Sophos console problems

[D.Ytterdal]

Greeting .
After tried for 2 weeks to solve some issues with Sophos Console 3.0 i now turn to this board.

My problem is, i've got 3 computers that won't communicate with the console, neither update, add policies or install(protect...).
It is possible to install the client manually, but still same error as above.

I've been through Sophos support site over and over, but neither helps..

The computers have their firewalls turned off, can be seen and accessed by other console software (not anti-virus).

Also, the console keep telling restart is needed for update on a big amout of machines. -The log says this error is dated 25-10-2007. But its still showing, even though the machines reboots every day at 5 am..

The Console is on a Windows 2003 server.

If other details are need, please post, and i will do my best to prodvide.

-Its not all the machines that shows a error..

A quick overview.
-Old errors are still showing warnings. Even if they have been acknowled.

-The console won't find some of the machines.

-Server is MS 2003.

-The clients are using windows XP sp2. -No firewalls / in a domain.

[KarlGoddard]

On the PC's that won't communicate back to the console... check the system times on them.

The only time I had this was when the PC system times were totally out of sync with my DC's. (don't ask why this happened they *should* sync I know!!)

With regards to the numerous warnings about a restart being needed... this is one of the countless glitches I've come accross with the recent update to Sophos. If I remember right even the Sophos knowledgebase says you can 'ignore' these warnings, but for some reason you can't get rid of them from the console.

This is where you have to delve into you sophos SQL database and remove them manually..

This is the sql I use to remove the 'restart warnings'

UPDATE ComputersAndDeletedComputers SET LastAUErrorAlert = NULL from computersanddeletedcomputers join errors on computersanddeletedcomputers.lastauerroralert = errors.id where errors.number = 109

Use at your own risk. It works for me but please test it out in your environment or construct your own similar query.

HTH

[ZeroHour]

BTW you may not be aware but the reboot machines *may* have got this update:
http://www.sophos.com/products/enter...g.html?lang=en

It requires a reboot.

[KarlGoddard]

yep and even after restarting - like the OP said - the warnings still show in the Console

[ZeroHour]

Yeh but it may be a issue with v6-v7 causing the console to report it wrongly.
Have you tried the sophos batch file that removes sophos completely?

[D.Ytterdal]

shall the batchfile run on the client?
ive tried to remove it by add/remove in windows.

if i try the sql. could i please get a explanation on how to run it?

[KarlGoddard]

you can use osql from the command line - have a look on the sophos knowledge base on how best to do that or you can use what I use - a utility called Query ExPlus. This allows you to query against any sql database you have.

Far quicker and lighter to use than Enterprise Manager!!

[Michael]

This is the problem with Sophos. When it goes wrong, it can be a right pain in the *** to get it right again.

As already recommended, run the removal scripts to completely remove Sophos. It's not necessary to uninstall manually via Add/Remove Programs, the script will do all this for you.

I would also recommend you delete the "C:\Program Files\Sophos" directory (if it still exists) and also delete Sophos registry entries:

HKEY_LOCAL_MACHINE > Software > Sophos

Delete the whole Sophos folder and its contents. Reboot the machine, run the removal scripts again, then I'd recommend you run a manual install on the workstation pointing to the Interchk share.

Two issues I had with Sophos recently - on an RM network, updating Sophos (new version, not identity files) caused problems. This was due to incorrect or no permissions set to 'write' the registry entries. Caused all kinds of weird and wonderful errors for me. It's isolated to RM and although I manually added the right permissions, I was unable to find the reason(s) behind it and neither were Sophos.

The second recent problem, was the sweepupd account was disabled in Active Directory. This also creates a whole load of problems. Someone entered an invalid password more than 5 times, so Active Directory disabled the account!

[mrtechsystems]

I do not want to sound cheeky have your enabled file sharing in the exceptions on the workstations

http://www.sophos.com/support/knowle...cle/12837.html

[D.Ytterdal]

Simpel Fileshareing is turned off. -Neither helps.
Anyways, running the sql script was a success, eliminated 75 of the machine errors.
-Thanks for that.

New problem is a huge amout of machines now differs from policy :?.
I will try to remove it by the Removal script today on the troublesome machines.

[woody]

I have had similar problems since updating to v3 of the console. More than half of the clients are greyed out and won't update or install from the console. I have always had the problem of clients not matching the policies even in v2 but with the clients that are connecting in v3, the policies keep failing to apply.

I have been on to Sophos tech support and they have gone through the whole simple file share turned off, firewall turned off etc etc, but to no avail. However, if I manually install sophos from the share then the console picks it up and it works without any problems?????

The other thing is, I thought simple file sharing was supposed to be off on xp PCs on a domain? All our PCs are XP and on the domain, yet on every PC I have looked at, simple file sharing is on????

Anyway, looks like we will be doing a lot of manual installs over the next week!

[m25man]

Check out my other post.

http://www.edugeek.net/index.php?nam...wtopic&t=12905

There might be a link between them. Worth a look.

[KarlGoddard]

I must say that I'm not overly impressed with v3.... I seem to spend an ever increasing part of my day dealing with Sophos related probs...

[zag]

Symantec corporate v10 is very good, especially the managment options. And finally their 10.5x client is very stable.

[D.Ytterdal]

I've found a solution to my earlier problem with machines that differs from policy.
The errors that have been achknowledge, must also be se as authorized in the group policy.

So i would like to summerise this topic.

Subject: errors in Sophos Console v3.

Problems: alot of computers are listed in "computers with error"

-Many computeres are telling to reboot, even if the gets a reboot daily
--Solution: Run this SQL command:

UPDATE ComputersAndDeletedComputers SET LastAUErrorAlert = NULL from computersanddeletedcomputers join errors on computersanddeletedcomputers.lastauerroralert = errors.id where errors.number = 109

-Many computers differs from policy. / Showing error with files month or weeks old. (Even if the have been dealt with).
--Solution: Achknowlegde the error, and remember to update group policy to allow or warn on the files that have been achknowledge.

-Some Computers are out-of-date, and can't get Sophos Anti-V. installed from console / are awating policy from console.
--Solution: *hoping to find a answer*