Failed to install Sophos End Point 10.6 on 2008 R2 Server.

Hello IT Team WDC,

happens on all 10
hm, is this a fresh install or does the upgrade 10.3 -> 10.6 fail? Anyway, which component fails, could you post the lines from the install log preceding this error (and also a few lines following Created Custom Action Server with PID ... if they aren't already part of the snippet)?

Christian

This is a fresh install after a very messy uninstall of the previous version.

The Sequence of events:

1. Failed upgrade from SEC 5.2.2 -> 5.3.1 (SEC was left completely unusable).
2. Endpoints left stranded.
3. Create new 2012 R2 server with fresh install SEC 5.3.1
4. Re-protect all endpoints windows 7, 2012 R2 works fine. 2008 R2 fails with this error.
5. Trying to manually uninstall/install the endpoint software

The autoupdate component is failing:

This is from the sophos ES Setup log in %temp%. Is this the correct log? I could not find "Created Custom Action" anywhere.

5/11/2016,8:50:54 AM,Information,Action start 8:50:54: PublishFeatures.,
5/11/2016,8:50:54 AM,Information,Action ended 8:50:54: PublishFeatures. Return value 1.,
5/11/2016,8:50:54 AM,Information,Action start 8:50:54: PublishProduct.,
5/11/2016,8:50:54 AM,Information,Action ended 8:50:54: PublishProduct. Return value 1.,
5/11/2016,8:50:54 AM,Information,Action start 8:50:54: SetRemoveTempFolders.,
5/11/2016,8:50:54 AM,Information,Action ended 8:50:54: SetRemoveTempFolders. Return value 1.,
5/11/2016,8:50:54 AM,Information,Action start 8:50:54: StartMonitor.,
5/11/2016,8:50:54 AM,Information,Action ended 8:50:54: StartMonitor. Return value 1.,
5/11/2016,8:50:54 AM,Information,Action start 8:50:54: InstallFinalize.,
5/11/2016,8:50:54 AM,Information,CustomAction AutoUpdateServiceStopCheck returned actual error code 1601 but will be translated to success due to continue marking,
5/11/2016,8:50:55 AM,Information,CustomAction CopyConfigFiles returned actual error code 1601 (note this may not be 100% accurate if translation happened inside sandbox),
5/11/2016,8:50:55 AM,ERROR,Error 1719.The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance.,
5/11/2016,8:50:58 AM,Information,Action ended 8:50:58: InstallFinalize. Return value 3.,
5/11/2016,8:50:58 AM,Information,Action ended 8:50:58: INSTALL. Return value 3.,
5/11/2016,8:50:58 AM,ERROR,Installation of C:\Users\username\AppData\Local\Temp\2\sophosa\sau\Sophos AutoUpdate.msi failed with error code 1603,

This is a fresh install after a very messy uninstall of the previous version.

The Sequence of events:

1. Failed upgrade from SEC 5.2.2 -> 5.3.1 (SEC was left completely unusable).
2. Endpoints left stranded.
3. Create new 2012 R2 server with fresh install SEC 5.3.1
4. Re-protect all endpoints windows 7, 2012 R2 works fine. 2008 R2 fails with this error.
5. Trying to manually uninstall/install the endpoint software

The autoupdate component is failing:

This is from the sophos ES Setup log in %temp%. Is this the correct log? I could not find "Created Custom Action" anywhere.

5/11/2016,8:50:54 AM,Information,Action start 8:50:54: PublishFeatures.,
5/11/2016,8:50:54 AM,Information,Action ended 8:50:54: PublishFeatures. Return value 1.,
5/11/2016,8:50:54 AM,Information,Action start 8:50:54: PublishProduct.,
5/11/2016,8:50:54 AM,Information,Action ended 8:50:54: PublishProduct. Return value 1.,
5/11/2016,8:50:54 AM,Information,Action start 8:50:54: SetRemoveTempFolders.,
5/11/2016,8:50:54 AM,Information,Action ended 8:50:54: SetRemoveTempFolders. Return value 1.,
5/11/2016,8:50:54 AM,Information,Action start 8:50:54: StartMonitor.,
5/11/2016,8:50:54 AM,Information,Action ended 8:50:54: StartMonitor. Return value 1.,
5/11/2016,8:50:54 AM,Information,Action start 8:50:54: InstallFinalize.,
5/11/2016,8:50:54 AM,Information,CustomAction AutoUpdateServiceStopCheck returned actual error code 1601 but will be translated to success due to continue marking,
5/11/2016,8:50:55 AM,Information,CustomAction CopyConfigFiles returned actual error code 1601 (note this may not be 100% accurate if translation happened inside sandbox),
5/11/2016,8:50:55 AM,ERROR,Error 1719.The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance.,
5/11/2016,8:50:58 AM,Information,Action ended 8:50:58: InstallFinalize. Return value 3.,
5/11/2016,8:50:58 AM,Information,Action ended 8:50:58: INSTALL. Return value 3.,
5/11/2016,8:50:58 AM,ERROR,Installation of C:\Users\username\AppData\Local\Temp\2\sophosa\sau\Sophos AutoUpdate.msi failed with error code 1603,

Hello IT Team WDC,

Is this the correct log
it is, apparently the initial install of AutoUpdate fails. This does not create a full MSI log (you'll find an MSIxxxxx.LOG which starts with Error 1719 and contains the list of Properties "besides" your Sophos ES Setup.log). I was not able to reproduce the same log as you (did you try to install with the UI running setup.exe from the CID?) but similar errors by tweaking (deliberately misconfiguring) the registry.
Dunno if they apply in your case but please see the following blog entry (yes, it's quite old):
Troubleshooting: Signs of an Incorrectly Registered Custom Action Server
Then there's Fix problems that programs cannot be installed or uninstalled from Microsoft Support which allegedly fixes corrupted registry keys

Christian
 

Finally got this one sorted out. Turned out is was windows update KB3139923 causing the failure. I uninstalled the update and everything works fine.

This occurred because I did not have KB3072630 installed before I installed KB3139923. It looks like you can also solve the issue by installing KB3072630 instead of uninstalling KB3139923. But I didn't try this.

Here is what I found:

https://social.technet.microsoft.com/Forums/windows/en-US/7109081b-a82a-46e4-b6fe-f19b7d56e431/problem-with-some-msi-installs-after-kb3139923?forum=w7itproinstall

Thanks for your help Christian!