Failed to install hmpa64: a reboot is required before the installation can succeed.

In the scenario where there is an update to HMPA, but the computer has yet to be restarted you get in the log:

"C:\Windows\Temp\Sophos HitmanPro Alert install log 20171122T230432.txt"

a 2017-11-22 23:04:32.256 [11076:8656] - Beginning install
a 2017-11-22 23:04:32.256 [11076:8656] - Executing step: Validate it is NextGen endpoint
a 2017-11-22 23:04:32.256 [11076:8656] - Executing step: Validate the user is an admin
a 2017-11-22 23:04:32.256 [11076:8656] - Executing step: Validate that HMPA is not pending reboot
w 2017-11-22 23:04:32.256 [11076:8656] - Validation failed
a 2017-11-22 23:04:32.256 [11076:8656] - Reboot required by execute step: Validate that HMPA is not pending reboot
w 2017-11-22 23:04:32.256 [11076:8656] - Failed step: Validate that HMPA is not pending reboot, rolling back previous steps
a 2017-11-22 23:04:32.256 [11076:8656] - Rolling back step: Validate the user is an admin
a 2017-11-22 23:04:32.256 [11076:8656] - Rolling back step: Validate it is NextGen endpoint
w 2017-11-22 23:04:32.256 [11076:8656] - Failed composite step
e 2017-11-22 23:04:32.256 [11076:8656] - A reboot is required before the installation can proceed

You get a popup saying the computer needs to be restarted.

HMPA upgrades work by setting up pending rename operations to delete the existing files and copy the new ones into place on restart.  

Regards,

Jak

Since last weeks update we are having massive numbers of these.
As many as 50% of the stations at some clients.
No one has reported seeing a pop up, including instances where it has occurred on the station our client contact uses.
As administrator it sure seems we are responsible for monitoring these, whether we want to or not.

As offsite IT we need to - download an events report, sort it to find the reboots not resolved, notify our client contact.
Client contact has people reboot, an update runs, we get update succeeded, then in the next day or so another update throws the same request for a reboot.

I get that it was a major update, but our clients are getting annoyed, my boss is getting annoyed. They have never needed this level of maintenance and want to know when it will stop.
Since there is no report we can run for reboots needed, it requires running the events report, filtering it, waiting for the endless process time, hoping it will return events.
Downloading and sorting the report to see who still needs to reboot, or needs to reboot again. 

We are reluctant to just wait a week or so for things to settle out. What if a user gets malware because they weren't updated properly?

There seems to be ZERO support for this product.

I too have been banging my head against the wall as to why of god's green earth do we have to reboot client computers for every single update. Its frustrating and infuriating.

I have NEVER seen this with anyone else product. Absolutely abysmal product.

Not only do I get these continual reboot notification required, but after I reboot, then another error.

Failed to install savxp: 1.

Seriously flawed product. This takes more administration time than all my servers and AD Forest combined. Something happens DAILY with this product.

Daily.....repeat...daily. Meaning ever single day I have to admin something in this Console.

Arrrrgggggh!!

Having the same issues - its wanted 4 different reboots over the past couple weeks. 

Now I am getting services failed all over the place. I thought they have fixed all this, but its chaos again.

I am seeing the exact same errors that Jak posted. I can restart the computer but there is no change. I am seeing this on around 70 computers. Also, the policy has warnings that the policy compliance differs from policy. I can run Comply with All Group Policies but then the error returns 10-20 minutes later.

How often is the console supposed to report machine status?

I am asking clients to reboot machines and when I check the console the next day the event data is sometimes over 24 hours old.
I can't tell if they rebooted or not. The device page says that the machines are online and in contact with Sophos.
If I run an event report I may only get data for 10 out of 22 machines in any 24 hour period.

So- I can't tell if they have rebooted, and the error has returned, or if they just haven't rebooted.
In some cases I have web event data so I confirmation the machine is in contact with Sophos, I just have no update data.

This particular "fail to install" is also not consistent across my clients. Some clients have a high percentage of machines with it, other clients with a few, and some with none.
 

I am getting this too, not on so many machines but a few

Does anyone know if there is any further updates from Sophos on this?

I have an endless reboot as well. 

Executing step: SetRegistryValue(HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro.Alert, 64, SystemComponent, 1)
Failed to open Registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro.Alert, error 2
A reboot is required before the installation can proceed

I don't really understand why reboots are still a monthly thing. Most endpoint products don't need constant reboots these days. 

Also why does the server product rarely need reboots even though its the same tech?

Hello Ted Bundy,

Is this a new installation you are referring to,  or has the issue started all of a sudden?

If the issue occurs while installing Sophos:
Is that key present in your system? Was there a previous installation of Sophos?

If yes to either, please perform a full backup of the registry and manually remove the HitmanPro entry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro.Alert. I would also recommend to look for any other hitmanpro keys under the uninstall location as well, and remove them.
After that, re-try installing Sophos. 

If the problems persist (or the above steps do not apply, and rebooting does not help), you may need to file a case with support and provide SDU logs to see what may be blocking hitmanpro from installing.
I can also take a look at your SDU logs if you would like to DM those to me first.

Regards,