Why is it requiring FIPS compliance?

Question

We had Sophos Management Console successfully installed and working, but then for various reasons another admin did a bunch of reworking of our GPOs on this network.

Now I'm trying to start the Sophos Management Service and I'm getting the generic "Error 0x80131604", which is showing up in the Application log as the "not part of the Windows Platform FIPS validated cryptographic algorithms" error. Problem is, "Use FIPS compliant algorithms" is disabled in the GPO, and I have confirmed that the registry has value of 0 for FipsAlgorithmPolicy\Enabled as well.

Any other reasons why it might be doing this? We haven't changed anything in the SMC install, it was just a sequence of GPO changes that were made, but as far as I know FIPS compliance was never turned on. At any rate, it's not turned on now, but the management service is still not starting.

This thread was automatically locked due to age.

jak · Accepted Answer

HI,

One other thing you could try is setting it as per:

https://msdn.microsoft.com/en-us/library/hh202806%28v=vs.110%29.aspx

<configuration>
    <runtime>
        <enforceFIPSPolicy enabled="false"/>
    </runtime>
</configuration>

If you open up the mgntsvc.exe.config file in the SEC directory. I imagine you can configure the above also.

Hope it helps.

Regards,

Jak