Sophos console problems

[D.Ytterdal]

Greeting .

After tried for 2 weeks to solve some issues with Sophos Console 3.0 i now turn to this board.

 

My problem is, i've got 3 computers that won't communicate with the console, neither update, add policies or install(protect...).

It is possible to install the client manually, but still same error as above.

 

I've been through Sophos support site over and over, but neither helps..

 

The computers have their firewalls turned off, can be seen and accessed by other console software (not anti-virus).

 

Also, the console keep telling restart is needed for update on a big amout of machines. -The log says this error is dated 25-10-2007. But its still showing, even though the machines reboots every day at 5 am..

 

The Console is on a Windows 2003 server.

 

If other details are need, please post, and i will do my best to prodvide.

 

-Its not all the machines that shows a error..

 

A quick overview.

-Old errors are still showing warnings. Even if they have been acknowled.

 

-The console won't find some of the machines.

 

-Server is MS 2003.

 

-The clients are using windows XP sp2. -No firewalls / in a domain.

[KarlGoddard]

On the PC's that won't communicate back to the console... check the system times on them.

 

The only time I had this was when the PC system times were totally out of sync with my DC's. (don't ask why this happened they *should* sync I know!!)

 

With regards to the numerous warnings about a restart being needed... this is one of the countless glitches I've come accross with the recent update to Sophos. If I remember right even the Sophos knowledgebase says you can 'ignore' these warnings, but for some reason you can't get rid of them from the console.

 

This is where you have to delve into you sophos SQL database and remove them manually..

 

This is the sql I use to remove the 'restart warnings'

 

UPDATE ComputersAndDeletedComputers SET LastAUErrorAlert = NULL from computersanddeletedcomputers join errors on computersanddeletedcomputers.lastauerroralert = errors.id where errors.number = 109

 

Use at your own risk. It works for me but please test it out in your environment or construct your own similar query.

 

HTH

[ZeroHour]

BTW you may not be aware but the reboot machines *may* have got this update:

http://www.sophos.com/products/enterprise/endpoint/security-and-control/upgrading.html?lang=en

 

It requires a reboot.

[KarlGoddard]

yep and even after restarting - like the OP said - the warnings still show in the Console

[ZeroHour]

Yeh but it may be a issue with v6-v7 causing the console to report it wrongly.

Have you tried the sophos batch file that removes sophos completely?

[D.Ytterdal]

shall the batchfile run on the client?

ive tried to remove it by add/remove in windows.

 

if i try the sql. could i please get a explanation on how to run it?

[KarlGoddard]

you can use osql from the command line - have a look on the sophos knowledge base on how best to do that or you can use what I use - a utility called Query ExPlus. This allows you to query against any sql database you have.

 

Far quicker and lighter to use than Enterprise Manager!!

[Michael]

This is the problem with Sophos. When it goes wrong, it can be a right pain in the *** to get it right again.

 

As already recommended, run the removal scripts to completely remove Sophos. It's not necessary to uninstall manually via Add/Remove Programs, the script will do all this for you.

 

I would also recommend you delete the "C:\Program Files\Sophos" directory (if it still exists) and also delete Sophos registry entries:

 

HKEY_LOCAL_MACHINE > Software > Sophos

 

Delete the whole Sophos folder and its contents. Reboot the machine, run the removal scripts again, then I'd recommend you run a manual install on the workstation pointing to the Interchk share.

 

Two issues I had with Sophos recently - on an RM network, updating Sophos (new version, not identity files) caused problems. This was due to incorrect or no permissions set to 'write' the registry entries. Caused all kinds of weird and wonderful errors for me. It's isolated to RM and although I manually added the right permissions, I was unable to find the reason(s) behind it and neither were Sophos.

 

The second recent problem, was the sweepupd account was disabled in Active Directory. This also creates a whole load of problems. Someone entered an invalid password more than 5 times, so Active Directory disabled the account!

[mrtechsystems]

I do not want to sound cheeky have your enabled file sharing in the exceptions on the workstations

 

http://www.sophos.com/support/knowledgebase/article/12837.html

[D.Ytterdal]

Simpel Fileshareing is turned off. -Neither helps.

Anyways, running the sql script was a success, eliminated 75 of the machine errors.

-Thanks for that.

 

New problem is a huge amout of machines now differs from policy :?.

I will try to remove it by the Removal script today on the troublesome machines.

[woody]

I have had similar problems since updating to v3 of the console. More than half of the clients are greyed out and won't update or install from the console. I have always had the problem of clients not matching the policies even in v2 but with the clients that are connecting in v3, the policies keep failing to apply.

 

I have been on to Sophos tech support and they have gone through the whole simple file share turned off, firewall turned off etc etc, but to no avail. However, if I manually install sophos from the share then the console picks it up and it works without any problems?????

 

The other thing is, I thought simple file sharing was supposed to be off on xp PCs on a domain? All our PCs are XP and on the domain, yet on every PC I have looked at, simple file sharing is on????

 

Anyway, looks like we will be doing a lot of manual installs over the next week!

[m25man]

Check out my other post.

 

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=12905

 

There might be a link between them. Worth a look.

[KarlGoddard]

I must say that I'm not overly impressed with v3.... I seem to spend an ever increasing part of my day dealing with Sophos related probs...

[zag]

Symantec corporate v10 is very good, especially the managment options. And finally their 10.5x client is very stable.

[D.Ytterdal]

I've found a solution to my earlier problem with machines that differs from policy.

The errors that have been achknowledge, must also be se as authorized in the group policy.

 

So i would like to summerise this topic.

 

Subject: errors in Sophos Console v3.

 

Problems: alot of computers are listed in "computers with error"

 

-Many computeres are telling to reboot, even if the gets a reboot daily

--Solution: Run this SQL command:

 

UPDATE ComputersAndDeletedComputers SET LastAUErrorAlert = NULL from computersanddeletedcomputers join errors on computersanddeletedcomputers.lastauerroralert = errors.id where errors.number = 109

 

-Many computers differs from policy. / Showing error with files month or weeks old. (Even if the have been dealt with).

--Solution: Achknowlegde the error, and remember to update group policy to allow or warn on the files that have been achknowledge.

 

-Some Computers are out-of-date, and can't get Sophos Anti-V. installed from console / are awating policy from console.

--Solution: *hoping to find a answer*

[KarlGoddard]

Symantec corporate v10 is very good, especially the managment options. And finally their 10.5x client is very stable.

 

I would start looking into alternatives but we're tied into Sophos through our LEA

[geoffd]

I have been installing the new console 4.5 that schools have to use from March. The instructions are a bit off and you end up having to find your own way round things. I have started documenting them on my forum which I set up a few days ago: OLCHS Tech Forum - Home

[TechSupp]

As already recommended, run the removal scripts to completely remove Sophos. It's not necessary to uninstall manually via Add/Remove Programs, the script will do all this for you.

 

What script is this as I'm due to remove Sophos and install the latest version. Any chance of a copy or a link to it?

[geoffd]

Just go to my forum above as I find ways I am documenting them as a reminder of what I am doing.

[geoffd]

If you have psexec installed

 

@echo off

echo "Starting Removal of Sophos"

 

psexec %1 msiexec.exe /x "c:\program files\sophos\autoupdate\cache\savxp\sophos anti-virus.msi" /q /norestart

psexec %1 msiexec.exe /x "c:\program files\sophos\autoupdate\cache\rms\sophos remote management system.msi" /q /norestart

psexec %1 msiexec.exe /x "c:\program files\sophos\autoupdate\cache\sau\sophos autoupdate.msi" /q /norestart

 

echo "MSI's removed"

 

psexec %1 reg delete HKLM\Software\Sophos /f

psexec %1 reg delete HKCU\Software\Sophos /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Agent" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SavService" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SAVAdminService" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Agent" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Service" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Certification Manager" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos EMLib Update Agent" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SEMscheduler" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Management Service" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Message Router" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SQLAgent$SOPHOS" /f

psexec %1 reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MSSQL$SOPHOS" /f

psexec %1 reg delete "HKLM\System\CurrentControlSet\Services\Eventlog\Sophos" /f

 

echo "Registry cleaned up"

 

psexec %1 rmdir "c:\program files\sophos" /s /q

 

echo "Sophos folder removed"

 

psexec %1 "c:\windows\system32\gpupdate" /force /boot

[geoffd]

Remove via batch command

 

"c:\program files\Sophos Sweep for NT\ESXP\setup.exe" -remove -ni -s

 

or if it's a server path

 

"\\servername\Sophos Sweep for NT\ESXP\setup.exe" -remove -ni -s

 

 

Read more: OLCHS Tech Forum - Login

[kili]

We had this very problem with some machines not updating. After checking event viewer on the affected computers it turned out to be a corrupt windows installer service. Re-install the windows installer service. I used this file WindowsXP-KB942288-v3-x86.exe from Microsoft to re-install the service. Search MS for that file and run it on the workstations in question.

 

This may solve your problem.

 

Kili

Edited December 7, 2010 by kili

[geoffd]

Using the scripts to remove then install I have managed to start getting through the new console 4.5 quite quickly.

[kili]

What script is this as I'm due to remove Sophos and install the latest version. Any chance of a copy or a link to it?

 

When we upgraded to the latest client, enterprise console simply upgraded the install, no removal necessary

[geoffd]

The console was fine overall, sometime the client didn't remove from the users computer so then it has to be removed first. Then a script is good.