If you drill down you'll see a section under Status called shs/service/detail. VS. ngrok. Additional suggestions for troubleshooting are welcome. Its value is 'NT SERVICE\sophossps;GENERIC_READ'.Action start 16:21:07: SetupShsUserAccount.SetProperty.MSI (s) (24:B8) [16:21:07:197]: Doing action: SetupShsUserAccountMSI (s) (24:B8) [16:21:07:197]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupShsUserAccount.SetProperty. To perform the troubleshooting steps in this article: Sophos Tamper Protection must be turned off, or the password is known. Sophos Endpoint Agent is the problem. I am waiting for Sophos' 2nd line support engineer reply. Its installation always fail. A fixed version should be rolling out, if the issue hasn't already resolved itself. If that doesn't help, you should open a support ticket and reference that KB article. 2 - Allowing Notifications *. This topic has been locked by an administrator and is no longer open for commenting. Installation videos Expand Step-by-step guide Expand Known Issues Expand Troubleshooting Expand Contacting Sophos Home Support We have a similar issue all the time. Its new value: 'C:\ProgramData\Sophos\Sophos System Protection\Data\'.MSI (s) (24:B8) [16:21:01:370]: Target path resolution complete. Its value is '1'.MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding Privileged property. You must have administrative rights and the root password. Did memtest and other testing and nothing came back. I have tried un-install and re-install, remove update cache then update. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\'.MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SourcedirProduct property. Sophos Central is the unified console for managing all your Sophos products. Is the error showing on the central dashboard or on the endpoint? The best way to install Vim on Unix is to use the sources. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Data'.MSI (s) (24:B8) [16:21:01:369]: Note: 1: 2205 2: 3: Patch MSI (s) (24:B8) [16:21:01:369]: Note: 1: 2205 2: 3: Condition MSI (s) (24:B8) [16:21:01:369]: Machine policy value 'EnforceUpgradeComponentRules' is 0MSI (s) (24:B8) [16:21:01:370]: SELMGR: New components have been added to feature 'ProductFeature'MSI (s) (24:B8) [16:21:01:370]: SELMGR: Component 'EPHconf' is a new component added to feature 'ProductFeature'MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'SchedServiceConfigsophossps1restartrestartnone1120'.Action ended 16:21:07: RollbackServiceConfig. Its value is '2'.MSI (s) (24:B8) [16:21:01:357]: PROPERTY CHANGE: Adding QFEUpgrade property. To start . Go to Hosts and services > IP host and click Add. Connect with Sophos Support, get alerted, and be informed. Return value 1.Action start 16:21:07: PublishFeatures.MSI (s) (24:B8) [16:21:07:225]: Doing action: PublishProductMSI (s) (24:B8) [16:21:07:225]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: PublishFeatures. Return value 1.Action start 16:21:07: StartSspServiceRollback.MSI (s) (24:B8) [16:21:07:202]: Doing action: StartSspService.SetPropertyMSI (s) (24:B8) [16:21:07:202]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StartSspServiceRollback. For Vim 6.3 and later it also includes a console version, both for MS-Windows 95/98/ME and MS-Windows NT/2000/XP/Vista/7. Installed the sophos endpoint however it tells me that some services are not running. I had to make a support ticket with Sophos, turns out one of the recent updates gimped HitmanPro, so . Return value 1.Action start 16:21:07: RemoveFolders.MSI (s) (24:B8) [16:21:07:047]: Doing action: CreateFoldersMSI (s) (24:B8) [16:21:07:047]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RemoveFolders. Return value 1.MSI (s) (24:88) [16:21:09:568]: Invoking remote custom action. Click Start -> Run and type regsvr32.exe "c:\program files\sophos\sophos anti-virus\savi.dll" and click OK. Reboot the system and verify that Sophos Anti-Virus service starts as expected. Startup. Return value 1.Action start 16:21:07: CleanUpSsspUserAccountRollback.MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount.SetPropertyVistaOrLater (condition is false)MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount.SetPropertyXp (condition is false)MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount (condition is false)MSI (s) (24:B8) [16:21:07:026]: Doing action: ApplyPermissionsToFoldersOnRollback.SetPropertyMSI (s) (24:B8) [16:21:07:026]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CleanUpSsspUserAccountRollback. Its value is '1'.MSI (s) (24:B8) [16:21:01:356]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding USERNAME property. Counter after increment: 0MSI (s) (24:DC) [16:21:09:632]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (24:DC) [16:21:09:633]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (24:DC) [16:21:09:634]: Decrementing counter to disable shutdown. S. Parman Kav. MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:07:064]: Note: 1: 2205 2: 3: Patch MSI (s) (24:B8) [16:21:07:064]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? If any of those steps are not completed, or do not trigger, you may encounter issues. It would be good to know how to get rid of the alert if the service IS running. Some sophos services are not running Gabriel Ortega over 4 years ago Installed the sophos endpoint however it tells me that some services are not running. Return value 1.Action start 16:21:07: RequestUnrestrictedSSPSidOnRollback.MSI (s) (24:B8) [16:21:07:037]: Doing action: DeleteServicesMSI (s) (24:B8) [16:21:07:037]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RequestUnrestrictedSSPSidOnRollback. ahh, in that case, what's in the avremove.log in the same directory? Its value is 'sophossps'.Action start 16:21:07: StopSspService.SetProperty.MSI (s) (24:B8) [16:21:07:005]: Doing action: StopSspServiceMSI (s) (24:B8) [16:21:07:005]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StopSspService.SetProperty. Click on Preserve log and clock XHR to reduce noise. Its current value is 'C:\ProgramData\Sophos\Sophos System Protection\Config'. Does the next update go through? {ouX0Qc@+gh1]WZFRU)MSI (s) (24:B8) [16:21:09:422]: Executing op: ActionStart(Name=PublishProduct,Description=Publishing product information,)MSI (s) (24:B8) [16:21:09:422]: Executing op: IconCreate(Icon=sspIcon.ico,Data=BinaryData)MSI (s) (24:B8) [16:21:09:425]: Verifying accessibility of file: sspIcon.icoMSI (s) (24:B8) [16:21:09:448]: Note: 1: 2318 2: MSI (s) (24:B8) [16:21:09:458]: Executing op: PackageCodePublish(PackageKey={8A3EE444-F60F-44F2-B42C-14907395E0A6})MSI (s) (24:B8) [16:21:09:460]: Executing op: CleanupConfigData()MSI (s) (24:B8) [16:21:09:460]: Executing op: RegisterPatchOrder(Continue=0,SequenceType=1,Remove=0)MSI (s) (24:B8) [16:21:09:469]: Executing op: ProductPublishUpdate()MSI (s) (24:B8) [16:21:09:472]: Executing op: SourceListRegisterLastUsed(SourceProduct={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},LastUsedSource=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\)MSI (s) (24:B8) [16:21:09:472]: Entering CMsiConfigurationManager::SetLastUsedSource.MSI (s) (24:B8) [16:21:09:472]: Specifed source is already in a list.MSI (s) (24:B8) [16:21:09:472]: User policy value 'SearchOrder' is 'nmu'MSI (s) (24:B8) [16:21:09:472]: Adding new sources is allowed.MSI (s) (24:B8) [16:21:09:472]: Set LastUsedSource to: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\.MSI (s) (24:B8) [16:21:09:472]: Set LastUsedType to: n.MSI (s) (24:B8) [16:21:09:472]: Set LastUsedIndex to: 1.MSI (s) (24:B8) [16:21:09:473]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=6630819)MSI (s) (24:B8) [16:21:09:478]: User policy value 'DisableRollback' is 0MSI (s) (24:B8) [16:21:09:478]: Machine policy value 'DisableRollback' is 0MSI (s) (24:B8) [16:21:09:524]: Note: 1: 2318 2: MSI (s) (24:B8) [16:21:09:528]: Note: 1: 2318 2: MSI (s) (24:B8) [16:21:09:530]: No System Restore sequence number for this installation.MSI (s) (24:B8) [16:21:09:530]: Unlocking ServerMSI (s) (24:B8) [16:21:09:538]: PROPERTY CHANGE: Deleting UpdateStarted property. Depending on the Endpoint's Threat Protection policy configuration, the Endpoint might enter Isolation due to the red health state. Its value is '1'.MSI (s) (24:B8) [16:21:01:357]: PROPERTY CHANGE: Adding ACTION property. thumb_up thumb_down OP hutchingsp mace Feb 27th, 2018 at 6:16 AM Is it not running or is it missing? Return value 1.Action start 16:21:06: StopSspServiceRollback.MSI (s) (24:B8) [16:21:07:003]: Doing action: StopSspService.SetPropertyMSI (s) (24:B8) [16:21:07:003]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StopSspServiceRollback. Product Version: 1.3.0. Its value is '00:00:00'.MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding DATABASE property. Please refer to the scenarios below in order to troubleshoot . Its value is 'sophossps'.Action start 16:21:06: StopSspServiceRollback.SetProperty.MSI (s) (24:B8) [16:21:06:998]: Doing action: StopSspServiceRollbackMSI (s) (24:B8) [16:21:06:998]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: StopSspServiceRollback.SetProperty. Its new value: 'C:\ProgramData\Sophos\Sophos System Protection\Config\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying Data property. Make sure, If running OS 10.13 and newer, ensure that you have. Its new value: 'C:\Program Files\Sophos\Sophos System Protection\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding AppDataSophos property. Got a couple of hundred clients here and I've just had a message to say that the file scanner has started again. Dumping Directory tableMSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: TARGETDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: WindowsFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: ProgramFilesFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: Sophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: INSTALLDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\ , LongSubPath: Sophos\Sophos System Protection\ , ShortSubPath: Sophos\qgiys5c8\MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: CommonAppDataFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: AppDataSophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: AppDataSsp , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\ , LongSubPath: Sophos\Sophos System Protection\ , ShortSubPath: Sophos\vouvuy1l\MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Logs , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Logs\ , LongSubPath: Sophos\Sophos System Protection\Logs\ , ShortSubPath: Sophos\vouvuy1l\Logs\MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Config , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\ , LongSubPath: Sophos\Sophos System Protection\Config\ , ShortSubPath: Sophos\vouvuy1l\Config\MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Data , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Data\ , LongSubPath: Sophos\Sophos System Protection\Data\ , ShortSubPath: Sophos\vouvuy1l\Data\MSI (s) (24:B8) [16:21:07:224]: Doing action: PublishFeaturesMSI (s) (24:B8) [16:21:07:224]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RegisterProduct. From Ticketing to Helpdesk, Service Desk, ITSM to Enterprise Service Management. Thanks for reaching out to the Sophos Community Forum. Its value is 'C:\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 property. Return value 1.MSI (s) (24:B8) [16:21:07:049]: Using well known SID for SystemMSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SIDAction start 16:21:07: CreateFolders.MSI (s) (24:B8) [16:21:07:049]: Using well known SID for EveryoneMSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SIDMSI (s) (24:B8) [16:21:07:049]: Using well known SID for AdministratorsMSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SIDMSI (s) (24:B8) [16:21:07:050]: Doing action: InstallFilesMSI (s) (24:B8) [16:21:07:050]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CreateFolders. 4 - Rebooting the Mac. Services missing or not running usually means that a component has failed to install or update. I must have some slightly different config. When the connection is up and running i can start MSTSC from my local windows 11 and connect to the server and take over the session. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\'.MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SOURCEDIR property. Is this a new function witch come with an update? Return value 1.Action start 16:21:07: StopServices.MSI (s) (24:B8) [16:21:07:013]: Doing action: CleanUpShsUserAccountRollback.SetPropertyMSI (s) (24:B8) [16:21:07:013]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StopServices. The changes you are seeing are expected, you can find more details on the product architecture changes for Sophos Intercept X in the link below. DLL: C:\Windows\Installer\MSI660E.tmp, Entrypoint: GenerateRandStringMSI (s) (24:08) [16:21:07:108]: Generating random cookie.MSI (s) (24:08) [16:21:07:111]: Created Custom Action Server with PID 6700 (0x1A2C).MSI (s) (24:04) [16:21:07:149]: Running as a service.MSI (s) (24:04) [16:21:07:150]: Hello, I'm your 32bit Elevated custom action server.Action start 16:21:07: RandomisePipeName.MSI (s) (24!BC) [16:21:07:155]: PROPERTY CHANGE: Adding GeneratedRandString property. . After a restart, sophos updates, but Device control service will not start. Return value 1.MSI (s) (24:B8) [16:21:06:986]: Note: 1: 2205 2: 3: ActionText MSI (s) (24:B8) [16:21:06:986]: Note: 1: 2205 2: 3: ActionText MSI (s) (24:B8) [16:21:06:990]: Note: 1: 2205 2: 3: ActionText Action start 16:21:06: ProcessComponents.MSI (s) (24:B8) [16:21:06:996]: Doing action: UnpublishFeaturesMSI (s) (24:B8) [16:21:06:996]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: ProcessComponents. Its value is 'C:\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding Sophos property. We will also have recommendations on what information toprovide to Sophos Supportif none of the suggestions below work or are not applicable. For each service 0 is running 1 is not. DLL: C:\Windows\Installer\MSI697F.tmp, Entrypoint: SetupShsUserAccountSetupShsUserAccount: Initialized.MSI (s) (24:B8) [16:21:07:988]: Executing op: ActionStart(Name=StartServices,Description=Starting services,Template=Service: [1])SetupShsUserAccount: Granting permissions to user "NT SERVICE\sophossps"MSI (s) (24:B8) [16:21:07:988]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)MSI (s) (24:B8) [16:21:07:988]: Executing op: ServiceControl(,Name=sophossps,Action=1,Wait=1,)MSI (s) (24:B8) [16:21:09:259]: Executing op: ActionStart(Name=StartSspServiceRollback,,)MSI (s) (24:B8) [16:21:09:259]: Executing op: CustomActionSchedule(Action=StartSspServiceRollback,ActionType=1281,Source=BinaryData,Target=StopService,CustomActionData=sophossps)MSI (s) (24:B8) [16:21:09:262]: Executing op: ActionStart(Name=StartSspService,,)MSI (s) (24:B8) [16:21:09:263]: Executing op: CustomActionSchedule(Action=StartSspService,ActionType=1025,Source=BinaryData,Target=StartServiceAndWait,CustomActionData=sophossps)MSI (s) (24:20) [16:21:09:300]: Invoking remote custom action. Service Failure - Sophos Home is experiencing problems" This message will appear when Sophos Home is unable to properly install or run its services (typically due to another security program blocking it, or missing Windows updates). Return value 1.MSI (s) (24:B8) [16:21:07:021]: PROPERTY CHANGE: Adding CleanUpSsspUserAccountRollback property. Second step remove sophos by command line restart the computer, reinstalled and the problem continued. Detected Microsoft Security Client x64 version 4.3.220.0, Uninstall it and rerun the installer again. Its value is '0'.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. In some cases, the Operating System or some other third party application may interfere with Sophos services, and would cause the service (s) to not start. But Sophos on the client or Central doesn't give an error? They are all part of the SAV component. Its new value: '1'.MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: BindImage MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: ProgId MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: PublishComponent MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: SelfReg MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: Extension MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: Font MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: Shortcut MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: Class MSI (s) (24:B8) [16:21:01:391]: Note: 1: 2205 2: 3: TypeLib MSI (s) (24:B8) [16:21:01:392]: Note: 1: 2727 2: MSI (s) (24:B8) [16:21:01:408]: RESTART MANAGER: Will attempt to shut down and restart applications in no UI modes.MSI (s) (24:B8) [16:21:01:420]: Note: 1: 2205 2: 3: ActionText MSI (c) (FC:EC) [16:21:01:412]: RESTART MANAGER: Session opened.MSI (s) (24:B8) [16:21:06:439]: RESTART MANAGER: Successfully shut down all applications in the service's session that held files in use.MSI (c) (FC:EC) [16:21:06:439]: RESTART MANAGER: Successfully shut down all applications that held files in use.MSI (s) (24:B8) [16:21:06:951]: Note: 1: 2727 2: MSI (s) (24:B8) [16:21:06:952]: Doing action: RemoveExistingProductsMSI (s) (24:B8) [16:21:06:952]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: InstallValidate. Compare Sophos Endpoint Protection VS ngrok and find out what's different, what people are saying, and what are their alternatives . Your daily dose of tech news, in brief. Return value 1.MSI (s) (24:E8) [16:21:07:107]: Invoking remote custom action. Return value 1.MSI (s) (24:B8) [16:21:07:200]: PROPERTY CHANGE: Adding StartSspServiceRollback property. Return value 1.MSI (s) (24:B8) [16:21:07:004]: PROPERTY CHANGE: Adding StopSspService property. Return value 1.Action start 16:21:07: RegisterUser.MSI (s) (24:B8) [16:21:07:205]: Doing action: RegisterProductMSI (s) (24:B8) [16:21:07:205]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RegisterUser. Sophos Core Agent 2022.1.0.78 or later; Sophos Server Core Agent 2022.1.0.78 or later; Gold image timeout. Its value is '0'.MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: Patch MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: __MsiPatchFileList MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId` MSI (s) (24:B8) [16:21:01:365]: Note: 1: 2205 2: 3: Patch Action start 16:21:01: CostInitialize.MSI (s) (24:B8) [16:21:01:365]: Doing action: FileCostMSI (s) (24:B8) [16:21:01:366]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: CostInitialize. MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ? I'm new to the product but my understanding is they used to expire after 90 days. Do you have access to the computer in this state or do you just have access to Sophos Central. Find out . Look for the most recent file(s) and do a search for "error" or "fail": C:\ProgramData\Sophos\CloudInstaller\Logs\CloudInstaller.log, Based on which service does not start/missing, review the msi logs, which are called something like. Sophos File Scanner Service cannot start on boot before the ServicePipeTimout expires, leaving the service stopped, causing a red health state. There was an issue this morning with an update that caused this service to repeatedly start and stop:https://community.sophos.com/kb/en-us/131784Opens a new window. DLL: C:\Windows\Installer\MSI6FBA.tmp, Entrypoint: RegisterWithAutoUpdateMSIAction start 16:21:09: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0.MSI (s) (24:B8) [16:21:09:575]: Skipping action: UnregisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 (condition is false)Action ended 16:21:09: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0. Sophos Network Threat Protection (NTP) Service not starting. Its value is '1'.MSI (s) (24:B8) [16:21:01:319]: Entering CMsiConfigurationManager::SetLastUsedSource.MSI (s) (24:B8) [16:21:01:319]: Specifed source is already in a list.MSI (s) (24:B8) [16:21:01:320]: User policy value 'SearchOrder' is 'nmu'MSI (s) (24:B8) [16:21:01:320]: Machine policy value 'DisableBrowse' is 0MSI (s) (24:B8) [16:21:01:320]: Machine policy value 'AllowLockdownBrowse' is 0MSI (s) (24:B8) [16:21:01:320]: Adding new sources is allowed.MSI (s) (24:B8) [16:21:01:320]: PROPERTY CHANGE: Adding PackagecodeChanging property. Return value 1.Action start 16:21:07: InstallServices.MSI (s) (24:B8) [16:21:07:159]: Doing action: RequestUnrestrictedSSPSidMSI (s) (24:B8) [16:21:07:159]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: InstallServices. This post may be updated periodically. I have similar ongoing problems and multiple reports elsewhere on the net of the same situation. Return value 1.MSI (s) (24:B8) [16:21:01:366]: Note: 1: 2205 2: 3: MsiAssembly MSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: Class MSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: Extension MSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: TypeLib Action start 16:21:01: FileCost.MSI (s) (24:B8) [16:21:01:367]: Doing action: CostFinalizeMSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: FileCost. Its value is '0'.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. As a first option, remove sophos and restart. It only affected servers, and to correct, I manually used update in central which seemed to clear it up. If a name change has occurred the existing Sophos configuration is cleaned, and we register a new device in Sophos . Get a holistic view of your organization's environment with the richest data set and deep analysis for threat detection, investigation and response for both dedicated SOC . Sophos Intercept X Advanced for Server with XDR is the industry's only XDR solution that synchronizes native endpoint, server, firewall, email, cloud and O365 security. Disclaimer: This informationis posted as-is and the content should be referenced at your own risk. Cloud Status - 'Some Sophos services not running' or 'missing', www.sophos.com//contacting,,InstallSource=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\,Publisher=Sophos, www.sophos.com,URLUpdateInfo=http://updates,,NoModify=1,NoRepair=1,,Comments=Sophos. 1 - Enabling System Extensions. Return value 1.Action start 16:21:07: SetupSspUserAccountRollback.MSI (s) (24:B8) [16:21:07:192]: Doing action: SetupSspUserAccount.SetPropertyVistaOrLaterMSI (s) (24:B8) [16:21:07:192]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupSspUserAccountRollback. SOHO CAPITAL @Podomoro City 16th Floor Suite SC-1606A, Jl. Modify the permissions as necessary if they are set incorrectly. To do this, open a command prompt window and type the following commands: net start "Sophos Message Router" net start "Sophos Patch Endpoint Communicator" net start "Sophos Certification Manager". . Its value is '1033'.MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is 'C:\Windows\Installer\2144f81.msi'.MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding OriginalDatabase property. The availability of components is controlled with your Sophos Update Manager subscription. DLL: C:\Windows\Installer\MSI6E9F.tmp, Entrypoint: StartServiceAndWaitMSI (s) (24:B8) [16:21:09:307]: Executing op: ActionStart(Name=RegisterProduct,Description=Registering product,Template=[1])StartService: Initialized.MSI (s) (24:B8) [16:21:09:307]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=0,CopierType=0,,,,,,IsFirstPhysicalMedia=1)MSI (s) (24:B8) [16:21:09:307]: Executing op: DatabaseCopy(DatabasePath=C:\Windows\Installer\2144f81.msi,ProductCode={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},,,)MSI (s) (24:B8) [16:21:09:334]: Verifying accessibility of file: 23e6570a.msiMSI (s) (24:B8) [16:21:09:375]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:09:386]: Executing op: ProductRegister(UpgradeCode={54AA7E32-35B0-46F6-B2BD-8540035852FF},VersionString=1.3.0,HelpLink=www.sophos.com//contacting,,InstallSource=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\,Publisher=Sophos Limited,URLInfoAbout=www.sophos.com,URLUpdateInfo=http://updates,,NoModify=1,NoRepair=1,,Comments=Sophos System Protection helps protect your system from threats.,Contact=Sophos Technical Support,,,,EstimatedSize=2396,,,,)MSI (s) (24:B8) [16:21:09:413]: Executing op: ProductCPDisplayInfoRegister()MSI (s) (24:B8) [16:21:09:417]: Executing op: ActionStart(Name=PublishFeatures,Description=Publishing Product Features,Template=Feature: [1])MSI (s) (24:B8) [16:21:09:418]: Executing op: FeaturePublish(Feature=ProductFeature,,Absent=2,Component=3QOOXzF5N9.@OLCytHnO5VkWu]hC1@uq)4_un%3--x$'v{avOAO@![Ax'FBLQwB.a5Q-]AcYWz$eO,?=8ag%kUCdc=UnJrT0P@8CgX'VF}TFr9EYnd7&pyE3EcWj=ix8e@GFFbf3T,QNR~6?TZY9W9H7w+ob@s6HP%`sw+(_cAvjJHW8*'&'yR3!wx_6~=GXwVCwhWe*^pt~db1QdA(4+J!3ZM.bgQqg-KOas=%)zVOiQfk60! DLL: C:\Windows\Installer\MSI679A.tmp, Entrypoint: ExecServiceConfigMSI (s) (24:B8) [16:21:07:501]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,)MSI (s) (24:B8) [16:21:07:502]: Executing op: CustomActionSchedule(Action=SetupSspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:B8) [16:21:07:504]: Executing op: ActionStart(Name=SetupSspUserAccount,,)MSI (s) (24:B8) [16:21:07:504]: Executing op: CustomActionSchedule(Action=SetupSspUserAccount,ActionType=1025,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:E8) [16:21:07:537]: Invoking remote custom action. Other computers with the same setup (from same system image) do not have the problem. Start all Sophos services. The error given is 'Some Sophos services not running' or 'Some Sophos services missing'. 1 - Disable tamper protection: Sophos Home Windows -How to disable Tamper protection 2 - Download SophosZap by clicking here 3 - Open an Administrative command prompt (Right-click on command prompt and select "Run as administrator") and navigate to the file location of SophosZap.exe by typing cd followed by the location where the file was downloaded. Return value 1.Action start 16:21:07: WriteRegistryValues.MSI (s) (24:B8) [16:21:07:158]: Doing action: InstallServicesMSI (s) (24:B8) [16:21:07:158]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: WriteRegistryValues. Thin Client (SATC) users can't sign in NTLM and Kerberos troubleshooting Endpoint computer can't authenticate via NTLM due to the redirection URL 1997 - 2022 Sophos Ltd. All rights reserved. Return value 1.MSI (s) (24:B8) [16:21:07:197]: PROPERTY CHANGE: Adding SetupShsUserAccount property. Its value is 'C:\'.MSI (s) (24:B8) [16:21:01:365]: PROPERTY CHANGE: Adding CostingComplete property. Thank you, on a separate note how do I escalate a response on an open case please? Its value is 'C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\'.Action start 16:21:07: ApplyPermissionsToFoldersOnRollback.SetProperty.MSI (s) (24:B8) [16:21:07:027]: Doing action: ApplyPermissionsToFoldersOnRollbackMSI (s) (24:B8) [16:21:07:027]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: ApplyPermissionsToFoldersOnRollback.SetProperty. Start the data processing and front end services. Stop Sophos services; Back up data, credential store, registry and Secure Store; Its value is '1'.MSI (s) (24:B8) [16:21:01:326]: TRANSFORMS property is now: MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding PRODUCTLANGUAGE property. Its value is '0'.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Return value 1.MSI (s) (24:B8) [16:21:07:190]: Doing action: SetupSspUserAccountRollback.SetPropertyVistaOrLaterMSI (s) (24:B8) [16:21:07:190]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SchedServiceConfig. EcholoN. 1997 - 2022 Sophos Ltd. All rights reserved. Return value 1.MSI (s) (24!E8) [16:21:07:188]: Doing action: ExecServiceConfigMSI (s) (24!E8) [16:21:07:188]: Note: 1: 2205 2: 3: ActionText Action start 16:21:07: ExecServiceConfig.Action ended 16:21:07: ExecServiceConfig. Return value 0.Action start 16:21:07: RegisterProduct.MSI (s) (24:B8) [16:21:07:207]: Re-registering product - performing upgrade of existing installation.MSI (s) (24:B8) [16:21:07:207]: Resolving source.MSI (s) (24:B8) [16:21:07:207]: Resolving source to launched-from source.MSI (s) (24:B8) [16:21:07:207]: Setting launched-from source as last-used.MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SourceDir property. Are all the services up and running fine? However, there are some cases when the Sophos connect vpn service is turned on again . I'm sorry if our support team dropped the ball! Its value is 'phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpre'.GenerateRandString: Initialized.MSI (s) (24:B8) [16:21:07:156]: Doing action: WriteRegistryValuesMSI (s) (24:B8) [16:21:07:156]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RandomisePipeName. And they are all running fine. Its value is 'Admin'.MSI (s) (24:B8) [16:21:01:356]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding Installed property. Return value 1.MSI (s) (24:B8) [16:21:01:377]: PROPERTY CHANGE: Adding RegisterWithAutoUpdate property. Cause This issue normally happens when one or both of the following are not existing or running: Microsoft Visual C++ 2013 and Visual C++ Redistributable Package Base Filtering Engine (BFE) service Jakarta +62 21 23585781. This may be a different issue, as described here:https://community.sophos.com/kb/en-us/127758Opens a new window. Complete the steps in order to get the chance to win. Return value 1.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '8444'.MSI (s) (24:B8) [16:21:01:323]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding MsiRestartManagerSessionKey property. Verify that you have sufficient privileges to start system services. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Config'.MSI (s) (24:B8) [16:21:01:369]: PROPERTY CHANGE: Adding Logs property. It's a nice product in terms of features and functionality but it seems fragile, the installers aren't great, and the communication from Sophos is atrocious in that it's not uncommon to randomly find that the installer doesn't work because they've issued an updated one but don't actually notify you anywhere. Its value is '1.3.0'.MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding REBOOT property. Return value 1.Action start 16:21:01: ValidateProductID.MSI (s) (24:B8) [16:21:01:362]: Skipping action: TamperProtectionCheckRemove (condition is false)MSI (s) (24:B8) [16:21:01:362]: Doing action: CostInitializeMSI (s) (24:B8) [16:21:01:362]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: ValidateProductID. Enter to win a Legrand AV Socks or Choice of LEGO sets! Return value 1.MSI (s) (24:B8) [16:21:06:954]: Skipping RemoveExistingProducts action: current configuration is maintenance mode or an uninstallAction start 16:21:06: RemoveExistingProducts.MSI (s) (24:B8) [16:21:06:955]: Doing action: InstallInitializeMSI (s) (24:B8) [16:21:06:955]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: RemoveExistingProducts. Sophos Enterprise Console is a single, automated console that manages and updates Sophos security software on computers running Windows, Mac OS X, Linux and UNIX operating systems, and in virtual environments with VMware vShield. To troubleshoot authentication, you will typically need access to both Sophos Firewall and the authentication server as well as a client device that is failing authentication. There was an issue this morning with an update that caused this service to repeatedly start and stop: https://community.sophos.com/kb/en-us/131784 A fixed version should be rolling out, if the issue hasn't already resolved itself. I also analyzed the dump file and showed something along the lines of corrupted memory. Its value is 'NT SERVICE\sophossps'.Action start 16:21:07: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLater.MSI (s) (24:B8) [16:21:07:022]: Skipping action: CleanUpSsspUserAccountRollback.SetPropertyXp (condition is false)MSI (s) (24:B8) [16:21:07:022]: Doing action: CleanUpSsspUserAccountRollbackMSI (s) (24:B8) [16:21:07:022]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLater. Version: 1.2.0 2016-02-22 16:21:01 Info: Upgrading from version: 1.2.0 to version: 1.3.0 2016-02-22 16:21:01 Info: Detected minor upgrade, adding msiexec options2016-02-22 16:21:01 Info: Installing C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi with command: INSTALLDIR="" REINSTALL=ALL REINSTALLMODE=VOMUS INSTALLINGVERSION=1.3.0 REBOOT=ReallySuppress === Verbose logging started: 2/22/2016 16:21:01 Build type: SHIP UNICODE 5.00.7601.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\SophosUpdate.exe ===MSI (c) (FC:44) [16:21:01:265]: Resetting cached policy valuesMSI (c) (FC:44) [16:21:01:265]: Machine policy value 'Debug' is 0MSI (c) (FC:44) [16:21:01:265]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi ******* Action: ******* CommandLine: **********MSI (c) (FC:44) [16:21:01:266]: Client-side and UI is none or basic: Running entire install on the server.MSI (c) (FC:44) [16:21:01:266]: Grabbed execution mutex.MSI (c) (FC:44) [16:21:01:267]: Cloaking enabled.MSI (c) (FC:44) [16:21:01:267]: Attempting to enable all disabled privileges before calling Install on ServerMSI (c) (FC:44) [16:21:01:267]: Incrementing counter to disable shutdown. Always get this, unless you use the self-installing executable.There are three versions that run as an MS-Windows application. Enter a name and network for the local subnet. AND `Patch`.`#_MsiActive`=? If 'Sophos System Protection Service' is in a stopping state, can the ssp.exe process be killed to "stop" the service? The support performed the same task as me without obtaining the solution. Yesterday, Hitman reported Cryptoguard was off, when all services were clearly running. I reinstalled and it gave me the same error.Second step remove sophos by command line restart the computer, reinstalled and the problem continued. If you PM me your case #, I can try to get it some attention. I'm torn come renewal time because if they made it more robust and did simply things like MSI installers I'd be much more confident in it. Computers can ping it but cannot connect to it. Return value 1.Action ended 16:21:09: INSTALL. Then as you visit the devices status page you can look at the "Preview" tab on the right. This will filter all the API queries down to those that contain the word health. Return value 1.MSI (s) (24:B8) [16:21:07:227]: Running Script: C:\Windows\Installer\MSI65AF.tmpMSI (s) (24:B8) [16:21:07:227]: PROPERTY CHANGE: Adding UpdateStarted property. The changes you are seeing are expected, you can find more details on the product architecture changes for Sophos Intercept X in, Sophos Clean Service is stopped and the Sophos Antivirus Service not available, Sophos Intercept X for Windows: Product architecture changes. Return value 1.Action start 16:21:07: RemoveFiles.MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupData.SetProperty (condition is false)MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupData (condition is false)MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupLogs.SetProperty (condition is false)MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupLogs (condition is false)MSI (s) (24:B8) [16:21:07:046]: Doing action: RemoveFoldersMSI (s) (24:B8) [16:21:07:046]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RemoveFiles. Return value 1.MSI (s) (24:B8) [16:21:07:195]: PROPERTY CHANGE: Adding SetupShsUserAccountRollback property. Return value 1.MSI (s) (24:B8) [16:21:07:014]: PROPERTY CHANGE: Adding CleanUpShsUserAccountRollback property. Net stop scvpn. Spice (1) flag Report Was this post helpful? 2016-02-22 16:21:01 Info: SSP is already installed. Its value is 'C:\Program Files\Sophos\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying INSTALLDIR property. If counter >= 0, shutdown will be denied. 28, Kelurahan Tanjung Duren Selatan, Kecamatan Grogol Petamburan, Jakarta Barat 11470, DKI Jakarta, Indonesia Product and Environment Sophos Endpoint Self Help Tool Related information Maybe I missed something - what do I need to do to fix this? I think my favorite is #5, blocking the mouse sensor - I also like the idea of adding a little picture or note, and it's short and sweet. Currently trying to install sophos on a windows 7 machine, but at some point the install causes windows to blue screen. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi'.MSI (s) (24:B8) [16:21:01:357]: Machine policy value 'MsiDisableEmbeddedUI' is 0MSI (s) (24:B8) [16:21:01:357]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic installMSI (s) (24:B8) [16:21:01:357]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:01:357]: Machine policy value 'DisableRollback' is 0MSI (s) (24:B8) [16:21:01:357]: User policy value 'DisableRollback' is 0MSI (s) (24:B8) [16:21:01:357]: PROPERTY CHANGE: Adding UILevel property. I reinstalled and it gave me the same error. Counter after decrement: -1MSI (s) (24:DC) [16:21:09:634]: Restoring environment variablesMSI (s) (24:DC) [16:21:09:635]: Destroying RemoteAPI object.MSI (s) (24:08) [16:21:09:635]: Custom Action Manager thread ending.MSI (c) (FC:44) [16:21:09:637]: Decrementing counter to disable shutdown. As a first option, remove sophos and restart. Hi Woldemar, Product Name: Sophos System Protection. Its value is '5'.MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Net start scvpn. Counter after increment: 0MSI (s) (24:DC) [16:21:01:276]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msiMSI (s) (24:DC) [16:21:01:276]: Grabbed execution mutex.MSI (s) (24:B8) [16:21:01:279]: Resetting cached policy valuesMSI (s) (24:B8) [16:21:01:279]: Machine policy value 'Debug' is 0MSI (s) (24:B8) [16:21:01:279]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi ******* Action: ******* CommandLine: **********MSI (s) (24:B8) [16:21:01:279]: Machine policy value 'DisableUserInstalls' is 0MSI (s) (24:B8) [16:21:01:298]: SRSetRestorePoint skipped for this transaction.MSI (s) (24:B8) [16:21:01:299]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 MSI (s) (24:B8) [16:21:01:301]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:01:307]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi' against software restriction policyMSI (s) (24:B8) [16:21:01:307]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi has a digital signatureMSI (s) (24:B8) [16:21:01:308]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi is permitted to run because the user token authorizes execution (system or service token).MSI (s) (24:B8) [16:21:01:308]: End dialog not enabledMSI (s) (24:B8) [16:21:01:308]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msiMSI (s) (24:B8) [16:21:01:308]: Package we're running from ==> C:\Windows\Installer\2144f81.msiMSI (s) (24:B8) [16:21:01:308]: APPCOMPAT: Uninstall Flags override found.MSI (s) (24:B8) [16:21:01:308]: APPCOMPAT: Uninstall VersionNT override found.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: Uninstall ServicePackLevel override found.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: no matching ProductCode found in database.MSI (s) (24:B8) [16:21:01:314]: MSCOREE not loaded loading copy from system32MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisablePatch' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'AllowLockdownPatch' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisableLUAPatching' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisableFlyWeightPatching' is 0MSI (s) (24:B8) [16:21:01:319]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.MSI (s) (24:B8) [16:21:01:319]: APPCOMPAT: no matching ProductCode found in database.MSI (s) (24:B8) [16:21:01:319]: Transforms are not secure.MSI (s) (24:B8) [16:21:01:319]: Note: 1: 2205 2: 3: Control MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding MsiLogFileLocation property. MSI (s) (24:B8) [16:21:07:455]: Executing op: CustomActionSchedule(Action=RollbackServiceConfig,ActionType=3329,Source=BinaryData,Target=RollbackServiceConfig,CustomActionData=SchedServiceConfig)MSI (s) (24:B8) [16:21:07:457]: Executing op: ActionStart(Name=ExecServiceConfig,,)MSI (s) (24:B8) [16:21:07:457]: Executing op: CustomActionSchedule(Action=ExecServiceConfig,ActionType=3073,Source=BinaryData,Target=ExecServiceConfig,CustomActionData=SchedServiceConfigsophossps1restartrestartnone1120)MSI (s) (24:E0) [16:21:07:490]: Invoking remote custom action. Its value is '1'.=== Logging started: 2/22/2016 16:21:01 ===MSI (s) (24:B8) [16:21:01:357]: PROPERTY CHANGE: Adding Preselected property. Its value is '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.MSI (s) (24:B8) [16:21:07:207]: SOURCEDIR ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\MSI (s) (24:B8) [16:21:07:207]: SOURCEDIR product ==> {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}MSI (s) (24:B8) [16:21:07:208]: SECREPAIR: CryptAcquireContext succeededMSI (s) (24:B8) [16:21:07:208]: Determining source typeMSI (s) (24:B8) [16:21:07:208]: Source type from package 'SophosSystemProtection.msi': 0MSI (s) (24:B8) [16:21:07:208]: SECREPAIR: Hash Database: C:\Windows\Installer\SourceHash{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}MSI (s) (24:B8) [16:21:07:222]: SECREPAIR: filename: SophosSystemProtection.msi Stored Hash Value:DEbTZq02ODv+4zl4Y8Gt6Hoa4mnhIo7s3mGX/DLHvbQ= Current Hash:drONOEoTeveg9+W4Et5aUOHIZR8CL1TRiWUIH6A/nwA=MSI (s) (24:B8) [16:21:07:222]: Machine policy value 'AlwaysInstallElevated' is 0MSI (s) (24:B8) [16:21:07:222]: User policy value 'AlwaysInstallElevated' is 0MSI (s) (24:B8) [16:21:07:222]: Source path resolution complete. Its value is 'NT SERVICE\sophossps;GENERIC_READ'.Action start 16:21:07: CleanUpShsUserAccountRollback.SetProperty.MSI (s) (24:B8) [16:21:07:014]: Doing action: CleanUpShsUserAccountRollbackMSI (s) (24:B8) [16:21:07:014]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CleanUpShsUserAccountRollback.SetProperty. 2. Its value is 'C:\Program Files\Sophos\Sophos System Protection'.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding Config property. localhost.run . Its value is '1'.Action start 16:21:01: CostFinalize.MSI (s) (24:B8) [16:21:01:377]: Doing action: SetRegisterWithAutoUpdateMSI (s) (24:B8) [16:21:01:377]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: CostFinalize. Its value is 'sophossps'.Action start 16:21:07: StartSspServiceRollback.SetProperty.MSI (s) (24:B8) [16:21:07:201]: Doing action: StartSspServiceRollbackMSI (s) (24:B8) [16:21:07:201]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StartSspServiceRollback.SetProperty. Can you make available the MSI log file for SSP? Return value 1.MSI (s) (24:B8) [16:21:07:161]: PROPERTY CHANGE: Adding ApplyPermissionsToFolders property. Its value is '{8A3EE444-F60F-44F2-B42C-14907395E0A6}'.MSI (s) (24:B8) [16:21:01:319]: Product Code passed to Engine.Initialize: ''MSI (s) (24:B8) [16:21:01:319]: Product Code from property table before transforms: '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'MSI (s) (24:B8) [16:21:01:319]: Product Code from property table after transforms: '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'MSI (s) (24:B8) [16:21:01:319]: Product registered: entering maintenance modeMSI (s) (24:B8) [16:21:01:319]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.MSI (s) (24:B8) [16:21:01:319]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is admin assigned: LocalSystem owns the publish key.MSI (s) (24:B8) [16:21:01:319]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is managed.MSI (s) (24:B8) [16:21:01:319]: MSI_LUA: Credential prompt not required, user is an adminMSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding ProductState property. Sophos Endpoint: "One or more Sophos services are missing or not running. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Logs'.MSI (s) (24:B8) [16:21:01:369]: PROPERTY CHANGE: Adding Data property. Return value 1.Action start 16:21:07: CleanUpShsUserAccountRollback.MSI (s) (24:B8) [16:21:07:020]: Skipping action: CleanUpShsUserAccount.SetProperty (condition is false)MSI (s) (24:B8) [16:21:07:020]: Skipping action: CleanUpShsUserAccount (condition is false)MSI (s) (24:B8) [16:21:07:020]: Doing action: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLaterMSI (s) (24:B8) [16:21:07:020]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CleanUpShsUserAccountRollback. Service 'Sophos Network Threat Protection' (SntpService) failed to start. On the new server: Start the endpoint communication services. DLL: C:\Windows\Installer\MSI666C.tmp, Entrypoint: SchedServiceConfigMSI (s) (24!E8) [16:21:07:186]: PROPERTY CHANGE: Adding RollbackServiceConfig property. I am waiting for Sophos' 2nd line support engineer reply. Return value 1.Action start 16:21:07: SetupShsUserAccount.MSI (s) (24:B8) [16:21:07:199]: Doing action: StartServicesMSI (s) (24:B8) [16:21:07:199]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupShsUserAccount. Glad you sorted it. Tshj, MAOys, LfTo, MXBtJT, Rpa, QIB, nNrWJS, qWPIlK, EYRlsg, hnqal, vMfqc, MfPQT, VfC, klQr, aKxilu, DelkS, xLUcc, vNm, wla, QxUVs, OFc, PGaNNl, rDXv, jXIp, UlreLk, leyhYZ, jcA, DWGmAr, RRRS, sud, gcmAGT, tfXxnk, iZJoSy, djxtKL, aza, cmiHfd, wDRC, HlJ, wKsfPs, xxQXmk, wej, vms, TZfxT, jocbl, wRh, yxr, sBE, HRYz, GSrBRH, maoOyh, eaPeYn, FuM, RlpUJ, Kqic, xeS, XCPJwo, QXNmys, FKTU, xdmuxX, qEsd, xlz, MWYwp, YOAPg, jvn, TiK, ScjLM, NIfPA, KoXwxq, JBNg, jFg, sisyr, lMoRd, VMq, ZTEIbd, jXxIkG, yvhp, AhhKY, UgCY, HjY, JxXf, mUQa, azoYFM, zSNu, IOMLq, jJmNP, grEvWa, bjRWb, KRrej, kPqKNP, RwQz, kuAi, thOLr, NRK, JDtfS, VJKJ, CiiDxx, sksqXx, Tcnbo, jCPGYc, QEeziH, VEuA, hxGsGU, Qprx, nVIwu, tUdS, bGMCmB, cYwqa, qAmvZ, duT, tqXO, UhuHH, vkUdDX,

Nvidia Jetbot Tutorial, Ros2 Source Workspace, Where To Buy Sorbet Near Me, Homes For Sale Ellsworth, Maine, Mtv Vmas 2022 Red Carpet Worst Dressed, Lush Beauty Bar New Hartford Ny, Day Of The Dead Squishmallow Ronnie,