Computer is net yet managed. [0xfffffffd]

HI,

Does the last router log end there or is there more?  I've seen that error before in logs and it's not a problem.

Maybe:

/search?q= 13771
Will help here. 

Jak

Hello mbjoe,

what else is in the log? I don't know about the meaning of this message about ImR_Client_Adapter as it is "normal" (i.e. you'll usually find it in the log). 

Normally 0xfffffffd is reported after you have tried to Protect computers, the task has been created and started but no message from the client was received after some time. So I guess the client's RMS somehow failed to report back. I'd check the Sophos Network Communications Report as well as the ClientMRInit logs. And just to make sure the communication is not block you could try to telnet from the client to the server's ports 8192 and 8194.

Christian

I'm seeing this in Windows Event Viewer but did not see the " View Sophos Network Communications Report" in the Sophos GUI.

Warning

Failed to communicate with parent router "Sophos Server IP".

For more information, see the RMS status report. To open the report, click Start, point to All Programs, point to Sophos, point to Sophos Endpoint Security and Control, and then click View Sophos Network Communications Report.

======

Error

DNS lookup failure trying to resolve the following addresses: fe80::cc8f:358f:adb9:db27.

For more information, see the RMS status report. To open the report, click Start, point to All Programs, point to Sophos, point to Sophos Endpoint Security and Control, and then click View Sophos Network Communications Report.

That's an IPv6 address. The Network Communications Report is available from the Sophos->SESC program group. What does it contain for the Parent addresses and Current parent address?

Christian

When I check the Network Report I see this for current parent address:

Current parent address: Not Available

The Parent Addresses is set correctly (compared to another system), it is only the "Current Parent Address" that is incorrect as it says Not Available.

Is there a way to manually input this or a way to refresh it?

RMS is trying to determine the current address (using the list as a start) and fails - you can't "force" it to use a certain address. Does the list contain addresses (IPv4, IPv6) and names (NetBIOS, FQDN) or only a subset? Which OS is on the client, Win7? As I said, it seems to have problems with the IPv6 address.

I also want to repeat Jak's question - is the router log you posted all you get? I'd expect some more lines.

Christian 

This is what I see in Parent Address, it is the same for all workstations I've checked (even the one having the problem)

Parent Address: Parent IPV4, Parent IPV6, Parent Name.Domain.com,Parent Name

The Router log is fairly long so yes there is more in there, is there anything specific I should be looking for?

05.07.2011 15:17:27 0A28 W Delivery failed(Timeout) for message type Certification.CertRequest, originator Router$WorkstationName:306038.Agent
05.07.2011 15:17:54 0A20 I Getting parent router IOR from Sophos Consol Server:8192
05.07.2011 15:17:54 0A20 I Received parent router's IOR:
IOR:010000002600000049444c3a536f70686f734d6573736167696e672f4d657373616765526f757465723a312e300000000200000000000000a0000000010102000d00000031302e38332e3131342e3139000001204100000014010f004e5550000000210000000001000000526f6f74504f4100526f7574657250657273697374656e740003000000010000004d657373616765526f757465720000000300000000000000080000000100a600004f415401000000140000000100a6000100010000000000090101000000000014000000080000000100a6008600022000000000a0000000010102000d0000003139322e3136382e35362e31000001204100000014010f004e5550000000210000000001000000526f6f74504f4100526f7574657250657273697374656e740003000000010000004d657373616765526f757465720000000300000000000000080000000100a600004f415401000000140000000100a6000100010000000000090101000000000014000000080000000100a60086000220
05.07.2011 15:17:54 0A20 I Successfully validated parent router's IOR
05.07.2011 15:17:54 0A20 I Accessing parent
05.07.2011 15:17:54 0A20 E ParentLogon::RegisterParent: Caught CORBA system exception, ID 'IDL:omg.org/CORBA/NO_PERMISSION:1.0'
Unknown vendor minor code id (0), minor code = 0, completed = NO

Other then the message I originally posted from the logs, I'm also seeing this:

HI,

Based on that IOR string, the parent router has the IP addresses: 10.83.114.19  and 192.168.56.1 .  So the client is connecting to the address of the parent as specified in the ParentAdrress field on the client in the registry, on port 8192.

It is then being told to connect to: 10.83.114.19 on port 8194 and if that fails, it should move on to trying 192.168.56.1 on 8194.  I believe it tries them in the order they appear, you could always do a netstat or use something like TCPView to confirm where the RouterNT.exe process is going first.

Does the parent router need to listen on both interfaces, is it managing clients in both those networks?

If not, I would suggest binding the router on the parent to just one of those IP addresses, that way the IOR will only contain the one ip address.

To do so: http://www.sophos.com/support/knowledgebase/article/12507.html  will help.

As a test, when you telnet to the server on port 8192 the IOR string returned will be shorter as it will only have 1 ip address encoded within it rather than the current 2.

Regards,

Jak