SafeGuard Disk Encryption - Error 00000052

After deleting the registry pending reboot key and rebooting have you double checked it since then to make sure it didn't get populated with another reboot flag?  Just curious.  I am sure you have - just making sure it isn't overlooked.

Hello FK,

a value which i deleted

[usual warning about fiddling with the registry] IIRC it is the key which has to be deleted, not just the values under it.

HTH

Christin

Hi QC,

sorry i meant the Key. Yes i deleted the key.

Instead of rolling out from EC, i have now run the "SGNClient.msi" directly. This time the installation went well.

There are no errors but the Client does not receive any policies and hence no encrpytion is being done.

Why the heck isn't it getting the Policies :).

BootLog.txt says:

Sophos Encryption Bootstrap started at 20121011T161923

Source path: \\SERVER\SophosUpdate\CIDs\S000\ENCRYPTION\encclient
Target path: C:\ProgramData\Sophos\Sophos SafeGuard Installers\staging

Command Line: \\SERVER\SophosUpdate\CIDs\S000\ENCRYPTION\setup.exe /q

Searching for third-party encryption products...
Starting competitor detection...
Enumerating competitor uninstall keys...
Running competitor detection for 64-bit competitors...
Enumerating competitor uninstall keys...
Third-party detection test complete.

Looking for SAU...
Found a product - {15C418EB-7675-42be-B2B3-281952DA014D} 
DisplayVersion = 2.7.4.317
Setting this as the latest version found.
MsiEnumRelatedProducts returned: 259
No more products found.
Latest version found: 2.7.4.317.
Base version required: 2.6.0.
This version of SAU is acceptable.
Detection of SAU finished.

Looking for RMS...
Found a product - {FED1005D-CBC8-45D5-A288-FFC7BB304121} 
DisplayVersion = 3.4.1
Setting this as the latest version found.
MsiEnumRelatedProducts returned: 259
No more products found.
Latest version found: 3.4.1.
Base version required: 3.4.0.
This version of RMS is acceptable.
Detection of RMS finished.

Number of current user sessions: 1

Verify and Copy One File starting...
First file: .\5_60_0_R9.xml
 - Loading file from target for inspection...
 - Target file not present.
 - Loading file from source...
 - Source checksum matches, writing file to target.
Verify and Copy One File finished.
Verify and Copy files starting...
Next file: .\SGNClient.msi
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0000.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0001.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0002.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0003.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0004.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0005.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0006.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0007.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0008.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0009.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0010.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0011.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0012.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0013.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0014.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0015.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0016.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0017.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0018.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0019.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0020.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0021.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0022.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0023.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0024.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0025.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0026.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0027.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0028.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0029.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0030.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0031.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0032.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0033.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0034.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0035.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0036.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0037.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0038.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0039.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0040.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0041.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0042.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0043.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0044.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0045.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0046.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0047.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0048.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0049.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0050.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0051.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0052.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0053.dat
 - This a file to ignore, continue.
Next file: .\SGNClient.msi.0054.dat
 - This a file to ignore, continue.
Next file: .\SGNClient_x64.msi
 - This is the split file itself, continue.
Next file: .\SGNClient_x64.msi.0000.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0001.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0002.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0003.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0004.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0005.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0006.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0007.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0008.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0009.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0010.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0011.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0012.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0013.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0014.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0015.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0016.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0017.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0018.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0019.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0020.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0021.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0022.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0023.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0024.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0025.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0026.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0027.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0028.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0029.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0030.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0031.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0032.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0033.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0034.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0035.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0036.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0037.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0038.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0039.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0040.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0041.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0042.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0043.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0044.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0045.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0046.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0047.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0048.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0049.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0050.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0051.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0052.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGNClient_x64.msi.0053.dat
 - This is a segment file.
 - Target data unavailable.
 - Loading file from source...
 - Source checksum matches, added to the file.
Next file: .\SGxClientPreinstall.msi
 - This is a regular file.
 - Loading file from target for inspection...
 - Target file not present.
 - Loading file from source...
 - Source checksum matches, writing file to target.
Closing split file...
Verify and Copy files finished.
Verifying files in C:\ProgramData\Sophos\Sophos SafeGuard Installers\staging...
Folder verified successfully.
Files copied and rebuilt successfully, proceeding.
Running the pre-requisite installer...
About to run the prerequisite installer, path = C:\ProgramData\Sophos\Sophos SafeGuard Installers\staging\SGxClientPreinstall.msi parameters = REBOOT=ReallySuppress SOURCELIST="C:\ProgramData\Sophos\Sophos SafeGuard Installers\InstallCache"
InstallPreReqMSI: MsiInstallProductW returned 0
Pre-req MSI returned 0
Pre-req MSI install complete, proceeding.
Running the client installer...
About to run the client installer, path = C:\ProgramData\Sophos\Sophos SafeGuard Installers\staging\SGNClient_x64.msi parameters = REBOOT=ReallySuppress POACFG="C:\ProgramData\Sophos\Sophos SafeGuard Installers\staging\.\5_60_0_R9.xml" DEPLOY_FROM_SEC=1 SOURCELIST="C:\ProgramData\Sophos\Sophos SafeGuard Installers\InstallCache"
InstallClientMSI: MsiInstallProductW returned 0 UI Handler returned 0
InstallClientMSI returned 0
Sophos Safeguard 5.50.0 Client Configuration is not installed.
Swapping staging and final folders...
Swap successful.
Proceeding to the reboot dialog step...
Presenting reboot dialog.
The dialog returned: 0
Bootstrap sequence complete, rebooting...
(Reboot command returned success.)

Regards
FK

Hello FK,

this is not a solution, rather some a recount of issues experienced and remarks based on findings with both the Beta and the productions version:

During the Beta I found that some errors "persisted". For example the client constantly returned an error for the installation started task - turned out that a previous run had failed and the client immediately reported the error at the start of the current run (although this then completed successfully). Another was that the client initially failed to send the machine keys but the error wasn't cleared when the subsequent attempt succeeded. I think all this has been corrected for the production release.

Nevertheless, from later tests it seems that errors "stay" longer than one would expect. I don't have a precise record but on one occasion I also had the Pending key issue, after removing it and running Protect again the error did not clear immediately. Didn't watch the client, but when I returned to it later I found the the install was complete and encryption had already started. Checking the console again the error had "disappeared" (perhaps the logic waits for a success from a later step).

When I "moved" one Beta client to the production server it started to display "Comparison failure" on the encryption policy. Moving it back did not resolve the issue. Re-protecting it with the production SDE client worked like a charm but did not resolve the issue. Thus eventually I uninstalled SDE (which needs some time as it has to decrypt the volume but is otherwise practically no effort) and the re-protected the client from SEC. This client also has a quite eventful history, at one point I more or less deliberately FUBARed the SDE kernel (details available on request by PM), recovered the volume (which was not encrypted though) with the PE disk and re-protected it with SDE. So it's quite robust.

SDE is intended to be simple and using it should not involve manually running the .msi. Uninstalling is, as said, not an effort, especially if it has not started encrypting or even completed the install (although it's not required I wouldn't use the client during the decryption though but even this would make the machine is unavailable for not more than half a day or so). From my experience the uninstall does a pretty good job of cleaning up.

I'd first try to run Protect from SEC again - it should not fail and maybe the client processes the policy as it should. If the client reports its status correctly but still refuses to comply with the policy then uninstall (both) SDE (components) and re-protect. It is supposed to work then. Won't fantasize about potential errors before you have tried :smileywink:

Christian

Hi Christian,

thank you for detailed response.

>I'd first try to run Protect from SEC again
Tried several times, but nothing happens. It has been 4 Days since i pushed it via Console and still receive the following message:

Policy            Not Received

Key                Not Received

Certificate    Not Received

The Console says something like "Policy is awaited from Console".

So my simple questions  :) are:

1. why isn't it receiving the Policy, Key and Certificate. What could be the key factor since communication between Client and Server is being taken place.
2. Where can I look for the key and certificates?

Kind Regards
FK

Hello FK,

the questions are simple, the answers probably not.

Basically the communication is via RMS, and involves the Router and Agent. The adapter for encryption is named SEA, so if you search for " SEA " in the agent logs you should see the activity pertaining to SDE. If you can't find this string there's likely some component missing or not operational. As SDE is rather new (and I haven't deployed it) I can't say whether you'll get any insight from it. As I said, I just uninstalled and reinstalled and as it worked I didn't pursue the issue with the policy further.

I suggest you contact Support as I have no better idea at this point.

Christian