Sophos Endpoint Defense konnte nicht installiert werden: Error code 80004005

Hi Andreas,

The thread which you were referring was for a different issue. Please PM us the case number which you have opened.

Good morning Jasmin.

I opened the ticket this morning..

#9742179

Best Regards

Andreas

Hi Andreas, 

Thank you for providing the case number. Could you also check under the %temp% location for installation logs and check for specific error? We will keep an eye on the case created and shall let you know if there is any further information required. 

Hi, I found this in a uninstall log:

Started C:\Program Files\Sophos\Endpoint Defense\uninstall.exe
26.02.2020 13:56:27, INFO : Starting Sophos Endpoint Defense uninstallation (2.1.2.0)
26.02.2020 13:56:27, INFO : Operating system version is Win10 or greater and supports InstallELAMCertificate ...
26.02.2020 13:56:27, INFO : Disabled SEL driver and services protection.
26.02.2020 13:56:27, INFO : Disabled driver and services protection.
26.02.2020 13:56:27, INFO : Removed Sophos process keys under 'AppCompatFlags\Custom'
26.02.2020 13:56:27, INFO : Removed Sophos process keys under 'Image File Execution Options'
26.02.2020 13:56:27, INFO : Removed Sophos process keys under 'AppCompatFlags\Custom - WOW6432'
26.02.2020 13:56:27, INFO : Removed Sophos process keys under 'Image File Execution Options - WOW6432'
26.02.2020 13:56:27, INFO : Stopping Sophos System Protection Service ...
26.02.2020 13:56:27, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:28, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:29, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:30, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:31, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:32, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:33, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:34, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:35, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:36, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:37, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:38, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:39, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:40, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:41, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:42, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:43, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:44, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:45, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:46, WARNING : Could not open service - Sophos System Protection Service, error 1060.
26.02.2020 13:56:47, WARNING : Skipping stop service - Sophos System Protection Service is not installed.
26.02.2020 13:56:47, INFO : Stopping Sophos Endpoint Defense Service ...
26.02.2020 13:56:47, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:48, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:49, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:50, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:51, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:52, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:53, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:54, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:55, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:56, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:57, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:58, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:56:59, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:57:00, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:57:01, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:57:02, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:57:03, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:57:04, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:57:05, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:57:06, WARNING : Could not open service - Sophos Endpoint Defense Service, error 1060.
26.02.2020 13:57:07, WARNING : Skipping stop service - Sophos Endpoint Defense Service is not installed.
26.02.2020 13:57:07, WARNING : Sophos System Protection Service has already been removed from the Service Control Manager.
26.02.2020 13:57:07, WARNING : Sophos Endpoint Defense Service has already been removed from the Service Control Manager.
26.02.2020 13:57:07, INFO : Deleting C:\WINDOWS\system32\drivers\SophosEL.sys
26.02.2020 13:57:07, ERROR : Filesystem error code: 1
26.02.2020 13:57:07, ERROR : Failed to uninstall: Failed to remove SophosEL.sys from System32 drivers

Hi Andreas,

Thank you for providing the logs, as per the error seen in Sophos Endpoint defense log, would you please try the steps listed in this article on one of the machine and check. 

Good morning. These Steps doesn't helped my and I also couldn'd find the About what's described there.

We have germany systems and we use Sophos Endpoint Security and Control. I tried right click to the Sophos symbol and choosed Update now.

I addaed a zip file with logs. Maybe this help more.

8473.20200303_Sophos.zip

Andreas

Hi Andreas,

Would you please collect the SDU logs using this article and also try to reinstall Sophos on one device and let us know the outcome of that as well. 

Here the link to the SDU Logs: 

https://sdu-feedback.sophos.com/prod/4773f470-30f6-5ceb-8514-f80d0c676801_2020-03-03-09-51-12.zip

I have tried to uninstall Sophos. I was able to uninstall alls parts excepted the Sophos Endpoint Defense. If I click on uninstall nothing happens. It's not possible to remove this part.

Sophos Auto Update had a problem while uninstalling but I could ignore it to proceed the uninstall.

We don't use the Endpoint Defense. We use only the Antivirus. But it seems that this part which we don't use make these problems.

Andreas 

If I delete everything manuelly and install it new then everything seems to work. But this can't be a solution to uninstall/remove Sophos at 550 Notebooks. After the upgrade to a new version of windows.

Hi Andreas,

The Sophos Endpoint Defense version 2.1.2 which you have installed on your machine currently had issues with update of Windows 10 Operating system. 

This particular issue has been resolved in the next version release of 2.1.4 endpoint core agent but that was for Sophos central endpoint. Would you please confirm the version of Sophos Endpoint Defense in the system where you installed the fresh version. 

Also, please suggest the enterprise console version which you have in your environment.

Hi Andreas,

The Sophos Endpoint Defense version 2.1.2 which you have installed on your machine currently had issues with update of Windows 10 Operating system. 

This particular issue has been resolved in the next version release of 2.1.4 endpoint core agent but that was for Sophos central endpoint. Would you please confirm the version of Sophos Endpoint Defense in the system where you installed the fresh version. 

Also, please suggest the enterprise console version which you have in your environment.

Hi we have the version 2.1.2.8000 at our systems installed. It's the same before and after.

We use the Recommended update path on our Sophos.

Andreas

Hi Andreas, 

It seems to be for enterprise console latest version of Sophos Endpoint Defense is 2.2.0.11405 which is currently only available in the preview version.  

Hi Jasmin,

thank you.

Could you tell me when the version 2.2.0 will be in the recommended Update path?

Or is there a possibility to disable the installation of Endoint Defense because we don't use this part.

Andreas

Hi Andreas, 

We will be updating our community forums once the version is available under the recommended subscription. Sophos Endpoint Defense is used for preventing the undesired action by the administrator and is part of Sophos Anti-Virus. 

The Sophos Endpoint Defense must be turned off only in the following situations:

• Before Sophos Anti-Virus is downgraded to an older version.
• If the operating system needs to be upgraded.
• A managed computer needs to be re-protected from the Sophos Enterprise Console. If SED is turned on, it will result in the error 0x00000082: The installation could not be started.
• On a Windows machine if a restore point needs to be used via a System Restore point.
  
  Any scripts being used to start or stop Sophos services will not work if Sophos Endpoint Defense is turned on, as well as modifying permissions on Sophos registry keys, Sophos files and folders or Sophos services.

Please check this article for more information. 

I tried to use the preview update on one of the clients which we already have updated to the new windows. But the same failure appears.

Hi Andreas, 

On the client on which you have updated the endpoint, could you please check the version of the Sophos Endpoint? 

 Hi Shweta,

The client with Preview Update Group:

Sophos Anti-Virus: 10.8.4.97

Sophos AutoUpdate: 5.14.36

Sophos Endpoint Defense: 2.1.1.8063

Sophos Network Threat Protection: 1.8.77.0

Sophos Remote Management System: 4.1.2

My client with recommendet Update Group:

Sophos Anti-Virus: 10.8.4.227

Sophos AutoUpdate: 5.15.166

Sophos Endpoint Defense: 2.1.2.8000

Sophos Network Threat Protection: 1.8.77.0

Sophos Remote Management System: 4.1.2

Hi Andreas,

I'd suggest you create a new preview subscription and check whether it is receiving the new version described here for Sophos AV.

Hi Jasmin,

that was my mistake. I changed the settings for the preview update and not the update works.

Sophos Anti-Virus: 10.8.6.215

Sophos AutoUpdate: 5.16.37

Sophos Endpoint Defense: 2.2.0.11405

Sophos Network Threat Protection: 1.9.2235.0

Sophos Remote Management System 4.1.2

The failure is still the same. Also with these new version.

Hopefully you will find another solution. To fix that problem.

Hi Andreas,

The assigned support engineer tried to contact you but unfortunately was unable to contact you. He has provided you with a few steps to perform.

Would you please follow it on one of the machines and reply back with the result?