Sophos Error Message - Computer is not yet managed by Enterprise Console

[James_Reed]

Hello people.

I have got a little problem in our school we use Sophos Virus software on one of the machines I had a problem updating the Sophos software so I decided to uninstall Sophos from the machine and then I done a fresh installation on the machine but I still get the same error message which is:

Code: fffffffd – This computer is not yet managed by Enterprise Console. It is Protected but has not yet reported its status to Enterprise Console.

Has anyone encountered this problem before? I did look at the Sophos website but the information they provide did not help me out.

Thank You

Can some please help me out.

[Michael]

In my experience, Sophos not reporting its status (despite fully protecting the machine) was down to corrupt or missing registry entries. I especially discovered this problem about a year ago on RM CC3 networks, but touchwood it has been alright for the moment. Alternatively, it could be firewall related as described here.

[DaveP]

Interesting! This is one of the issues I am currently handling and I alluded to in an earlier post this evening. I left the Console updating all of the servers and workstations today. Hopefully it will have caught up by tomorrow morning and I can work with something approaching a 'normal' network tomorrow?

[Sophos-Support-5]

As the fffffffd article suggests (even though it's describing the Sophos Control Center and not the Enterprise Console it's the same version of RMS)...

Sophos small business solutions: 'Error fffffffd' is reported in the Sophos Control Center

...the Console pushed out the scheduled task; the task was known to have run; however nothing has been heard from the client since.

Common issues are either the IP address the client has been told to send messages is wrong, the server or client has multiple IP addresses the they're getting in the way of each other, or something is blocking the communication.

The best thing to do is check...

(1) All the Sophos services are started (you can do this remotely with a snapin)
(2) Restart the Sophos Message Router and Sophos Agent services (again remotely).
(3) Can you telnet from the client to the server and server to client? Open a cmd prompt. enter:

telnet <theOtherComputer'sName> 8192

This tests if something is listening on 8192 (the standard message router port). You should get IOR:4840543954305850430955945034598345034958430523 4783473204

Connection to host lost.

If you get nothing then something is blocking the communication. The IOR:... string (as one long string starting with "IOR:" can be decoded to make sure it contains the right IP address:

ILU IOR Parser

The client polls the server every 15 minutes so as long as the client can telnet the server the Windows firewall shouldn't cause too many problems.
(4) Check the logs under C:\Documents and Settings\All Users\Application Data\Sophos\Remote Management System\3\Router\Logs (you can do this remotely via the C$ share of the computer). In the logs you'll have vertical column of I 's if you scroll down look for W 's (warnings) or E 's (errors).

Post up the latest router log and agent log (...\Remote Management System\3\Agent\Logs) if you need further advice. They're the ultimate source of what's going wrong.

Three out of the above four can all be done from the server without ever visiting the client machine.

If you prefer feel free to run the SDU (Sophos Diagnostic Utility)...

Sophos Diagnostic Utility (SDU): how to download and install

...on the client and the Sophos Management Server (so we can see what's being received on the server-side) and email the logs into us:

https://secure.sophos.com/support/query/

Regards,

Sophos Technical Support