Sophos installer creates a local AutoUpdate account using naming convention 'SophosSAUaaa' instead of 'SophosSAU0'

Question

Sophos installer creates a local AutoUpdate account using naming convention 'SophosSAU<machine-name>aaa' instead of 'SophosSAU<machine-name>0' which seems to be affecting our client computers thus preventing them from updating correctly. The 'aaa' section of the local account replaces the last 2 characters of the machine name which is causing all sorts of issues. Is there a reason for this? Has Sophos changed the way it creates the local account? We are currently using Sophos Endpoint 10.6.3., previously used Sophos 10.3.x. The Sophos shield in the taskbar sits with a red X. My only solution is to manually create a local account prior to installation and insert the registry keys, etc. Any info on fixing this would be much appreciated.

This thread was automatically locked due to age.

QC · Answer

Hello Liam Hitchen , 
 indeed the installer now appends (or, as in your case, perhaps overlays) the string aaa instead of appending 0 . Neither the SophosSAU article nor the release notes mention this change - if it is intended. Can't say if this change came with 10.6.3. 
 replaces the last 2 characters [...] all sorts of issues which besides the failed updates (bad enough of course)? Shouldn't make a difference how the name built (except for DCs where there is a greater chance for collisions - wonder if it'd count up to aab, aac, ...) - unless the local account name and the Download User registry value are different. Haven't observed the overlay though, might depend on the computername length. [Edit] A few checks suggest that only the first 8 characters of the computer name are used. No issues here though as far as I can tell. [/Edit] 
 Please contact Support directly - this is nothing you or I could fix it seems. I'd appreciate if you could post their answer here. 
 Christian

Liam Hitchen · Answer

Unfortunately, Sophos Support have not provided a reason as to why the local account is created with the 'aaa'. Instead, they have directed me to a KB article on how to manually create the local account before installing Sophos. I've already done this and yes it does work, but I was more interested in why the change in the naming of the local account used for autoupdating. To be honest, I don't think their support team even know why so it looks like all hope is lost !! 
 https://community.sophos.com/kb/en-us/48910 - I already used this to manually create the local account so I will just have to use this as the official resolution.