=== Verbose logging started: 1/26/2018 10:47:00 Build type: SHIP UNICODE 5.00.7601.00 Calling process: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe === MSI (c) (04:B0) [10:47:00:300]: Cloaking enabled. MSI (c) (04:B0) [10:47:00:300]: Attempting to enable all disabled privileges before calling Install on Server MSI (c) (04:B0) [10:47:00:300]: End dialog not enabled MSI (c) (04:B0) [10:47:00:300]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi MSI (c) (04:B0) [10:47:00:300]: Package we're running from ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi MSI (c) (04:B0) [10:47:00:300]: Machine policy value 'DisableUserInstalls' is 0 MSI (c) (04:B0) [10:47:00:300]: APPCOMPAT: Compatibility mode property overrides found. MSI (c) (04:B0) [10:47:00:300]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2831282D-8519-4910-B339-2302840ABEF3}'. MSI (c) (04:B0) [10:47:00:300]: APPCOMPAT: no matching ProductCode found in database. MSI (c) (04:B0) [10:47:00:316]: MSCOREE not loaded loading copy from system32 MSI (c) (04:B0) [10:47:00:316]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2831282D-8519-4910-B339-2302840ABEF3}'. MSI (c) (04:B0) [10:47:00:316]: APPCOMPAT: no matching ProductCode found in database. MSI (c) (04:B0) [10:47:00:316]: Transforms are not secure. MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Users\tpc\AppData\Local\Temp\Sophos Endpoint Firewall 1.0.0.564 install log 20180126 104700.txt'. MSI (c) (04:B0) [10:47:00:316]: No Command Line. MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{4B3C66C0-2036-482C-8B6E-20BD8A081136}'. MSI (c) (04:B0) [10:47:00:316]: Product Code passed to Engine.Initialize: '(none)' MSI (c) (04:B0) [10:47:00:316]: Product Code from property table before transforms: '{2831282D-8519-4910-B339-2302840ABEF3}' MSI (c) (04:B0) [10:47:00:316]: Product Code from property table after transforms: '{2831282D-8519-4910-B339-2302840ABEF3}' MSI (c) (04:B0) [10:47:00:316]: Product not registered: beginning first-time install MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'. MSI (c) (04:B0) [10:47:00:316]: Entering CMsiConfigurationManager::SetLastUsedSource. MSI (c) (04:B0) [10:47:00:316]: User policy value 'SearchOrder' is 'nmu' MSI (c) (04:B0) [10:47:00:316]: Adding new sources is allowed. MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'. MSI (c) (04:B0) [10:47:00:316]: Package name extracted from package path: 'Sophos Endpoint Firewall.msi' MSI (c) (04:B0) [10:47:00:316]: Package to be registered: 'Sophos Endpoint Firewall.msi' MSI (c) (04:B0) [10:47:00:316]: Note: 1: 2262 2: AdminProperties 3: -2147287038 MSI (c) (04:B0) [10:47:00:316]: TRANSFORMS property is now: MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'. MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\Favorites MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Network Shortcuts MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\Documents MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Printer Shortcuts MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Recent MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\SendTo MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Templates MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\ProgramData MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Local MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\Pictures MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Start Menu MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\Desktop MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates MSI (c) (04:B0) [10:47:00:316]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts MSI (c) (04:B0) [10:47:00:316]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 MSI (c) (04:B0) [10:47:00:316]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation MSI (c) (04:B0) [10:47:00:316]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated. MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'. MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'. MSI (c) (04:B0) [10:47:00:316]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'TCH'. MSI (c) (04:B0) [10:47:00:316]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'Microsoft'. MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi'. MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi'. MSI (c) (04:B0) [10:47:00:316]: Machine policy value 'MsiDisableEmbeddedUI' is 0 MSI (c) (04:B0) [10:47:00:316]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI MSI (c) (04:B0) [10:47:00:316]: EEUI - Disabling MsiEmbeddedUI in quiet mode === Logging started: 1/26/2018 10:47:00 === MSI (c) (04:B0) [10:47:00:316]: Machine policy value 'DisableRollback' is 0 MSI (c) (04:B0) [10:47:00:316]: User policy value 'DisableRollback' is 0 MSI (c) (04:B0) [10:47:00:316]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'. MSI (c) (04:B0) [10:47:00:316]: Creating MSIHANDLE (3) of type 790537 for thread 5040 MSI (c) (04:B0) [10:47:00:316]: MsiOpenPackageEx is returning 0 MSI (c) (04:B0) [10:47:00:316]: Closing MSIHANDLE (3) of type 790537 for thread 5040 === Verbose logging stopped: 1/26/2018 10:47:00 === === Verbose logging started: 1/26/2018 10:47:00 Build type: SHIP UNICODE 5.00.7601.00 Calling process: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe === MSI (c) (04:84) [10:47:00:331]: Resetting cached policy values MSI (c) (04:84) [10:47:00:331]: Machine policy value 'Debug' is 0 MSI (c) (04:84) [10:47:00:331]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi ******* Action: ******* CommandLine: ********** MSI (c) (04:84) [10:47:00:331]: Client-side and UI is none or basic: Running entire install on the server. MSI (c) (04:84) [10:47:00:331]: Grabbed execution mutex. MSI (c) (04:84) [10:47:00:331]: Cloaking enabled. MSI (c) (04:84) [10:47:00:331]: Attempting to enable all disabled privileges before calling Install on Server MSI (c) (04:84) [10:47:00:331]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (58:DC) [10:47:00:331]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi MSI (s) (58:DC) [10:47:00:331]: Grabbed execution mutex. MSI (s) (58:88) [10:47:00:331]: Resetting cached policy values MSI (s) (58:88) [10:47:00:331]: Machine policy value 'Debug' is 0 MSI (s) (58:88) [10:47:00:331]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi ******* Action: ******* CommandLine: ********** MSI (s) (58:88) [10:47:00:331]: Machine policy value 'DisableUserInstalls' is 0 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 00005109C80000000000000000F01FEC MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 00005109C80000000000000000F01FEC MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 00005109C80090400000000000F01FEC MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 00005109C80090400000000000F01FEC MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 00005109F80000000100000000F01FEC MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 00005109F80000000100000000F01FEC MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 02DBB97E052406DED0985E96AD2628F9 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 02DBB97E052406DED0985E96AD2628F9 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 08FEB4391D9B68A4B8248D6A17A6D872 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 08FEB4391D9B68A4B8248D6A17A6D872 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 1007C6B46D7C017319E3B52CF3EC196E MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 1007C6B46D7C017319E3B52CF3EC196E MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 159C35FE2B970D627E4064B25F1056C6 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 159C35FE2B970D627E4064B25F1056C6 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 1926E8D15D0BCE53481466615F760A7F MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 1926E8D15D0BCE53481466615F760A7F MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 1D5E3C0FEDA1E123187686FED06E995A MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 1D5E3C0FEDA1E123187686FED06E995A MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 22EF11C02F35B9C4E99728B4010D79E6 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 22EF11C02F35B9C4E99728B4010D79E6 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 27220B77512B8424EA7FF66441E64708 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 27220B77512B8424EA7FF66441E64708 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 291AA275516EF904B8C1D1CA4765848A MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 291AA275516EF904B8C1D1CA4765848A MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 2A1E41C2BE4CE66438471882D627D3A3 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 2A1E41C2BE4CE66438471882D627D3A3 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 2A25F2EA311E1ECBC789148523907F5D MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 2A25F2EA311E1ECBC789148523907F5D MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 2B7A37F2E05E6A93A9CBFE984E6CE263 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 2B7A37F2E05E6A93A9CBFE984E6CE263 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 33C58598439EE364191E0BFC90F0CE35 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 33C58598439EE364191E0BFC90F0CE35 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 39103BDF0ADFAAD3CAAC7AE5FE5E6370 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 39103BDF0ADFAAD3CAAC7AE5FE5E6370 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 3AF2CDE243F15E43095885C8E9DFC16C MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 3AF2CDE243F15E43095885C8E9DFC16C MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 3D6AA218BEB57754881B0099B819BA14 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 3D6AA218BEB57754881B0099B819BA14 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 476A066DDA290D5B07A3223407071B95 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 476A066DDA290D5B07A3223407071B95 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 4794C33D033C5B74FB332773C27F1A83 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 4794C33D033C5B74FB332773C27F1A83 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 492665406B6A26447912300137BE6349 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 492665406B6A26447912300137BE6349 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 49851B357DC9E6767D58D41938F0FA8B MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 49851B357DC9E6767D58D41938F0FA8B MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 4C36813DE3ED0344296FB96C2B699EFB MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 4C36813DE3ED0344296FB96C2B699EFB MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 4ccf9caae9dddda409c15b94a670bae2 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 4ccf9caae9dddda409c15b94a670bae2 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 4EC82571333CBF849A4E8D147E59DCEC MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 4EC82571333CBF849A4E8D147E59DCEC MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 52CC158AA9BBB95D02816E8FE4AAD0E1 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 52CC158AA9BBB95D02816E8FE4AAD0E1 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 5C4834679ACBC703A9CADF44632686A6 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 5C4834679ACBC703A9CADF44632686A6 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 624C5EC8700570E4205DBF1CB39CBF44 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 624C5EC8700570E4205DBF1CB39CBF44 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 63821726FA33CB9E0BD53D1791FC0EDA MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 63821726FA33CB9E0BD53D1791FC0EDA MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 66EFFB1A1AE32D4EABC1C7523966CA85 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 66EFFB1A1AE32D4EABC1C7523966CA85 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 68AB67CA3301FFFFABE7000000000060 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 68AB67CA3301FFFFABE7000000000060 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 68AB67CA7DA7FFFFB744BA0000000010 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 68AB67CA7DA7FFFFB744BA0000000010 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 6925B44622B5EE049B4559892E1E24E7 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 6925B44622B5EE049B4559892E1E24E7 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 6933F4C8D131A39EEE30371C639FD5B9 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 6933F4C8D131A39EEE30371C639FD5B9 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 6B3FBDA838DB629D5B481304D7F256C7 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 6B3FBDA838DB629D5B481304D7F256C7 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 6EBEAD136FF4F784A89BB3FE9B8B361D MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 6EBEAD136FF4F784A89BB3FE9B8B361D MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 6FE34EAA304B040E4B6E72A644E15BB1 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 6FE34EAA304B040E4B6E72A644E15BB1 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 71460E5BCA4A52243BE6E7439C61617E MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 71460E5BCA4A52243BE6E7439C61617E MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 746D66A7B06460FC9E733AC39C3904B5 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 746D66A7B06460FC9E733AC39C3904B5 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 7546DEFEC13082F1523D5774A4A070F5 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 7546DEFEC13082F1523D5774A4A070F5 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 75AEEA8E341B2E543BDCD702F7A72771 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 75AEEA8E341B2E543BDCD702F7A72771 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 7AC9D7B6C805CD2D3E1801350855F707 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 7AC9D7B6C805CD2D3E1801350855F707 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 801ACD1A619E101DA6E2249441EDE0DA MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 801ACD1A619E101DA6E2249441EDE0DA MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 80630C7882DF8B548A8C9F3BF479E16B MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 80630C7882DF8B548A8C9F3BF479E16B MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 81741D5B9A67A04738C5FD75D15D87E6 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 81741D5B9A67A04738C5FD75D15D87E6 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 871647447D6B823A4200303947C36B9F MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 871647447D6B823A4200303947C36B9F MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 8E8701F070D87B9DDE5D88C820C71655 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 8E8701F070D87B9DDE5D88C820C71655 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 8FA9FC416A017AF4E9752DD2DB46C477 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 8FA9FC416A017AF4E9752DD2DB46C477 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 91AC1A8F8CEBE425BC44D48C5A158A94 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 91AC1A8F8CEBE425BC44D48C5A158A94 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 9259CB59B565C95FF9C60262954E335E MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 9259CB59B565C95FF9C60262954E335E MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 94F040F13DA50EE4E9A0817F33527EDC MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 94F040F13DA50EE4E9A0817F33527EDC MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 99E80CA9B0328e74791254777B1F42AE MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 99E80CA9B0328e74791254777B1F42AE MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 9D2FDDDB1E770B16D5DCC7DDFCD99B2C MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 9D2FDDDB1E770B16D5DCC7DDFCD99B2C MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 9D403D4F7467352459E74482B668134F MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 9D403D4F7467352459E74482B668134F MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: 9E1B888F3E46D97419BDD219393C5953 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: 9E1B888F3E46D97419BDD219393C5953 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: A089CE062ADB6BC44A720BA745894BAC MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: A089CE062ADB6BC44A720BA745894BAC MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: A10173754C72A804A8751DCD87FD484B MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: A10173754C72A804A8751DCD87FD484B MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: A438064BA7C613EC7A5CAF4D0F84C9F2 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: A438064BA7C613EC7A5CAF4D0F84C9F2 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: B06127B076F90C7458F8A50047611284 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: B06127B076F90C7458F8A50047611284 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: B2AC72EC3667B6F4E8164A5593A07CF1 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: B2AC72EC3667B6F4E8164A5593A07CF1 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: BC0A505DC8557622A2D26C60A1777CB2 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: BC0A505DC8557622A2D26C60A1777CB2 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: C215A171B26CB6C4F8DAB53B0496C5A1 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: C215A171B26CB6C4F8DAB53B0496C5A1 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: C3257C0EB6866EE3F81BBC34933EE0DD MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: C3257C0EB6866EE3F81BBC34933EE0DD MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: C58A66138AFE7E5351506330ECE438A6 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: C58A66138AFE7E5351506330ECE438A6 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: CFD2C1F142D260E3CB8B271543DA9F98 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: CFD2C1F142D260E3CB8B271543DA9F98 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: D20352A90C039D93DBF6126ECE614057 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: D20352A90C039D93DBF6126ECE614057 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: D30CF9A3586C138449FCE4FD3D474979 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: D30CF9A3586C138449FCE4FD3D474979 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: D62D391E6B23C9A79BF009CB796A3766 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: D62D391E6B23C9A79BF009CB796A3766 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: DA93DA4DE19033D4BBB2956FCF8BDA3C MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: DA93DA4DE19033D4BBB2956FCF8BDA3C MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: E0F71EC122C0F19D574C4D4433607082 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: E0F71EC122C0F19D574C4D4433607082 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: E28E226FAFFA48740AF84713F17561AC MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: E28E226FAFFA48740AF84713F17561AC MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: E4AF43EEA517AF64C9FA602EA64E12D7 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: E4AF43EEA517AF64C9FA602EA64E12D7 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: E7BC058DCB270154ABF48439B2AF2B59 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: E7BC058DCB270154ABF48439B2AF2B59 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: ED46E5150A0F9C684387C28C8B29854F MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: ED46E5150A0F9C684387C28C8B29854F MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: EFEE0228DC83E77358593193D847A0EC MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: EFEE0228DC83E77358593193D847A0EC MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: F2F289CDA38AD44C2562E6CD044C0869 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: F2F289CDA38AD44C2562E6CD044C0869 MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: F7322F45C810B3848848F90C8D88043C MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: F7322F45C810B3848848F90C8D88043C MSI (s) (58:88) [10:47:00:331]: Setting cached product context: machine assigned for product: F9979B2546CEC452F99AAC63D971E3E8 MSI (s) (58:88) [10:47:00:331]: Using cached product context: machine assigned for product: F9979B2546CEC452F99AAC63D971E3E8 MSI (s) (58:88) [10:47:00:347]: SRSetRestorePoint skipped for this transaction. MSI (s) (58:88) [10:47:00:347]: File will have security applied from OpCode. MSI (s) (58:88) [10:47:00:347]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi' against software restriction policy MSI (s) (58:88) [10:47:00:347]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi has a digital signature MSI (s) (58:88) [10:47:00:363]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi is permitted to run at the 'unrestricted' authorization level. MSI (s) (58:88) [10:47:00:363]: End dialog not enabled MSI (s) (58:88) [10:47:00:363]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi MSI (s) (58:88) [10:47:00:363]: Package we're running from ==> C:\Windows\Installer\92305.msi MSI (s) (58:88) [10:47:00:363]: APPCOMPAT: Compatibility mode property overrides found. MSI (s) (58:88) [10:47:00:363]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2831282D-8519-4910-B339-2302840ABEF3}'. MSI (s) (58:88) [10:47:00:363]: APPCOMPAT: no matching ProductCode found in database. MSI (s) (58:88) [10:47:00:363]: MSCOREE not loaded loading copy from system32 MSI (s) (58:88) [10:47:00:363]: Machine policy value 'TransformsSecure' is 0 MSI (s) (58:88) [10:47:00:363]: User policy value 'TransformsAtSource' is 0 MSI (s) (58:88) [10:47:00:363]: Machine policy value 'DisablePatch' is 0 MSI (s) (58:88) [10:47:00:363]: Machine policy value 'AllowLockdownPatch' is 0 MSI (s) (58:88) [10:47:00:363]: Machine policy value 'DisableLUAPatching' is 0 MSI (s) (58:88) [10:47:00:363]: Machine policy value 'DisableFlyWeightPatching' is 0 MSI (s) (58:88) [10:47:00:363]: Enabling baseline caching for this transaction since all active patches are MSI 3.0 style MSPs or at least one MSI 3.0 minor update patch is active MSI (s) (58:88) [10:47:00:363]: APPCOMPAT: looking for appcompat database entry with ProductCode '{2831282D-8519-4910-B339-2302840ABEF3}'. MSI (s) (58:88) [10:47:00:363]: APPCOMPAT: no matching ProductCode found in database. MSI (s) (58:88) [10:47:00:363]: Transforms are not secure. MSI (s) (58:88) [10:47:00:363]: Note: 1: 2205 2: 3: Control MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Users\tpc\AppData\Local\Temp\Sophos Endpoint Firewall 1.0.0.564 install log 20180126 104700.txt'. MSI (s) (58:88) [10:47:00:363]: Command Line: REBOOT=ReallySuppress ARPSYSTEMCOMPONENT=1 CURRENTDIRECTORY=C:\Program Files (x86)\Sophos\CloudInstaller CLIENTUILEVEL=3 MSICLIENTUSESEXTERNALUI=1 CLIENTPROCESSID=4612 MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{4B3C66C0-2036-482C-8B6E-20BD8A081136}'. MSI (s) (58:88) [10:47:00:363]: Product Code passed to Engine.Initialize: '' MSI (s) (58:88) [10:47:00:363]: Product Code from property table before transforms: '{2831282D-8519-4910-B339-2302840ABEF3}' MSI (s) (58:88) [10:47:00:363]: Product Code from property table after transforms: '{2831282D-8519-4910-B339-2302840ABEF3}' MSI (s) (58:88) [10:47:00:363]: Product not registered: beginning first-time install MSI (s) (58:88) [10:47:00:363]: Product {2831282D-8519-4910-B339-2302840ABEF3} is not managed. MSI (s) (58:88) [10:47:00:363]: MSI_LUA: Credential prompt not required, user is an admin MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'. MSI (s) (58:88) [10:47:00:363]: Entering CMsiConfigurationManager::SetLastUsedSource. MSI (s) (58:88) [10:47:00:363]: User policy value 'SearchOrder' is 'nmu' MSI (s) (58:88) [10:47:00:363]: Adding new sources is allowed. MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'. MSI (s) (58:88) [10:47:00:363]: Package name extracted from package path: 'Sophos Endpoint Firewall.msi' MSI (s) (58:88) [10:47:00:363]: Package to be registered: 'Sophos Endpoint Firewall.msi' MSI (s) (58:88) [10:47:00:363]: Note: 1: 2262 2: AdminProperties 3: -2147287038 MSI (s) (58:88) [10:47:00:363]: Machine policy value 'DisableMsi' is 0 MSI (s) (58:88) [10:47:00:363]: Machine policy value 'AlwaysInstallElevated' is 0 MSI (s) (58:88) [10:47:00:363]: User policy value 'AlwaysInstallElevated' is 0 MSI (s) (58:88) [10:47:00:363]: Product installation will be elevated because user is admin and product is being installed per-machine. MSI (s) (58:88) [10:47:00:363]: Running product '{2831282D-8519-4910-B339-2302840ABEF3}' with elevated privileges: Product is assigned. MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding REBOOT property. Its value is 'ReallySuppress'. MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding ARPSYSTEMCOMPONENT property. Its value is '1'. MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\Program Files (x86)\Sophos\CloudInstaller'. MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'. MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding MSICLIENTUSESEXTERNALUI property. Its value is '1'. MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '4612'. MSI (s) (58:88) [10:47:00:363]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0 MSI (s) (58:88) [10:47:00:363]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality. MSI (s) (58:88) [10:47:00:363]: TRANSFORMS property is now: MSI (s) (58:88) [10:47:00:363]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'. MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\Favorites MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Network Shortcuts MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\Documents MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Printer Shortcuts MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Recent MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\SendTo MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Templates MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\ProgramData MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Local MSI (s) (58:88) [10:47:00:363]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\Pictures MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Start Menu MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\Users\tpc\Desktop MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates MSI (s) (58:88) [10:47:00:378]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts MSI (s) (58:88) [10:47:00:378]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 MSI (s) (58:88) [10:47:00:378]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated. MSI (s) (58:88) [10:47:00:378]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'. MSI (s) (58:88) [10:47:00:378]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'. MSI (s) (58:88) [10:47:00:378]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (58:88) [10:47:00:378]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'TCH'. MSI (s) (58:88) [10:47:00:378]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (58:88) [10:47:00:378]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'Microsoft'. MSI (s) (58:88) [10:47:00:378]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Windows\Installer\92305.msi'. MSI (s) (58:88) [10:47:00:378]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi'. MSI (s) (58:88) [10:47:00:378]: Machine policy value 'MsiDisableEmbeddedUI' is 0 MSI (s) (58:88) [10:47:00:378]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI MSI (s) (58:88) [10:47:00:378]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install MSI (s) (58:88) [10:47:00:378]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (58:88) [10:47:00:378]: Machine policy value 'DisableRollback' is 0 MSI (s) (58:88) [10:47:00:378]: User policy value 'DisableRollback' is 0 MSI (s) (58:88) [10:47:00:378]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'. === Logging started: 1/26/2018 10:47:00 === MSI (s) (58:88) [10:47:00:378]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'. MSI (s) (58:88) [10:47:00:378]: Doing action: INSTALL MSI (s) (58:88) [10:47:00:378]: Note: 1: 2205 2: 3: ActionText Action start 10:47:00: INSTALL. MSI (s) (58:88) [10:47:00:378]: Running ExecuteSequence MSI (s) (58:88) [10:47:00:378]: Doing action: FindRelatedProducts MSI (s) (58:88) [10:47:00:378]: Note: 1: 2205 2: 3: ActionText Action start 10:47:00: FindRelatedProducts. MSI (s) (58:88) [10:47:00:378]: Doing action: AppSearch MSI (s) (58:88) [10:47:00:378]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: FindRelatedProducts. Return value 1. MSI (s) (58:88) [10:47:00:378]: Note: 1: 2205 2: 3: AppSearch MSI (s) (58:88) [10:47:00:378]: Note: 1: 2228 2: 3: AppSearch 4: SELECT `Property`, `Signature_` FROM `AppSearch` Action start 10:47:00: AppSearch. MSI (s) (58:88) [10:47:00:394]: Doing action: WixQueryOsWellKnownSID MSI (s) (58:88) [10:47:00:394]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: AppSearch. Return value 0. MSI (s) (58:88) [10:47:00:394]: Creating MSIHANDLE (164) of type 790542 for thread 5256 MSI (s) (58:AC) [10:47:00:394]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4059.tmp, Entrypoint: WixQueryOsWellKnownSID MSI (s) (58:B0) [10:47:00:394]: Generating random cookie. MSI (s) (58:B0) [10:47:00:394]: Created Custom Action Server with PID 5300 (0x14B4). MSI (s) (58:30) [10:47:00:409]: Running as a service. MSI (s) (58:30) [10:47:00:409]: Hello, I'm your 32bit Impersonated custom action server. MSI (s) (58!CC) [10:47:00:441]: Creating MSIHANDLE (165) of type 790541 for thread 5324 MSI (s) (58!CC) [10:47:00:441]: PROPERTY CHANGE: Adding WIX_ACCOUNT_LOCALSYSTEM property. Its value is 'NT AUTHORITY\SYSTEM'. MSI (s) (58!CC) [10:47:00:441]: PROPERTY CHANGE: Adding WIX_ACCOUNT_LOCALSERVICE property. Its value is 'NT AUTHORITY\LOCAL SERVICE'. MSI (s) (58!CC) [10:47:00:441]: PROPERTY CHANGE: Adding WIX_ACCOUNT_NETWORKSERVICE property. Its value is 'NT AUTHORITY\NETWORK SERVICE'. MSI (s) (58!CC) [10:47:00:441]: PROPERTY CHANGE: Adding WIX_ACCOUNT_ADMINISTRATORS property. Its value is 'BUILTIN\Administrators'. MSI (s) (58!CC) [10:47:00:441]: PROPERTY CHANGE: Adding WIX_ACCOUNT_USERS property. Its value is 'BUILTIN\Users'. MSI (s) (58!CC) [10:47:00:441]: PROPERTY CHANGE: Adding WIX_ACCOUNT_GUESTS property. Its value is 'BUILTIN\Guests'. MSI (s) (58!CC) [10:47:00:441]: Closing MSIHANDLE (165) of type 790541 for thread 5324 MSI (s) (58:AC) [10:47:00:441]: Closing MSIHANDLE (164) of type 790542 for thread 5256 Action start 10:47:00: WixQueryOsWellKnownSID. MSI (s) (58:88) [10:47:00:441]: Doing action: LaunchConditions MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: WixQueryOsWellKnownSID. Return value 1. Action start 10:47:00: LaunchConditions. MSI (s) (58:88) [10:47:00:441]: Doing action: ValidateProductID MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: LaunchConditions. Return value 1. Action start 10:47:00: ValidateProductID. MSI (s) (58:88) [10:47:00:441]: Skipping action: IsRemoveAllowed (condition is false) MSI (s) (58:88) [10:47:00:441]: Doing action: CostInitialize MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: ValidateProductID. Return value 1. MSI (s) (58:88) [10:47:00:441]: Machine policy value 'MaxPatchCacheSize' is 10 MSI (s) (58:88) [10:47:00:441]: Baseline: Sorting baselines for {2831282D-8519-4910-B339-2302840ABEF3}. MSI (s) (58:88) [10:47:00:441]: Baseline: New baseline 1.0.0 from transaction. MSI (s) (58:88) [10:47:00:441]: Baseline: Sorted order Native: Order 0. MSI (s) (58:88) [10:47:00:441]: Baseline Data Table: MSI (s) (58:88) [10:47:00:441]: ProductCode: {2831282D-8519-4910-B339-2302840ABEF3} Version: 1.0.0 Attributes: 0 PatchId: Native BaselineId: -2147483648 Order: 0 MSI (s) (58:88) [10:47:00:441]: Baseline File Table: MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'C:\'. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'. MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: Patch MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: __MsiPatchFileList MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (58:88) [10:47:00:441]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId` MSI (s) (58:88) [10:47:00:441]: Delta compression fallback method for this product transaction is 'MSI 2.0 legacy obsolescence' MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: Patch Action start 10:47:00: CostInitialize. MSI (s) (58:88) [10:47:00:441]: Doing action: FileCost MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: CostInitialize. Return value 1. MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: MsiAssembly MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: Class MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: Extension MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: TypeLib Action start 10:47:00: FileCost. MSI (s) (58:88) [10:47:00:441]: Doing action: CostFinalize MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: FileCost. Return value 1. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'. MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: Patch MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: Condition MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'C:\'. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding dirSophosProgram property. Its value is 'C:\Program Files\Sophos\'. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\Sophos\Endpoint Firewall\'. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding dirSophosData property. Its value is 'C:\ProgramData\Sophos\'. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding dirDataFolder property. Its value is 'C:\ProgramData\Sophos\Endpoint Firewall\'. MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding dirLogsFolder property. Its value is 'C:\ProgramData\Sophos\Endpoint Firewall\Logs\'. MSI (s) (58:88) [10:47:00:441]: Target path resolution complete. Dumping Directory table... MSI (s) (58:88) [10:47:00:441]: Note: target paths subject to change (via custom actions or browsing) MSI (s) (58:88) [10:47:00:441]: Dir (target): Key: TARGETDIR , Object: C:\ MSI (s) (58:88) [10:47:00:441]: Dir (target): Key: WindowsFolder , Object: C:\Windows\ MSI (s) (58:88) [10:47:00:441]: Dir (target): Key: ProgramFiles64Folder , Object: C:\Program Files\ MSI (s) (58:88) [10:47:00:441]: Dir (target): Key: dirSophosProgram , Object: C:\Program Files\Sophos\ MSI (s) (58:88) [10:47:00:441]: Dir (target): Key: INSTALLDIR , Object: C:\Program Files\Sophos\Endpoint Firewall\ MSI (s) (58:88) [10:47:00:441]: Dir (target): Key: CommonAppDataFolder , Object: C:\ProgramData\ MSI (s) (58:88) [10:47:00:441]: Dir (target): Key: dirSophosData , Object: C:\ProgramData\Sophos\ MSI (s) (58:88) [10:47:00:441]: Dir (target): Key: dirDataFolder , Object: C:\ProgramData\Sophos\Endpoint Firewall\ MSI (s) (58:88) [10:47:00:441]: Dir (target): Key: dirLogsFolder , Object: C:\ProgramData\Sophos\Endpoint Firewall\Logs\ MSI (s) (58:88) [10:47:00:441]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'. MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: MsiAssembly MSI (s) (58:88) [10:47:00:441]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ? Action start 10:47:00: CostFinalize. MSI (s) (58:88) [10:47:00:441]: Doing action: MigrateFeatureStates MSI (s) (58:88) [10:47:00:441]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: CostFinalize. Return value 1. Action start 10:47:00: MigrateFeatureStates. MSI (s) (58:88) [10:47:00:456]: Doing action: InstallValidate MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: MigrateFeatureStates. Return value 0. MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: Dialog MSI (s) (58:88) [10:47:00:456]: Feature: featSophosEndpointFirewall; Installed: Absent; Request: Local; Action: Local MSI (s) (58:88) [10:47:00:456]: Component: cmpDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (58:88) [10:47:00:456]: Component: cmpLogsFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (58:88) [10:47:00:456]: Component: cmpEfwAdapterDll; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (58:88) [10:47:00:456]: Component: cmpIntegrityDat; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (58:88) [10:47:00:456]: Component: cmpNoticeTxt; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (58:88) [10:47:00:456]: Component: cmpEfwRegistryKey; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (58:88) [10:47:00:456]: Component: cmpEfwTelemetryPluginExe; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (58:88) [10:47:00:456]: Component: cmpEfwTelemetryKey; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (58:88) [10:47:00:456]: Component: cmpTelemetryPersistKey; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (58:88) [10:47:00:456]: Component: __cmpEfwRegistryKey65; Installed: Null; Request: Local; Action: Local; Client State: Null MSI (s) (58:88) [10:47:00:456]: Component: __cmpTelemetryPersistKey65; Installed: Null; Request: Local; Action: Local; Client State: Null MSI (s) (58:88) [10:47:00:456]: Component: __cmpEfwTelemetryKey65; Installed: Null; Request: Local; Action: Local; Client State: Null MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: BindImage MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: ProgId MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: PublishComponent MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: SelfReg MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: Extension MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: Font MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: Shortcut MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: Class MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: TypeLib Action start 10:47:00: InstallValidate. MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: _RemoveFilePath MSI (s) (58:88) [10:47:00:456]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'. MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: BindImage MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: ProgId MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: PublishComponent MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: SelfReg MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: Extension MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: Font MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: Shortcut MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: Class MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: TypeLib MSI (s) (58:88) [10:47:00:456]: Note: 1: 2727 2: MSI (s) (58:88) [10:47:00:456]: Note: 1: 2727 2: MSI (s) (58:88) [10:47:00:456]: Doing action: RemoveExistingProducts MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: InstallValidate. Return value 1. Action start 10:47:00: RemoveExistingProducts. MSI (s) (58:88) [10:47:00:456]: Doing action: SetARPINSTALLLOCATION MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: RemoveExistingProducts. Return value 1. MSI (s) (58:88) [10:47:00:456]: PROPERTY CHANGE: Adding ARPINSTALLLOCATION property. Its value is 'C:\Program Files\Sophos\Endpoint Firewall\'. Action start 10:47:00: SetARPINSTALLLOCATION. MSI (s) (58:88) [10:47:00:456]: Doing action: InstallInitialize MSI (s) (58:88) [10:47:00:456]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: SetARPINSTALLLOCATION. Return value 1. MSI (s) (58:88) [10:47:00:456]: Machine policy value 'AlwaysInstallElevated' is 0 MSI (s) (58:88) [10:47:00:456]: User policy value 'AlwaysInstallElevated' is 0 MSI (s) (58:88) [10:47:00:456]: BeginTransaction: Locking Server MSI (s) (58:88) [10:47:00:456]: SRSetRestorePoint skipped for this transaction. MSI (s) (58:88) [10:47:00:456]: Server not locked: locking for product {2831282D-8519-4910-B339-2302840ABEF3} Action start 10:47:00: InstallInitialize. MSI (s) (58:88) [10:47:00:550]: Doing action: ProcessComponents MSI (s) (58:88) [10:47:00:550]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: InstallInitialize. Return value 1. MSI (s) (58:88) [10:47:00:550]: Note: 1: 2205 2: 3: MsiPatchCertificate MSI (s) (58:88) [10:47:00:550]: LUA patching is disabled: missing MsiPatchCertificate table MSI (s) (58:88) [10:47:00:550]: Resolving source. MSI (s) (58:88) [10:47:00:550]: Resolving source to launched-from source. MSI (s) (58:88) [10:47:00:550]: Setting launched-from source as last-used. MSI (s) (58:88) [10:47:00:550]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\'. MSI (s) (58:88) [10:47:00:550]: PROPERTY CHANGE: Adding SOURCEDIR property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\'. MSI (s) (58:88) [10:47:00:550]: PROPERTY CHANGE: Adding SourcedirProduct property. Its value is '{2831282D-8519-4910-B339-2302840ABEF3}'. MSI (s) (58:88) [10:47:00:550]: SOURCEDIR ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\ MSI (s) (58:88) [10:47:00:550]: SOURCEDIR product ==> {2831282D-8519-4910-B339-2302840ABEF3} MSI (s) (58:88) [10:47:00:550]: SECREPAIR: CryptAcquireContext succeeded MSI (s) (58:88) [10:47:00:550]: Determining source type MSI (s) (58:88) [10:47:00:550]: Source type from package 'Sophos Endpoint Firewall.msi': 0 MSI (s) (58:88) [10:47:00:550]: SECREPAIR: Hash Database: C:\Windows\Installer\SourceHash{2831282D-8519-4910-B339-2302840ABEF3} MSI (s) (58:88) [10:47:00:550]: Note: 1: 2262 2: SourceHash 3: -2147287038 MSI (s) (58:88) [10:47:00:550]: SECREPAIR: New Hash Database creation complete. MSI (s) (58:88) [10:47:00:565]: SECREPAIR: Hash Value for the file:Sophos Endpoint Firewall.msi is: KM8MvpnPpG3jm+KWI4sbiL3D7BAo5ITSWp50jxZ5B8w= MSI (s) (58:88) [10:47:00:581]: SECREPAIR: Hash Value for the file:Sophos\Endpoint Firewall\EfwAdapter.dll is: EvvoB4sd07w7+uK+1Bw1MDcesDD+uYT4mQOsdeQwazA= MSI (s) (58:88) [10:47:00:581]: SECREPAIR: Hash Value for the file:Sophos\Endpoint Firewall\integrity.dat is: CyqhHfEk7gCXuL+Mfc4wV4whqIksvuOIvcHplUJFYbA= MSI (s) (58:88) [10:47:00:581]: SECREPAIR: Hash Value for the file:Sophos\Endpoint Firewall\NOTICE.txt is: l4u/4NuZXgTNIr4kzDxXuwrEEhDMzfjOOYViTNxCQCw= MSI (s) (58:88) [10:47:00:581]: SECREPAIR: Hash Value for the file:Sophos\Endpoint Firewall\EfwTelemetryPlugin.exe is: U1qySZ66FzTp+jabuwVRWM+ItWK+u3mJQsuDcFUXLjg= Action start 10:47:00: ProcessComponents. MSI (s) (58:88) [10:47:00:581]: Source path resolution complete. Dumping Directory table... MSI (s) (58:88) [10:47:00:581]: Dir (source): Key: TARGETDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\ , LongSubPath: , ShortSubPath: MSI (s) (58:88) [10:47:00:581]: Dir (source): Key: WindowsFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\ , LongSubPath: , ShortSubPath: MSI (s) (58:88) [10:47:00:581]: Dir (source): Key: ProgramFiles64Folder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\ , LongSubPath: , ShortSubPath: MSI (s) (58:88) [10:47:00:581]: Dir (source): Key: dirSophosProgram , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (58:88) [10:47:00:581]: Dir (source): Key: INSTALLDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos\Endpoint Firewall\ , LongSubPath: Sophos\Endpoint Firewall\ , ShortSubPath: Sophos\cwrj16-e\ MSI (s) (58:88) [10:47:00:581]: Dir (source): Key: CommonAppDataFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\ , LongSubPath: , ShortSubPath: MSI (s) (58:88) [10:47:00:581]: Dir (source): Key: dirSophosData , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (58:88) [10:47:00:581]: Dir (source): Key: dirDataFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos\Endpoint Firewall\ , LongSubPath: Sophos\Endpoint Firewall\ , ShortSubPath: Sophos\rev_xszz\ MSI (s) (58:88) [10:47:00:581]: Dir (source): Key: dirLogsFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos\Endpoint Firewall\Logs\ , LongSubPath: Sophos\Endpoint Firewall\Logs\ , ShortSubPath: Sophos\rev_xszz\Logs\ MSI (s) (58:88) [10:47:00:581]: Note: 1: 2205 2: 3: ActionText MSI (s) (58:88) [10:47:00:581]: Note: 1: 2205 2: 3: ActionText MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ActionText MSI (s) (58:88) [10:47:00:597]: Doing action: UnpublishFeatures MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: ProcessComponents. Return value 1. Action start 10:47:00: UnpublishFeatures. MSI (s) (58:88) [10:47:00:597]: Skipping action: DisableAndUnloadMcsAdapterRollback.SetProperty (condition is false) MSI (s) (58:88) [10:47:00:597]: Skipping action: DisableAndUnloadMcsAdapterRollback (condition is false) MSI (s) (58:88) [10:47:00:597]: Skipping action: DisableAndUnloadMcsAdapter.SetProperty (condition is false) MSI (s) (58:88) [10:47:00:597]: Skipping action: DisableAndUnloadMcsAdapter (condition is false) MSI (s) (58:88) [10:47:00:597]: Doing action: StopServices MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: UnpublishFeatures. Return value 1. MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ServiceControl MSI (s) (58:88) [10:47:00:597]: Note: 1: 2228 2: 3: ServiceControl 4: SELECT `Name`,`Wait`,`Arguments`,`Event`, `Action` FROM `ServiceControl`, `Component` WHERE `Component_` = `Component` AND (`Action` = 0 OR `Action` = 1 OR `Action` = 2) Action start 10:47:00: StopServices. MSI (s) (58:88) [10:47:00:597]: Doing action: RemoveRegistryValues MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: StopServices. Return value 1. Action start 10:47:00: RemoveRegistryValues. MSI (s) (58:88) [10:47:00:597]: Doing action: RemoveFiles MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: RemoveRegistryValues. Return value 1. MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: RemoveFile MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: RemoveFile Action start 10:47:00: RemoveFiles. MSI (s) (58:88) [10:47:00:597]: Doing action: RemoveFolders MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: RemoveFiles. Return value 0. Action start 10:47:00: RemoveFolders. MSI (s) (58:88) [10:47:00:597]: Doing action: CreateFolders MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: RemoveFolders. Return value 1. MSI (s) (58:88) [10:47:00:597]: Finished allocating new user SID MSI (s) (58:88) [10:47:00:597]: Finished allocating new user SID MSI (s) (58:88) [10:47:00:597]: Finished allocating new user SID MSI (s) (58:88) [10:47:00:597]: Using well known SID for System MSI (s) (58:88) [10:47:00:597]: Finished allocating new user SID Action start 10:47:00: CreateFolders. MSI (s) (58:88) [10:47:00:597]: Doing action: InstallFiles MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: CreateFolders. Return value 1. MSI (s) (58:88) [10:47:00:597]: The file represented by File table key 'filEfwAdapterDll' has no eligible binary patches MSI (s) (58:88) [10:47:00:597]: The file represented by File table key 'filIntegrityDat' has no eligible binary patches MSI (s) (58:88) [10:47:00:597]: The file represented by File table key 'filNoticeTxt' has no eligible binary patches MSI (s) (58:88) [10:47:00:597]: The file represented by File table key 'filEfwTelemetryPluginExe' has no eligible binary patches Action start 10:47:00: InstallFiles. MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: Patch MSI (s) (58:88) [10:47:00:597]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence` MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: MsiSFCBypass MSI (s) (58:88) [10:47:00:597]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ? MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (58:88) [10:47:00:597]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ? MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (58:88) [10:47:00:597]: Doing action: WriteRegistryValues MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: InstallFiles. Return value 1. Action start 10:47:00: WriteRegistryValues. MSI (s) (58:88) [10:47:00:597]: Doing action: CreateTelemetryRegistryValue MSI (s) (58:88) [10:47:00:597]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: WriteRegistryValues. Return value 1. Action start 10:47:00: CreateTelemetryRegistryValue. MSI (s) (58:88) [10:47:00:612]: Doing action: StartServices MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: CreateTelemetryRegistryValue. Return value 1. MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ServiceControl MSI (s) (58:88) [10:47:00:612]: Note: 1: 2228 2: 3: ServiceControl 4: SELECT `Name`,`Wait`,`Arguments`,`Event`, `Action` FROM `ServiceControl`, `Component` WHERE `Component_` = `Component` AND (`Action` = 0 OR `Action` = 1 OR `Action` = 2) Action start 10:47:00: StartServices. MSI (s) (58:88) [10:47:00:612]: Doing action: EnableAndLoadMcsAdapterRollback.SetProperty MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: StartServices. Return value 1. MSI (s) (58:88) [10:47:00:612]: PROPERTY CHANGE: Adding EnableAndLoadMcsAdapterRollback property. Its value is 'C:\Program Files\Sophos\Endpoint Firewall\EfwAdapter.dll'. Action start 10:47:00: EnableAndLoadMcsAdapterRollback.SetProperty. MSI (s) (58:88) [10:47:00:612]: Doing action: EnableAndLoadMcsAdapterRollback MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: EnableAndLoadMcsAdapterRollback.SetProperty. Return value 1. Action start 10:47:00: EnableAndLoadMcsAdapterRollback. MSI (s) (58:88) [10:47:00:612]: Doing action: EnableFirewallAuditing MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: EnableAndLoadMcsAdapterRollback. Return value 1. Action start 10:47:00: EnableFirewallAuditing. MSI (s) (58:88) [10:47:00:612]: Doing action: EnableAndLoadMcsAdapter.SetProperty MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: EnableFirewallAuditing. Return value 1. MSI (s) (58:88) [10:47:00:612]: PROPERTY CHANGE: Adding EnableAndLoadMcsAdapter property. Its value is 'C:\Program Files\Sophos\Endpoint Firewall\EfwAdapter.dll'. Action start 10:47:00: EnableAndLoadMcsAdapter.SetProperty. MSI (s) (58:88) [10:47:00:612]: Doing action: EnableAndLoadMcsAdapter MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: EnableAndLoadMcsAdapter.SetProperty. Return value 1. Action start 10:47:00: EnableAndLoadMcsAdapter. MSI (s) (58:88) [10:47:00:612]: Doing action: RegisterUser MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: EnableAndLoadMcsAdapter. Return value 1. Action start 10:47:00: RegisterUser. MSI (s) (58:88) [10:47:00:612]: Doing action: RegisterProduct MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: RegisterUser. Return value 1. Action start 10:47:00: RegisterProduct. MSI (s) (58:88) [10:47:00:612]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'. MSI (s) (58:88) [10:47:00:612]: Doing action: PublishFeatures MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: RegisterProduct. Return value 1. Action start 10:47:00: PublishFeatures. MSI (s) (58:88) [10:47:00:612]: Doing action: PublishProduct MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: PublishFeatures. Return value 1. Action start 10:47:00: PublishProduct. MSI (s) (58:88) [10:47:00:612]: Skipping action: WixFailWhenDeferred (condition is false) MSI (s) (58:88) [10:47:00:612]: Doing action: InstallFinalize MSI (s) (58:88) [10:47:00:612]: Note: 1: 2205 2: 3: ActionText Action ended 10:47:00: PublishProduct. Return value 1. MSI (s) (58:88) [10:47:00:612]: Running Script: C:\Windows\Installer\MSI4115.tmp MSI (s) (58:88) [10:47:00:612]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'. MSI (s) (58:88) [10:47:00:612]: Machine policy value 'DisableRollback' is 0 MSI (s) (58:88) [10:47:00:628]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (58:88) [10:47:00:628]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1278891489,LangId=1033,Platform=589824,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1) Action start 10:47:00: InstallFinalize. MSI (s) (58:88) [10:47:00:628]: Executing op: ProductInfo(ProductKey={2831282D-8519-4910-B339-2302840ABEF3},ProductName=Sophos Endpoint Firewall,PackageName=Sophos Endpoint Firewall.msi,Language=1033,Version=16777216,Assignment=1,ObsoleteArg=0,ProductIcon=icoInstaller,,PackageCode={4B3C66C0-2036-482C-8B6E-20BD8A081136},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3) MSI (s) (58:88) [10:47:00:628]: Executing op: DialogInfo(Type=0,Argument=1033) MSI (s) (58:88) [10:47:00:628]: Executing op: DialogInfo(Type=1,Argument=Sophos Endpoint Firewall) MSI (s) (58:88) [10:47:00:628]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1]) MSI (s) (58:88) [10:47:00:628]: Executing op: SetBaseline(Baseline=0,) MSI (s) (58:88) [10:47:00:628]: Executing op: SetBaseline(Baseline=1,) MSI (s) (58:88) [10:47:00:628]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,) MSI (s) (58:88) [10:47:00:628]: Executing op: ProgressTotal(Total=9,Type=1,ByteEquivalent=24000) MSI (s) (58:88) [10:47:00:628]: Executing op: ComponentRegister(ComponentId={72C6A988-3DD3-45C1-AC9E-BE9D903BE967},KeyPath=C:\ProgramData\Sophos\Endpoint Firewall\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (58:88) [10:47:00:628]: Executing op: ComponentRegister(ComponentId={B8E69B43-832F-41ED-9929-C421434FFF28},KeyPath=C:\ProgramData\Sophos\Endpoint Firewall\Logs\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (58:88) [10:47:00:628]: Executing op: ComponentRegister(ComponentId={CBF73D2B-1BF9-4A0F-9698-1E2AC2E55EE4},KeyPath=C:\Program Files\Sophos\Endpoint Firewall\EfwAdapter.dll,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (58:88) [10:47:00:628]: Executing op: ComponentRegister(ComponentId={9949C0F5-D4C7-4D91-9621-5795B6737F83},KeyPath=C:\Program Files\Sophos\Endpoint Firewall\integrity.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (58:88) [10:47:00:628]: Executing op: ComponentRegister(ComponentId={47976696-8995-4D7F-B6D5-EF9D83DB7E84},KeyPath=C:\Program Files\Sophos\Endpoint Firewall\NOTICE.txt,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (58:88) [10:47:00:628]: Executing op: ComponentRegister(ComponentId={992EA78D-086F-40FE-9265-9088EF188556},KeyPath=C:\Program Files\Sophos\Endpoint Firewall\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (58:88) [10:47:00:628]: Executing op: ComponentRegister(ComponentId={4170DD63-F675-4DF2-BFE5-AF1771D2CC2E},KeyPath=C:\Program Files\Sophos\Endpoint Firewall\EfwTelemetryPlugin.exe,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (58:88) [10:47:00:628]: Executing op: ComponentRegister(ComponentId={44275EF8-0891-4992-BB9A-A97821F12D6C},KeyPath=C:\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0) MSI (s) (58:88) [10:47:00:628]: Executing op: ComponentRegister(ComponentId={B9AA0A92-2E3D-4291-B643-C04CF1E7AB48},KeyPath=C:\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (58:88) [10:47:00:628]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1]) MSI (s) (58:88) [10:47:00:628]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Endpoint Firewall\,Foreign=0,SecurityDescriptor=BinaryData,) MSI (s) (58:88) [10:47:00:628]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Endpoint Firewall\Logs\,Foreign=0,SecurityDescriptor=BinaryData,) MSI (s) (58:88) [10:47:00:628]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Endpoint Firewall\,Foreign=0,,) MSI (s) (58:88) [10:47:00:643]: Executing op: FolderCreate(Folder=C:\,Foreign=0,,) MSI (s) (58:88) [10:47:00:643]: Executing op: FolderCreate(Folder=C:\,Foreign=0,,) MSI (s) (58:88) [10:47:00:643]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6]) MSI (s) (58:88) [10:47:00:643]: Executing op: ProgressTotal(Total=1465885,Type=0,ByteEquivalent=1) MSI (s) (58:88) [10:47:00:643]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Endpoint Firewall\) MSI (s) (58:88) [10:47:00:643]: Executing op: SetSourceFolder(Folder=1\Sophos\cwrj16-e\|Sophos\Endpoint Firewall\) MSI (s) (58:88) [10:47:00:643]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=65536,CopierType=0,,,,,,IsFirstPhysicalMedia=1) MSI (s) (58:88) [10:47:00:643]: Executing op: FileCopy(SourceName=nhfkxdyq.dll|EfwAdapter.dll,SourceCabKey=filEfwAdapterDll,DestName=EfwAdapter.dll,Attributes=512,FileSize=1200696,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.0.0.564,Language=2057,InstallMode=58982400,,,,,,,) MSI (s) (58:88) [10:47:00:643]: File: C:\Program Files\Sophos\Endpoint Firewall\EfwAdapter.dll; To be installed; Won't patch; No existing file MSI (s) (58:88) [10:47:00:643]: Source for file 'EfwAdapter.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos\Endpoint Firewall\'. MSI (s) (58:88) [10:47:00:643]: Executing op: FileCopy(SourceName=kratgzmv.exe|EfwTelemetryPlugin.exe,SourceCabKey=filEfwTelemetryPluginExe,DestName=EfwTelemetryPlugin.exe,Attributes=512,FileSize=250504,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.0.0.564,Language=2057,InstallMode=58982400,,,,,,,) MSI (s) (58:88) [10:47:00:643]: File: C:\Program Files\Sophos\Endpoint Firewall\EfwTelemetryPlugin.exe; To be installed; Won't patch; No existing file MSI (s) (58:88) [10:47:00:643]: Source for file 'EfwTelemetryPlugin.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos\Endpoint Firewall\'. MSI (s) (58:88) [10:47:00:643]: Executing op: FileCopy(SourceName=wl-98nu1.dat|integrity.dat,SourceCabKey=filIntegrityDat,DestName=integrity.dat,Attributes=512,FileSize=1204,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-422664028,HashPart2=-1992495266,HashPart3=-236173318,HashPart4=181182075,,) MSI (s) (58:88) [10:47:00:643]: File: C:\Program Files\Sophos\Endpoint Firewall\integrity.dat; To be installed; Won't patch; No existing file MSI (s) (58:88) [10:47:00:643]: Source for file 'integrity.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos\Endpoint Firewall\'. MSI (s) (58:88) [10:47:00:643]: Executing op: FileCopy(SourceName=NOTICE.txt,SourceCabKey=filNoticeTxt,DestName=NOTICE.txt,Attributes=512,FileSize=13481,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=1827200457,HashPart2=419014115,HashPart3=1687052901,HashPart4=-602903739,,) MSI (s) (58:88) [10:47:00:643]: File: C:\Program Files\Sophos\Endpoint Firewall\NOTICE.txt; To be installed; Won't patch; No existing file MSI (s) (58:88) [10:47:00:643]: Source for file 'NOTICE.txt' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos\Endpoint Firewall\'. MSI (s) (58:88) [10:47:00:643]: Executing op: CacheSizeFlush(,) MSI (s) (58:88) [10:47:00:643]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3]) MSI (s) (58:88) [10:47:00:643]: Executing op: ProgressTotal(Total=7,Type=1,ByteEquivalent=13200) MSI (s) (58:88) [10:47:00:643]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Telemetry\Plugins\EFW,,BinaryType=0,,) MSI (s) (58:88) [10:47:00:643]: Executing op: RegAddValue(Name=Path,Value=C:\Program Files\Sophos\Endpoint Firewall\EfwTelemetryPlugin.exe,) MSI (s) (58:88) [10:47:00:643]: Executing op: RegAddValue(Name=Cmd,Value=EfwTelemetryPlugin.exe,) MSI (s) (58:88) [10:47:00:643]: Executing op: RegCreateKey() MSI (s) (58:88) [10:47:00:643]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos,,BinaryType=1,,) MSI (s) (58:88) [10:47:00:643]: Executing op: RegCreateKey() MSI (s) (58:88) [10:47:00:643]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Endpoint Firewall\Logging,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (58:88) [10:47:00:643]: Executing op: RegCreateKey() MSI (s) (58:88) [10:47:00:643]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Endpoint Firewall,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (58:88) [10:47:00:643]: Executing op: RegCreateKey() MSI (s) (58:88) [10:47:00:643]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Endpoint Firewall\Telemetry,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (58:88) [10:47:00:643]: Executing op: RegCreateKey() MSI (s) (58:88) [10:47:00:643]: Executing op: ActionStart(Name=CreateTelemetryRegistryValue,,) MSI (s) (58:88) [10:47:00:643]: Executing op: CustomActionSchedule(Action=CreateTelemetryRegistryValue,ActionType=1025,Source=BinaryData,Target=CreateTelemetryRegistryValue,) MSI (s) (58:88) [10:47:00:659]: Creating MSIHANDLE (166) of type 790536 for thread 5256 MSI (s) (58:D0) [10:47:00:659]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4156.tmp, Entrypoint: CreateTelemetryRegistryValue MSI (s) (58!D4) [10:47:00:659]: Creating MSIHANDLE (167) of type 790531 for thread 5332 MSI (s) (58!D4) [10:47:00:659]: Closing MSIHANDLE (167) of type 790531 for thread 5332 MSI (s) (58:D0) [10:47:00:659]: Closing MSIHANDLE (166) of type 790536 for thread 5256 MSI (s) (58:88) [10:47:00:659]: Executing op: ActionStart(Name=EnableAndLoadMcsAdapterRollback,,) CreateTelemetryRegistryValue: Initialized. MSI (s) (58:88) [10:47:00:659]: Executing op: CustomActionSchedule(Action=EnableAndLoadMcsAdapterRollback,ActionType=1281,Source=BinaryData,Target=DisableAndUnloadMcsAdapter,CustomActionData=C:\Program Files\Sophos\Endpoint Firewall\EfwAdapter.dll) MSI (s) (58:88) [10:47:00:675]: Executing op: ActionStart(Name=EnableFirewallAuditing,,) MSI (s) (58:88) [10:47:00:675]: Executing op: CustomActionSchedule(Action=EnableFirewallAuditing,ActionType=1025,Source=BinaryData,Target=EnableFirewallAuditing,) MSI (s) (58:88) [10:47:00:675]: Creating MSIHANDLE (168) of type 790536 for thread 5256 MSI (s) (58:D8) [10:47:00:675]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4176.tmp, Entrypoint: EnableFirewallAuditing MSI (s) (58!DC) [10:47:00:675]: Creating MSIHANDLE (169) of type 790531 for thread 5340 MSI (s) (58!DC) [10:47:00:675]: Closing MSIHANDLE (169) of type 790531 for thread 5340 MSI (s) (58!DC) [10:47:00:675]: Creating MSIHANDLE (170) of type 790531 for thread 5340 EnableFirewallAuditing: Initialized. MSI (s) (58!DC) [10:47:00:675]: Closing MSIHANDLE (170) of type 790531 for thread 5340 EnableFirewallAuditing: Error 0x80004005: Could not set firewall auditing information MSI (s) (58:D8) [10:47:00:675]: Closing MSIHANDLE (168) of type 790536 for thread 5256 CustomAction EnableFirewallAuditing returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) MSI (s) (58:88) [10:47:00:690]: User policy value 'DisableRollback' is 0 MSI (s) (58:88) [10:47:00:690]: Machine policy value 'DisableRollback' is 0 Action ended 10:47:00: InstallFinalize. Return value 3. MSI (s) (58:88) [10:47:00:690]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1278891489,LangId=1033,Platform=589824,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1) MSI (s) (58:88) [10:47:00:690]: Executing op: DialogInfo(Type=0,Argument=1033) MSI (s) (58:88) [10:47:00:690]: Executing op: DialogInfo(Type=1,Argument=Sophos Endpoint Firewall) MSI (s) (58:88) [10:47:00:690]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1]) MSI (s) (58:88) [10:47:00:690]: Executing op: ActionStart(Name=EnableFirewallAuditing,,) MSI (s) (58:88) [10:47:00:690]: Executing op: ProductInfo(ProductKey={2831282D-8519-4910-B339-2302840ABEF3},ProductName=Sophos Endpoint Firewall,PackageName=Sophos Endpoint Firewall.msi,Language=1033,Version=16777216,Assignment=1,ObsoleteArg=0,ProductIcon=icoInstaller,,PackageCode={4B3C66C0-2036-482C-8B6E-20BD8A081136},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3) MSI (s) (58:88) [10:47:00:690]: Executing op: ActionStart(Name=EnableAndLoadMcsAdapterRollback,,) MSI (s) (58:88) [10:47:00:690]: Executing op: CustomActionRollback(Action=EnableAndLoadMcsAdapterRollback,ActionType=1281,Source=BinaryData,Target=DisableAndUnloadMcsAdapter,CustomActionData=C:\Program Files\Sophos\Endpoint Firewall\EfwAdapter.dll) MSI (s) (58:88) [10:47:00:690]: Creating MSIHANDLE (171) of type 790536 for thread 5256 MSI (s) (58:E0) [10:47:00:690]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI4187.tmp, Entrypoint: DisableAndUnloadMcsAdapter MSI (s) (58!E4) [10:47:00:690]: Creating MSIHANDLE (172) of type 790531 for thread 5348 MSI (s) (58!E4) [10:47:00:690]: Closing MSIHANDLE (172) of type 790531 for thread 5348 MSI (s) (58!E4) [10:47:00:690]: Creating MSIHANDLE (173) of type 790531 for thread 5348 DisableAndUnloadMcsAdapter: Initialized. MSI (s) (58!E4) [10:47:00:690]: Closing MSIHANDLE (173) of type 790531 for thread 5348 MSI (s) (58!E4) [10:47:00:690]: Creating MSIHANDLE (174) of type 790531 for thread 5348 DisableAndUnloadMcsAdapter: EFW adapter key is missing MSI (s) (58!E4) [10:47:00:690]: Closing MSIHANDLE (174) of type 790531 for thread 5348 MSI (s) (58!E4) [10:47:00:690]: Creating MSIHANDLE (175) of type 790531 for thread 5348 DisableAndUnloadMcsAdapter: About to wait for the EFW adapter to be unloaded MSI (s) (58!E4) [10:47:00:690]: Closing MSIHANDLE (175) of type 790531 for thread 5348 MSI (s) (58:E0) [10:47:00:706]: Closing MSIHANDLE (171) of type 790536 for thread 5256 DisableAndUnloadMcsAdapter: EFW adapter unloaded MSI (s) (58:88) [10:47:00:706]: Executing op: ActionStart(Name=CreateTelemetryRegistryValue,,) MSI (s) (58:88) [10:47:00:706]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3]) MSI (s) (58:88) [10:47:00:706]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Endpoint Firewall\Telemetry,,BinaryType=1,,) MSI (s) (58:88) [10:47:00:706]: Executing op: RegRemoveKey() MSI (s) (58:88) [10:47:00:706]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Endpoint Firewall,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (58:88) [10:47:00:706]: Executing op: RegCreateKey() MSI (s) (58:88) [10:47:00:706]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Endpoint Firewall\Logging,,BinaryType=1,,) MSI (s) (58:88) [10:47:00:706]: Executing op: RegRemoveKey() MSI (s) (58:88) [10:47:00:706]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (58:88) [10:47:00:706]: Executing op: RegCreateKey() MSI (s) (58:88) [10:47:00:706]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Telemetry\Plugins\EFW,,BinaryType=0,,) MSI (s) (58:88) [10:47:00:706]: Executing op: RegCreateKey() MSI (s) (58:88) [10:47:00:706]: Executing op: RegRemoveValue(Name=Cmd,Value=EfwTelemetryPlugin.exe,) MSI (s) (58:88) [10:47:00:706]: Executing op: RegCreateKey() MSI (s) (58:88) [10:47:00:706]: Executing op: RegRemoveValue(Name=Path,Value=C:\Program Files\Sophos\Endpoint Firewall\EfwTelemetryPlugin.exe,) MSI (s) (58:88) [10:47:00:706]: Executing op: RegRemoveKey() MSI (s) (58:88) [10:47:00:706]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\Software\Sophos\Telemetry\Plugins\EFW 3: 2 MSI (s) (58:88) [10:47:00:706]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6]) MSI (s) (58:88) [10:47:00:706]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Endpoint Firewall\) MSI (s) (58:88) [10:47:00:706]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Endpoint Firewall\NOTICE.txt,,) MSI (s) (58:88) [10:47:00:706]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Endpoint Firewall\integrity.dat,,) MSI (s) (58:88) [10:47:00:706]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Endpoint Firewall\EfwTelemetryPlugin.exe,,) MSI (s) (58:88) [10:47:00:706]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Endpoint Firewall\EfwAdapter.dll,,) MSI (s) (58:88) [10:47:00:706]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1]) MSI (s) (58:88) [10:47:00:706]: Executing op: FolderCreate(Folder=C:\,Foreign=0,SecurityDescriptor=BinaryData,) MSI (s) (58:88) [10:47:00:706]: Executing op: FolderCreate(Folder=C:\,Foreign=0,SecurityDescriptor=BinaryData,) MSI (s) (58:88) [10:47:00:706]: Executing op: FolderRemove(Folder=C:\Program Files\Sophos\Endpoint Firewall\,Foreign=0) MSI (s) (58:88) [10:47:00:706]: Note: 1: 2318 2: MSI (s) (58:88) [10:47:00:706]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Endpoint Firewall\Logs\,Foreign=0) MSI (s) (58:88) [10:47:00:706]: Note: 1: 2318 2: MSI (s) (58:88) [10:47:00:706]: Note: 1: 2318 2: MSI (s) (58:88) [10:47:00:706]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Endpoint Firewall\,Foreign=0) MSI (s) (58:88) [10:47:00:706]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,) MSI (s) (58:88) [10:47:00:706]: Executing op: ComponentUnregister(ComponentId={B9AA0A92-2E3D-4291-B643-C04CF1E7AB48},ProductKey={2831282D-8519-4910-B339-2302840ABEF3},BinaryType=1,) MSI (s) (58:88) [10:47:00:706]: Executing op: ComponentUnregister(ComponentId={44275EF8-0891-4992-BB9A-A97821F12D6C},ProductKey={2831282D-8519-4910-B339-2302840ABEF3},BinaryType=0,) MSI (s) (58:88) [10:47:00:706]: Executing op: ComponentUnregister(ComponentId={4170DD63-F675-4DF2-BFE5-AF1771D2CC2E},ProductKey={2831282D-8519-4910-B339-2302840ABEF3},BinaryType=1,) MSI (s) (58:88) [10:47:00:706]: Executing op: ComponentUnregister(ComponentId={992EA78D-086F-40FE-9265-9088EF188556},ProductKey={2831282D-8519-4910-B339-2302840ABEF3},BinaryType=1,) MSI (s) (58:88) [10:47:00:706]: Executing op: ComponentUnregister(ComponentId={47976696-8995-4D7F-B6D5-EF9D83DB7E84},ProductKey={2831282D-8519-4910-B339-2302840ABEF3},BinaryType=1,) MSI (s) (58:88) [10:47:00:721]: Executing op: ComponentUnregister(ComponentId={9949C0F5-D4C7-4D91-9621-5795B6737F83},ProductKey={2831282D-8519-4910-B339-2302840ABEF3},BinaryType=1,) MSI (s) (58:88) [10:47:00:721]: Executing op: ComponentUnregister(ComponentId={CBF73D2B-1BF9-4A0F-9698-1E2AC2E55EE4},ProductKey={2831282D-8519-4910-B339-2302840ABEF3},BinaryType=1,) MSI (s) (58:88) [10:47:00:721]: Executing op: ComponentUnregister(ComponentId={B8E69B43-832F-41ED-9929-C421434FFF28},ProductKey={2831282D-8519-4910-B339-2302840ABEF3},BinaryType=1,) MSI (s) (58:88) [10:47:00:721]: Executing op: ComponentUnregister(ComponentId={72C6A988-3DD3-45C1-AC9E-BE9D903BE967},ProductKey={2831282D-8519-4910-B339-2302840ABEF3},BinaryType=1,) MSI (s) (58:88) [10:47:00:721]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0) MSI (s) (58:88) [10:47:00:721]: Error in rollback skipped. Return: 5 MSI (s) (58:88) [10:47:00:721]: Note: 1: 2318 2: MSI (s) (58:88) [10:47:00:721]: No System Restore sequence number for this installation. MSI (s) (58:88) [10:47:00:721]: Unlocking Server MSI (s) (58:88) [10:47:00:721]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'. Action ended 10:47:00: INSTALL. Return value 3. Property(S): UpgradeCode = {8682C52C-8CC7-4923-9F32-920AF207A2C6} Property(S): dirDataFolder = C:\ProgramData\Sophos\Endpoint Firewall\ Property(S): dirLogsFolder = C:\ProgramData\Sophos\Endpoint Firewall\Logs\ Property(S): INSTALLDIR = C:\Program Files\Sophos\Endpoint Firewall\ Property(S): TARGETDIR = C:\ Property(S): ARPINSTALLLOCATION = C:\Program Files\Sophos\Endpoint Firewall\ Property(S): EnableAndLoadMcsAdapterRollback = C:\Program Files\Sophos\Endpoint Firewall\EfwAdapter.dll Property(S): EnableAndLoadMcsAdapter = C:\Program Files\Sophos\Endpoint Firewall\EfwAdapter.dll Property(S): dirSophosData = C:\ProgramData\Sophos\ Property(S): CommonAppDataFolder = C:\ProgramData\ Property(S): dirSophosProgram = C:\Program Files\Sophos\ Property(S): ProgramFiles64Folder = C:\Program Files\ Property(S): SourceDir = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\ Property(S): VersionNT = 601 Property(S): VersionNT64 = 601 Property(S): ALLUSERS = 1 Property(S): ARPPRODUCTICON = icoInstaller Property(S): ARPCOMMENTS = Sophos Endpoint Firewall Property(S): ARPCONTACT = Sophos Technical Support Property(S): ARPHELPLINK = http://www.sophos.com/support/ Property(S): ARPNOMODIFY = 1 Property(S): ARPNOREPAIR = 1 Property(S): ARPURLINFOABOUT = http://www.sophos.com/ Property(S): MSIRESTARTMANAGERCONTROL = Disable Property(S): BuildReference = 206493 Property(S): ProductFullVersion = 1.0.0.564 Property(S): Manufacturer = Sophos Limited Property(S): ProductCode = {2831282D-8519-4910-B339-2302840ABEF3} Property(S): ProductLanguage = 1033 Property(S): ProductName = Sophos Endpoint Firewall Property(S): ProductVersion = 1.0.0.564 Property(S): SecureCustomProperties = WIX_ACCOUNT_ADMINISTRATORS;WIX_ACCOUNT_LOCALSYSTEM;WIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTED Property(S): MsiLogFileLocation = C:\Users\tpc\AppData\Local\Temp\Sophos Endpoint Firewall 1.0.0.564 install log 20180126 104700.txt Property(S): PackageCode = {4B3C66C0-2036-482C-8B6E-20BD8A081136} Property(S): ProductState = -1 Property(S): PackagecodeChanging = 1 Property(S): REBOOT = ReallySuppress Property(S): ARPSYSTEMCOMPONENT = 1 Property(S): CURRENTDIRECTORY = C:\Program Files (x86)\Sophos\CloudInstaller Property(S): CLIENTUILEVEL = 3 Property(S): MSICLIENTUSESEXTERNALUI = 1 Property(S): CLIENTPROCESSID = 4612 Property(S): VersionDatabase = 405 Property(S): VersionMsi = 5.00 Property(S): WindowsBuild = 7601 Property(S): ServicePackLevel = 1 Property(S): ServicePackLevelMinor = 0 Property(S): MsiNTProductType = 1 Property(S): WindowsFolder = C:\Windows\ Property(S): WindowsVolume = C:\ Property(S): System64Folder = C:\Windows\system32\ Property(S): SystemFolder = C:\Windows\SysWOW64\ Property(S): RemoteAdminTS = 1 Property(S): TempFolder = C:\Users\tpc\AppData\Local\Temp\ Property(S): ProgramFilesFolder = C:\Program Files (x86)\ Property(S): CommonFilesFolder = C:\Program Files (x86)\Common Files\ Property(S): CommonFiles64Folder = C:\Program Files\Common Files\ Property(S): AppDataFolder = C:\Users\tpc\AppData\Roaming\ Property(S): FavoritesFolder = C:\Users\tpc\Favorites\ Property(S): NetHoodFolder = C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Network Shortcuts\ Property(S): PersonalFolder = C:\Users\tpc\Documents\ Property(S): PrintHoodFolder = C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\ Property(S): RecentFolder = C:\Users\tpc\AppData\Roaming\Microsoft\Windows\Recent\ Property(S): SendToFolder = C:\Users\tpc\AppData\Roaming\Microsoft\Windows\SendTo\ Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\ Property(S): LocalAppDataFolder = C:\Users\tpc\AppData\Local\ Property(S): MyPicturesFolder = C:\Users\tpc\Pictures\ Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\ Property(S): DesktopFolder = C:\Users\Public\Desktop\ Property(S): FontsFolder = C:\Windows\Fonts\ Property(S): GPTSupport = 1 Property(S): OLEAdvtSupport = 1 Property(S): ShellAdvtSupport = 1 Property(S): MsiAMD64 = 6 Property(S): Msix64 = 6 Property(S): Intel = 6 Property(S): PhysicalMemory = 8136 Property(S): VirtualMemory = 14186 Property(S): AdminUser = 1 Property(S): MsiTrueAdminUser = 1 Property(S): LogonUser = tpc Property(S): UserSID = S-1-5-21-3941082974-3120526808-1881659357-3766 Property(S): UserLanguageID = 1033 Property(S): ComputerName = TCH-PC Property(S): SystemLanguageID = 1033 Property(S): ScreenX = 1024 Property(S): ScreenY = 768 Property(S): CaptionHeight = 22 Property(S): BorderTop = 1 Property(S): BorderSide = 1 Property(S): TextHeight = 16 Property(S): TextInternalLeading = 3 Property(S): ColorBits = 32 Property(S): TTCSupport = 1 Property(S): Time = 10:47:00 Property(S): Date = 1/26/2018 Property(S): MsiNetAssemblySupport = 4.7.2558.0 Property(S): MsiWin32AssemblySupport = 6.1.7601.17514 Property(S): RedirectedDllSupport = 2 Property(S): MsiRunningElevated = 1 Property(S): Privileged = 1 Property(S): USERNAME = TCH Property(S): COMPANYNAME = Microsoft Property(S): DATABASE = C:\Windows\Installer\92305.msi Property(S): OriginalDatabase = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi Property(S): UILevel = 2 Property(S): ACTION = INSTALL Property(S): WIX_ACCOUNT_LOCALSYSTEM = NT AUTHORITY\SYSTEM Property(S): WIX_ACCOUNT_LOCALSERVICE = NT AUTHORITY\LOCAL SERVICE Property(S): WIX_ACCOUNT_NETWORKSERVICE = NT AUTHORITY\NETWORK SERVICE Property(S): WIX_ACCOUNT_ADMINISTRATORS = BUILTIN\Administrators Property(S): WIX_ACCOUNT_USERS = BUILTIN\Users Property(S): WIX_ACCOUNT_GUESTS = BUILTIN\Guests Property(S): ROOTDRIVE = C:\ Property(S): CostingComplete = 1 Property(S): OutOfDiskSpace = 0 Property(S): OutOfNoRbDiskSpace = 0 Property(S): PrimaryVolumeSpaceAvailable = 0 Property(S): PrimaryVolumeSpaceRequired = 0 Property(S): PrimaryVolumeSpaceRemaining = 0 Property(S): INSTALLLEVEL = 1 Property(S): SOURCEDIR = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\ Property(S): SourcedirProduct = {2831282D-8519-4910-B339-2302840ABEF3} Property(S): ProductToBeRegistered = 1 MSI (s) (58:88) [10:47:00:737]: Note: 1: 1708 MSI (s) (58:88) [10:47:00:737]: Product: Sophos Endpoint Firewall -- Installation failed. MSI (s) (58:88) [10:47:00:737]: Windows Installer installed the product. Product Name: Sophos Endpoint Firewall. Product Version: 1.0.0.564. Product Language: 1033. Manufacturer: Sophos Limited. Installation success or error status: 1603. MSI (s) (58:88) [10:47:00:737]: Deferring clean up of packages/files, if any exist MSI (s) (58:88) [10:47:00:737]: MainEngineThread is returning 1603 MSI (s) (58:DC) [10:47:00:737]: No System Restore sequence number for this installation. === Logging stopped: 1/26/2018 10:47:00 === MSI (s) (58:DC) [10:47:00:737]: User policy value 'DisableRollback' is 0 MSI (s) (58:DC) [10:47:00:737]: Machine policy value 'DisableRollback' is 0 MSI (s) (58:DC) [10:47:00:737]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (58:DC) [10:47:00:737]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (58:DC) [10:47:00:737]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (58:DC) [10:47:00:737]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (s) (58:DC) [10:47:00:737]: Restoring environment variables MSI (s) (58:DC) [10:47:00:737]: Destroying RemoteAPI object. MSI (s) (58:B0) [10:47:00:737]: Custom Action Manager thread ending. MSI (c) (04:84) [10:47:00:737]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (c) (04:84) [10:47:00:753]: MainEngineThread is returning 1603 === Verbose logging stopped: 1/26/2018 10:47:00 ===