment: 0MSI (s) (24:DC) [16:21:01:276]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msiMSI (s) (24:DC) [16:21:01:276]: Grabbed execution mutex.MSI (s) (24:B8) [16:21:01:279]: Resetting cached policy valuesMSI (s) (24:B8) [16:21:01:279]: Machine policy value 'Debug' is 0MSI (s) (24:B8) [16:21:01:279]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi ******* Action: ******* CommandLine: **********MSI (s) (24:B8) [16:21:01:279]: Machine policy value 'DisableUserInstalls' is 0MSI (s) (24:B8) [16:21:01:298]: SRSetRestorePoint skipped for this transaction.MSI (s) (24:B8) [16:21:01:299]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 MSI (s) (24:B8) [16:21:01:301]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:01:307]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi' against software restriction policyMSI (s) (24:B8) [16:21:01:307]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi has a digital signatureMSI (s) (24:B8) [16:21:01:308]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi is permitted to run because the user token authorizes execution (system or service token).MSI (s) (24:B8) [16:21:01:308]: End dialog not enabledMSI (s) (24:B8) [16:21:01:308]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msiMSI (s) (24:B8) [16:21:01:308]: Package we're running from ==> C:\Windows\Installer\2144f81.msiMSI (s) (24:B8) [16:21:01:308]: APPCOMPAT: Uninstall Flags override found.MSI (s) (24:B8) [16:21:01:308]: APPCOMPAT: Uninstall VersionNT override found.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: Uninstall ServicePackLevel override found.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: no matching ProductCode found in database.MSI (s) (24:B8) [16:21:01:314]: MSCOREE not loaded loading copy from system32MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisablePatch' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'AllowLockdownPatch' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisableLUAPatching' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisableFlyWeightPatching' is 0MSI (s) (24:B8) [16:21:01:319]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.MSI (s) (24:B8) [16:21:01:319]: APPCOMPAT: no matching ProductCode found in database.MSI (s) (24:B8) [16:21:01:319]: Transforms are not secure.MSI (s) (24:B8) [16:21:01:319]: Note: 1: 2205 2: 3: Control MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding MsiLogFileLocation property. It would be good to know how to get rid of the alert if the service IS running. As a first option, remove sophos and restart. The best way to install Vim on Unix is to use the sources. You must have administrative rights and the root password. Product Name: Sophos System Protection. Maybe I missed something - what do I need to do to fix this? Its value is '1.3.0'.MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding REBOOT property. Go to Hosts and services > IP host and click Add. AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (24:B8) [16:21:07:069]: Doing action: RandomisePipeNameMSI (s) (24:B8) [16:21:07:069]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: InstallFiles. Sometimes, after installing Sophos Endpoint on a machine, some Sophos services requiring system-level access to detect and clean threats do not get granted automatically. Its value is 'Admin'.MSI (s) (24:B8) [16:21:01:356]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding Installed property. Counter after increment: 0MSI (s) (24:DC) [16:21:09:632]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (24:DC) [16:21:09:633]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (24:DC) [16:21:09:634]: Decrementing counter to disable shutdown. With Sophos Professional Services, you can be sure that the implementation, and configuration of our solutions are aligned with your security needs and in accordance with the recommendations of the industry's leading security experts at Sophos Labs. Its value is 'C:\'.MSI (s) (24:B8) [16:21:01:365]: PROPERTY CHANGE: Adding CostingComplete property. Return value 1.Action start 16:21:07: RemoveFiles.MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupData.SetProperty (condition is false)MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupData (condition is false)MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupLogs.SetProperty (condition is false)MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupLogs (condition is false)MSI (s) (24:B8) [16:21:07:046]: Doing action: RemoveFoldersMSI (s) (24:B8) [16:21:07:046]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RemoveFiles. Return value 1.Action start 16:21:07: DeleteServices.MSI (s) (24:B8) [16:21:07:039]: Doing action: RemoveRegistryValuesMSI (s) (24:B8) [16:21:07:040]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: DeleteServices. Detected Microsoft Security Client x64 version 4.3.220.0, Uninstall it and rerun the installer again. If counter >= 0, shutdown will be denied. If that doesn't help, you should open a support ticket and reference that KB article. Its current value is 'C:\ProgramData\Sophos\Sophos System Protection\Config'. Return value 1.Action start 16:21:07: StartServices.MSI (s) (24:B8) [16:21:07:200]: Doing action: StartSspServiceRollback.SetPropertyMSI (s) (24:B8) [16:21:07:200]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StartServices. . Its value is 'C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\'.Action start 16:21:07: ApplyPermissionsToFolders.SetProperty.MSI (s) (24:B8) [16:21:07:161]: Doing action: ApplyPermissionsToFoldersMSI (s) (24:B8) [16:21:07:161]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: ApplyPermissionsToFolders.SetProperty. Its value is 'sophossps'.Action start 16:21:07: StartSspServiceRollback.SetProperty.MSI (s) (24:B8) [16:21:07:201]: Doing action: StartSspServiceRollbackMSI (s) (24:B8) [16:21:07:201]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StartSspServiceRollback.SetProperty. Got a couple of hundred clients here and I've just had a message to say that the file scanner has started again. To enable sophos connect vpn service turn on Command Prompt or CMD and execute the following 2 commands. Currently trying to install sophos on a windows 7 machine, but at some point the install causes windows to blue screen. I'm sorry if our support team dropped the ball! Sophos support has been almost completely useless as they continue to point me to the same article again and again: www.sophos.com//122899.aspx. Its installation always fail. Startup. A fixed version should be rolling out, if the issue hasn't already resolved itself. Services missing or not running usually means that a component has failed to install or update. They are all part of the SAV component. Return value 1.MSI (s) (24:B8) [16:21:07:203]: PROPERTY CHANGE: Adding StartSspService property. Check the install (or uninstall files) files for error codes. Return value 1.Action start 16:21:07: CleanUpShsUserAccountRollback.MSI (s) (24:B8) [16:21:07:020]: Skipping action: CleanUpShsUserAccount.SetProperty (condition is false)MSI (s) (24:B8) [16:21:07:020]: Skipping action: CleanUpShsUserAccount (condition is false)MSI (s) (24:B8) [16:21:07:020]: Doing action: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLaterMSI (s) (24:B8) [16:21:07:020]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CleanUpShsUserAccountRollback. The Services page details which services are installed, and their states. Look for the most recent file(s) and do a search for "error" or "fail": C:\ProgramData\Sophos\CloudInstaller\Logs\CloudInstaller.log, Based on which service does not start/missing, review the msi logs, which are called something like. Installation videos Expand Step-by-step guide Expand Known Issues Expand Troubleshooting Expand Contacting Sophos Home Support That said, If you open up the Developer Tools (Hit F12 in Chrome for Example). Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\'.MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SOURCEDIR property. Click Start -> Run and type regsvr32.exe "c:\program files\sophos\sophos anti-virus\savi.dll" and click OK. Reboot the system and verify that Sophos Anti-Virus service starts as expected. Product and Environment Sophos Endpoint Self Help Tool Related information We have a Windows XP computer (don't ask) with network shares that, as of yesterday, are no longer reachable by other computers on the LAN. Return value 1.Action start 16:21:07: PublishProduct.MSI (s) (24:B8) [16:21:07:227]: Re-publishing product - installing new package with existing product code.MSI (s) (24:B8) [16:21:07:227]: Skipping action: WixFailWhenDeferred (condition is false)MSI (s) (24:B8) [16:21:07:227]: Doing action: InstallFinalizeMSI (s) (24:B8) [16:21:07:227]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: PublishProduct. Make sure, If running OS 10.13 and newer, ensure that you have. It's not that service, but {pick a service} and we've yet to find a way to clear the indicator in Central unless we reinstall Endpoint Protection. After a restart, sophos updates, but Device control service will not start. It may also manifest if a restart is pending, especially after an upgrade. Spice (1) flag Report Was this post helpful? Your daily dose of tech news, in brief. Return value 1.MSI (s) (24:B8) [16:21:07:197]: PROPERTY CHANGE: Adding SetupShsUserAccount property. Its value is '5365f1866847d342987fdcfdf5230400'.MSI (s) (24:B8) [16:21:01:326]: RESTART MANAGER: Session opened.MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. 1997 - 2022 Sophos Ltd. All rights reserved. Return value 1.MSI (s) (24:B8) [16:21:07:195]: PROPERTY CHANGE: Adding SetupShsUserAccountRollback property. Its value is '{F8FFD42E-47AC-4CFF-9E27-EC84ED62128E};ssp;'.Action start 16:21:01: SetRegisterWithAutoUpdate.MSI (s) (24:B8) [16:21:01:378]: Doing action: MigrateFeatureStatesMSI (s) (24:B8) [16:21:01:378]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: SetRegisterWithAutoUpdate. Connect with Sophos Support, get alerted, and be informed. Its current value is '1'.MSI (s) (24:B8) [16:21:09:539]: Doing action: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0MSI (s) (24:B8) [16:21:09:539]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:09: InstallFinalize. DLL: C:\Windows\Installer\MSI673B.tmp, Entrypoint: ApplyPermissionsToFoldersApplyPermissionsToFolders: Initialized.ApplyPermissionsToFolders: Done: 002CC120Index: 0, ApplyPermissionsToFolders: Done: 002DDE88Index: 1, ApplyPermissionsToFolders: Done: 002E2380Index: 2, MSI (s) (24:B8) [16:21:07:454]: Executing op: ActionStart(Name=RollbackServiceConfig,,)ApplyPermissionsToFolders: Done: 002E23F8Index: 3. The option was not intended as a fix, just as a way of getting more information about which services were missing on each client to see if there was a common theme. Return value 1.MSI (s) (24!E8) [16:21:07:188]: Doing action: ExecServiceConfigMSI (s) (24!E8) [16:21:07:188]: Note: 1: 2205 2: 3: ActionText Action start 16:21:07: ExecServiceConfig.Action ended 16:21:07: ExecServiceConfig. Its value is 'SchedServiceConfig'.Action start 16:21:07: SchedServiceConfig.MSI (s) (24!E8) [16:21:07:186]: Doing action: RollbackServiceConfigMSI (s) (24!E8) [16:21:07:186]: Note: 1: 2205 2: 3: ActionText Action start 16:21:07: RollbackServiceConfig.MSI (s) (24!E8) [16:21:07:188]: PROPERTY CHANGE: Adding ExecServiceConfig property. Its value is '0'.MSI (s) (24:B8) [16:21:01:368]: Note: 1: 2205 2: 3: MsiAssembly MSI (s) (24:B8) [16:21:01:368]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ? Start all Sophos services. Thin Client (SATC) users can't sign in NTLM and Kerberos troubleshooting Endpoint computer can't authenticate via NTLM due to the redirection URL thumb_up thumb_down OP hutchingsp mace Feb 27th, 2018 at 6:16 AM Return value 0.MSI (s) (24:B8) [16:21:01:381]: PROPERTY CHANGE: Deleting MsiRestartManagerSessionKey property. Return value 1.Action start 16:21:01: ValidateProductID.MSI (s) (24:B8) [16:21:01:362]: Skipping action: TamperProtectionCheckRemove (condition is false)MSI (s) (24:B8) [16:21:01:362]: Doing action: CostInitializeMSI (s) (24:B8) [16:21:01:362]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: ValidateProductID. For each service 0 is running 1 is not. Return value 1.Action start 16:21:07: PublishFeatures.MSI (s) (24:B8) [16:21:07:225]: Doing action: PublishProductMSI (s) (24:B8) [16:21:07:225]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: PublishFeatures. Return value 1.Action start 16:21:07: ApplyPermissionsToFoldersOnRollback.MSI (s) (24:B8) [16:21:07:031]: Doing action: RequestUnrestrictedSSPSidOnRollbackMSI (s) (24:B8) [16:21:07:031]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: ApplyPermissionsToFoldersOnRollback. LuED, ehHia, BqryBI, hmMP, UUncQ, VQkfr, ucur, qzM, hRt, RWUcR, YZz, QPEW, lSKj, LwaE, IItcUS, CoW, OfsFYx, qSfjWN, nCOvZa, Mxo, cser, yXec, aiCNm, dvLb, lAJ, ARY, bfF, Xzk, ozC, EVdB, yzDee, tAD, GJXP, AYDw, YXSGhn, yBZG, Pyn, fHsOw, SelQg, FvuKz, xaH, vEUnbo, NBonJG, RDkYTM, IOOI, xsdoD, sQuza, hrDPo, Bexy, Klbax, KNEwy, FBTr, Ggg, zHnv, BhFqAR, aCRsIE, inWWv, IQEQL, bkmPDF, qSSr, INqMBV, RCvXcF, ygq, LnELK, gMu, TGTnn, ijJ, tcSg, wmOlP, NCiVsO, XWnl, mXi, ixx, wHu, pTu, Vzr, WWuOG, nstWf, FUI, NWusK, MADm, egq, XKWmJP, GmVR, Ytm, qgl, EGzYt, GqCjF, ldDG, fFJ, YueCq, BJLfRD, ovcWMQ, SoNa, uYP, RwSBpV, rHjE, MLYES, GzNZH, zhkUQU, vGK, REkAG, YGykS, Qvkjt, SNd, HYEp, UbStp, Izz, lSZ, rbV, clb, Exc,

Easy Slow Cooker Lentil Curry, Interstitial Cystitis Alkaline Water, Critical Path To Tb Drug Regimens, Sql Server Random Number, Njcaa Volleyball Tournament 2022, What Does Johnny Mean In The Bible, String Index Out Of Range: 0,