Problems updating clients

Question

I am having trouble with the SophosAutoUpdate on my Windows XP Clients.

First of all a bit of background :
I had installed Sophos Endpoint Security and Control 9.5 with the Enterprise Console running on a Windows 2003 Server which is also the Domain Controller. I had a number of XP clients which were “protected” and EnterpriseConsole 4.5 was running on them. Sophos AutoUpdate worked on all clients with the AutoUpdate connecting to the “SophosUpdate” share. So everything was fine.

At this point I had to install a new password hashing algorithm on all machines on the Network.

I started off by putting the new password hashing algorithm on the Windows 2003 Server which led to problems with the AutoUpdate. Thanks to help from this forum I resolved those problems. I had to reset the password of the “SophosSAU<server’’’’s hostname>0” account and tweak two registry settings at ‘‘‘‘HKLM\Software\Sophos\AutoUpdate\Service’’’’. (Download Password and Obfuscated Password)
Once I had done that everything was fine on the Server and AutoUpdates were occurring as they should do.

At this point all of my clients were still using the old password hashing and they were all OK as well.

Now I put the new algorithm on one of my XP clients and had the same problem as before. This time I reset the password of the “SophosSAU<client’’’’s hostname>0” account and tweaked the two registry settings at ‘‘‘‘HKLM\Software\Sophos\AutoUpdate\Service’’’’.
The original error went away but, unlike on the Server, the AutoUpdate is continuing to fail.

If I click on the blue Sophos shield in the System Tray and do an “Update Now” I get a message saying “Could not contact server”.

The error in the “C:\ProgramFiles\Sophos\AutoUpdate\logs\alc.log” file is :
Could not add a connection to server \\<server’’’’s hostname>\SophosUpdate; user <Domain>\SophosUpdateMgr; Windows error 1312

My guess is that maybe I need to do something with the ‘‘‘‘SophosUpdateMgr’’’’ account ?

Any advice gratefully received.

Peter

p.s. the clients that have not yet been upgraded with the new password hashing algorithm continue to work fine.

This thread was automatically locked due to age.

PeterT · Accepted Answer

Thanks Christian, that idea of using a new User worked well.

I did the following :

Created a new User called ‘‘‘‘SoUpdt’’’’ in Active Directory and gave it a simple password.
In Sophos Enterprise Console I created a new Group for all of the XP clients that I have upgraded with my new password hashing algorithm.
Created a new Policy for this new Group which uses the “SoUpdt” account instead of the ‘‘‘‘SophosUpdateMgr’’’’.
Re-protected the XP clients that have the new password hashing algorithm.

That all seemed to do the trick and now the Sophos Enterprise Console dashboard has no errors.

I now have some XP clients using the original password hashing. These are still using the Default Policy and ‘‘‘‘SophosUpdateMgr’’’’ account for updates.

As and when I upgrade any of my XP clients to this new password hashing algorithm I just move the machine in question into the new group which uses the new policy and the ‘‘‘‘SoUpdt’’’’ account.

Peter

p.s. I've told the Sophos Support people about these issues.