This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Installation failed windows 2008. Error -2147213568

Hi,

We are deploying ServerProtection on all our servers and there is a windows 2008 that gives me problems.

It downloads correctly but when it starts installing it gives errors when installing the different modules and services. The first one to give error is Sophos Management Communications System forand the error is

"2020-03-28T20:40:59.9029958Z INFO : Installing Component: Sophos Management Communications System for Windows CPP
2020-03-28T20:40:59.9342458Z INFO : Trying IProductSetup2 interface.
2020-03-28T20:41:13.1373708Z INFO : Installed Sophos Management Communications System for Windows CPP: -2147213568 (reboot code: 0)
2020-03-28T20:43:22.4811208Z INFO : Installed Sophos Management Communications System for Windows CPP: -2147213568 (reboot code: 0)
2020-03-28T20:47:29.4645972Z INFO : Installed Sophos Management Communications System for Windows CPP: -2147213568 (reboot code: 0)
2020-03-28T20:47:29.4645972Z ERROR : Installation failed"

And in the log of MCS:

"2020-03-28T19:39:33.968Z [ 3584] ERROR 2008: [CORC] Failed to set core trigger status key OpenKeyFunction failed. Error: 2. Value name='SOFTWARE\Sophos\EndpointDefense\Monitoring\TriggerCoreStatus'.
2020-03-28T19:39:35.077Z [ 2168] ERROR 2013: Caught unknown exception unloading SDU"

Although this happens with almost all modules.

I attach installation log and mcs log and some pics

I don't know what else to do.

Greetings and thank you.

2818.SophosCloudInstaller_20200328_203814.log 5008.McsAgent.log

This thread was automatically locked due to age.

Parents

0 Shweta over 5 years ago

Hi David Mateos

It seems that it is unable to fetch the package details, have you tried to completely uninstall once? After reboot, try to download the fresh installer and install again.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 David Mateos over 5 years ago in reply to Shweta

Shweta said:

Hi David Mateos

It seems that it is unable to fetch the package details, have you tried to completely uninstall once? After reboot, try to download the fresh installer and install again.

I've uninstalled it several times via Programs and Features but I didn't know this other method via CLI. Is it also necessary to use it to uninstall?

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 5 years ago in reply to David Mateos

Hi David Mateos

It will help to remove the remnants if any, you can try it once.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 David Mateos over 5 years ago in reply to Shweta

Ok, i will try and update the post.

Thank you for your attention.
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 5 years ago in reply to David Mateos

Hi David Mateos

Sure, no worries. Let us know how it goes.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 David Mateos over 5 years ago in reply to Shweta
Hi,

The commands to get the uninstall script give me no results

32-bit: REG QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall /s /f SOPHOS > C:\Sophos_Uninstall_Strings.txt

Fin de la búsqueda: 0 coincidencias encontradas.

64-bit: REG QUERY HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s /f SOPHOS > C:\Sophos_Uninstall_Strings.txt

Fin de la búsqueda: 0 coincidencias encontradas.

so i assume that sophos is correct uninstalled with the "progams and features". I'm trying fresh installing on more time and update the issue.
Cancel
Vote Up 0 Vote Down

Cancel
0 David Mateos over 5 years ago in reply to David Mateos

The same thing :(
Cancel
Vote Up 0 Vote Down

Cancel
0 DianneY over 5 years ago in reply to David Mateos

Hi David Mateos

Do you have any GPO's in place assigned for Sophos services? I ask because of this.

Also, check any recent Sophos installation logs in C:\Windows\Temp or %Localappdata%\Temp to see if there was any other errors.
Cancel
Vote Up 0 Vote Down

Cancel
0 David Mateos over 5 years ago in reply to DianneY

Hi David Mateos

Do you have any GPO's in place assigned for Sophos services? I ask because of this.

Also, check any recent Sophos installation logs in C:\Windows\Temp or %Localappdata%\Temp to see if there was any other errors.

Hi,

I've checked and it doesn't look like I have any gpo for sophos.

Logs in c:\windows\temp

Sophos Web Intelligence Install.log:

swi_update_64.exe 2020-03-30 21:40:25 Uninstall skipped since 32bit LSP is not present. LSP="C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll"
swi_update_64.exe 2020-03-30 21:40:25 Uninstall skipped since 64bit LSP is not present. LSP="C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll"

and sophos Management Communications System Install.log (attached)0333.Sophos Web Intelligence Install.log 5773.Sophos Management Communications System Install Log 20200326 213801.txt
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 5 years ago in reply to David Mateos
Hi David Mateos

Could you please follow the below steps, to disable tamper protection and then manually install the components. Please backup the registry before making any changes.

Boot the system into Safe Mode.

Click Start > Run > services.msc > right-click Sophos Anti-Virus service > properties > set to disabled > OK

Click Start > Run and type regedit and then click OK.

Go to the following location in the registry editor:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent and set the REG_DWORD Start to 0x00000004

Go to the following location in the registry editor:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config and set the following REG_DWORD values SAVEnabled and SEDEnabled to 0

Go to the following location in the registry editor:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection and set the REG_DWORD Enabled to 0

Reboot the system in normal mode.

If you have the file C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\sau\Sophos AutoUpdate.msi or C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sau\Sophos AutoUpdate.msi avaiable execute it to install autoupdate component.

If you have the file C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\ui64\Sophos UI.msi orC:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ui64\Sophos UI.msi available, execute it to install UI component.

After getting the 2 components installed, open the UI from the system tray and force an update.

If the UI is not visible, do another reboot and open the UI from the system tray and force an update.

If none of the files is available re-run the installer. Let me know how it goes.
Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Shweta over 5 years ago in reply to David Mateos
Hi David Mateos

Could you please follow the below steps, to disable tamper protection and then manually install the components. Please backup the registry before making any changes.

Boot the system into Safe Mode.

Click Start > Run > services.msc > right-click Sophos Anti-Virus service > properties > set to disabled > OK

Click Start > Run and type regedit and then click OK.

Go to the following location in the registry editor:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent and set the REG_DWORD Start to 0x00000004

Go to the following location in the registry editor:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config and set the following REG_DWORD values SAVEnabled and SEDEnabled to 0

Go to the following location in the registry editor:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection and set the REG_DWORD Enabled to 0

Reboot the system in normal mode.

If you have the file C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\sau\Sophos AutoUpdate.msi or C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sau\Sophos AutoUpdate.msi avaiable execute it to install autoupdate component.

If you have the file C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\ui64\Sophos UI.msi orC:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ui64\Sophos UI.msi available, execute it to install UI component.

After getting the 2 components installed, open the UI from the system tray and force an update.

If the UI is not visible, do another reboot and open the UI from the system tray and force an update.

If none of the files is available re-run the installer. Let me know how it goes.
Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 David Mateos over 5 years ago in reply to Shweta

Still the same. More pics attached.

Does the Sophos Diagnostic Utility help?

Thank you
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 5 years ago in reply to David Mateos

Hi David Mateos

Yes please, this might require some in-depth investigation, Kindly PM me the SDU logs once you have collected.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 David Mateos over 5 years ago in reply to Shweta

Still the same.

Ok, i give up

I've been talking with my fellow I.T.'s and we decided to reinstall this machine and upgrade OS version after which we hope the installation will work.

Thank you so much for yout attention.
Cancel
Vote Up 0 Vote Down

Cancel
0 Shweta over 5 years ago in reply to David Mateos

Hi David Mateos

Thank you for the update, in case any further troubleshooting is required then feel free to reach out to us.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel