[sims] Sophos Intercept X preventing SIMS.net install on Windows 10

[kennysarmy]

We've been on SOLUS 3 now for quite a while - does anyone know the manual installation instructions to install SIMS.net on a client so I can bypass SOLUS 3 ?

[thatley]

We've been on SOLUS 3 now for quite a while - does anyone know the manual installation instructions to install SIMS.net on a client so I can bypass SOLUS 3 ?

 

Hi Kenny,

 

You should be able to just run SimsInst.exe from your SIMS install share. That should run the pre-requisites and all the other components (with Intercept X disabled of course)

[thatley]

Jeepers! I'm now so glad that the Dell PC our F&BM uses failed to update to W10 from W7 recently - the pre-upgrade check reported there'd be a graphics driver issue on the year-old Dell if it was up[graded to I held fire.

 

This happens for us on Win7 x64 and x86 specky.

[thatley]

Got this update from LGFL/Atomwide after I left yesterday:

 

"I've just received an update from our account manager explaining that Sophos have today been liaising with the user that started the Edugeek thread.

They are still troubleshooting at the moment but assure me that I'll be kept in the loop.

As soon as I know more, I'll feed back to you."

 

I'm guessing that's you Kenny

[kennysarmy]

Hi Kenny,

 

You should be able to just run SimsInst.exe from your SIMS install share. That should run the pre-requisites and all the other components (with Intercept X disabled of course)

 

Do we know if anyone has sent them a copy of "SimsInst.exe" ?

 

Might be worth it...

[thatley]

Do we know if anyone has sent them a copy of "SimsInst.exe" ?

 

Might be worth it...

 

Trouble is, it's not just SIMSinst.exe. SIMSinst.exe calls on all the other components for install "SimsInfrastructureSetup.exe, SimsApplicationSetup.exe, SimsManualSetup.ext, SimsAMPARK.exe" Think they'd pretty much need to see a whole "Setups" directory to diagnose, which is why I think Sophos are liaising with someone from CAPITA as well as looking at this forum.

Edited November 9, 2017 by thatley

[kennysarmy]

Latest E-mail to SOPHOS!

 

I have FTP uploaded the following files:

 

Process Monitor

SimsTest4LogfileInterceptX-hitman-running-FAILS.zip

 

SDU Log

SIMSTEST04_20171109_101652_sdulog.zip

 

These are from a PC freshly imaged, Intercept X installed AND HitManPro Service RUNNING.

 

The software DOES NOT installcorrectly.

 

 

I do not feel we can do much more now - you should have all the information to fix this issue, I've also advised that the other schools feel that the issue began whenHitmanPro.Alert was upgraded from 3.6.8 to 3.6.9 in October!

 

So it should now be pretty straight forward for your engineers to expedite a fix!

 

I look forward to good news later today.

 

Regards

[thatley]

Nice one Kenny!

 

I've pretty much said the same to Atomwide to pass on to Sophos that we've done all we can now with testing.

 

Fingers crossed for a result!

[kennysarmy]

Latest test!

 

Two identical PC's side by side; one with Intercept X running, one with no Sophos software.

 

Mapped the S:\ drive.

 

Ran the following : SIMSApplications, SIMSampark and SIMSmanuals

 

All installed correctly on both PC's!

 

If I check in C:\ProgramData\ there is obviously no C:\ProgramData\Capita\Solus3\Deployments folder - so maybe that is something to do with it?

[thatley]

Did you run SIMSInfrastructureSetup? That's where it fails if you run SimsInst.exe

[MrMat]

Even after the installation, is the SIMSApplicationSetup.exe still running in the background?

[DeGrimmy]

This thread is very interesting. I had this very problem on a freshly imaged Windows 7 x64 PC. I normally install Sophos first out of principle, but I never made the connection between SIMS failing and Intercept X. The way I got around it was by running the component installers individually, skipping the prerequisite install step as we already have those installed anyway.

 

I had assumed it was down to something odd with the PC, as I'd installed Sophos & SIMS on other freshly imaged PCs on the same day with no issues. I don't have any solutions to add but I'll definitely keep tabs on the thread. Thanks all!

[kennysarmy]

Even after the installation, is the SIMSApplicationSetup.exe still running in the background?

 

Seems they are all hanging around on the Intercept X PC!

 

[kennysarmy]

Did you run SIMSInfrastructureSetup? That's where it fails if you run SimsInst.exe

 

Our LEA told us this was not necessary on a workstation install

"No this does not need to be run when installing onto a workstation.

[kennysarmy]

My worry is there will be an Autumn Release before this issue is resolved and there WILL be school's who don't know they have an issue....and pushing out via SOLUS3 could bork all their clients....

[kennysarmy]

Wondering if anyone is able to replicate the failed installations who is not using SOLUS 3 - can I try your method ?

[kennysarmy]

Just spoke to someone from SOPHOS escalations team.

 

They are going to remote in tomorrow and view 3 computers live as we push out Sims.net using SOLUS 3

 

1. A PC with intercept X

2. A PC without intercept X

3. The SIMS Server.

 

 

This should along with all the logs and other files I've sent over give them a better idea what is going on.

 

Apparently there is a new version of Intercept X coming out soon but it's not for public release, but we may be able to get our hands on it - in advance for testing against this issue.

 

Cheers

[thatley]

Just spoke to someone from SOPHOS escalations team.

 

They are going to remote in tomorrow and view 3 computers live as we push out Sims.net using SOLUS 3

 

1. A PC with intercept X

2. A PC without intercept X

3. The SIMS Server.

 

 

This should along with all the logs and other files I've sent over give them a better idea what is going on.

 

Apparently there is a new version of Intercept X coming out soon but it's not for public release, but we may be able to get our hands on it - in advance for testing against this issue.

 

Cheers

 

 

Great news about the testing tomorrow - if they need to look at SIMS being deployed manually or by script - I have a clean test rig here ready and waiting. Point them this way if they're interested.

 

Good luck Kenny!

[kennysarmy]

The plan for the new PC's in my office awaiting deployment is;

 

Install Sophos Endpoint with Intercept X, but disable the Hitmanpro service - this allows SOLUS3 to push out SIMS.net correctly.

 

When SOPHOS fix the issue and the affected PC's are upgraded we can then manually turn back on the service, at that point we should be good to roll out the Autumn release of SIMS too!

[thatley]

Sounds like a plan! Really hope they fix it or find the cause in your testing tomorrow. I'll be waiting with bated breath!

[MrMat]

Seems they are all hanging around on the Intercept X PC!

 

[ATTACH=CONFIG]46126[/ATTACH]

 

I think that's the issue. Sophos seems to be preventing the SIMS EXE from closing when it's finished. If you were to run the installers again, you'd just end up with two of each still running in the background etc.

 

We’re getting the same issue over here with a whole bunch of machines throughout the Borough, all of which have Sophos installed (the below may be rambling/repeating what’s already been said but just thought I’d give my 2 pence).

 

We’re trying to install SIMS using SOLUS3 and it only gets so far and then stops resulting in the Failed to unpack error on S3. It seems to be that the EXEs aren’t closing properly which seems to prevent the install from finishing. It doesn’t matter whether you run the SIMSApplication/Manual/Ampark etc manually or whether it’s ran from S3, when it’s finished it doesn’t close properly and can still be seen running in the background.

 

I’ve narrowed it down to be ‘Sophos Exploit Prevention V3.6.9’ (is this the same as Intercept X/Hitman?). Tested on several laptops (tried deploying via S3 = Fails, remove S3, remove Exploit Prevention, clean out all the S3 folders etc, restart machine, try S3 and SIMS again and it all installs just fine).

 

We also have an active call open with SOPHOS but to be honest, not much as happened so far.

[thatley]

To throw something else at Intercept X - we've just discovered that it stops Hyper-V machines starting on Windows 10. Disabled Hitman.Pro in registry, boom, Hyper-v works.

 

What have Sophos done!

[kennysarmy]

I think that's the issue. Sophos seems to be preventing the SIMS EXE from closing when it's finished. If you were to run the installers again, you'd just end up with two of each still running in the background etc.

 

We’re getting the same issue over here with a whole bunch of machines throughout the Borough, all of which have Sophos installed (the below may be rambling/repeating what’s already been said but just thought I’d give my 2 pence).

 

We’re trying to install SIMS using SOLUS3 and it only gets so far and then stops resulting in the Failed to unpack error on S3. It seems to be that the EXEs aren’t closing properly which seems to prevent the install from finishing. It doesn’t matter whether you run the SIMSApplication/Manual/Ampark etc manually or whether it’s ran from S3, when it’s finished it doesn’t close properly and can still be seen running in the background.

 

I’ve narrowed it down to be ‘Sophos Exploit Prevention V3.6.9’ (is this the same as Intercept X/Hitman?). Tested on several laptops (tried deploying via S3 = Fails, remove S3, remove Exploit Prevention, clean out all the S3 folders etc, restart machine, try S3 and SIMS again and it all installs just fine).

 

We also have an active call open with SOPHOS but to be honest, not much as happened so far.

 

I'm awaiting a remote session with SOPHOS this morning to show them exactly what is going on....

[kennysarmy]

14:03 Adithyan Thangaraj: You have been extremely cooperative and patient .. Thank you .. We do not expect immeidate solution as I suspect Dev team may hve to be involved in this .. I will update you as and when I receive updates form the Global Esclations Team .

14:03 Jeff 3: ok - there are a lot of schools and users around the country awaiting a solution!

14:04 Jeff 3: To throw something else at Intercept X - we've just discovered that it stops Hyper-V machines starting on Windows 10. Disabled Hitman.Pro in registry, boom, Hyper-v works.

 

What have Sophos done!

14:04 Jeff 3: this is from the thread on edugeek forum that I started!

14:04 Jeff 3:

14:04 Jeff 3: oh dear

14:05 Adithyan Thangaraj: Honestly ....

14:05 Adithyan Thangaraj: The Hyper V issue is someting we know ... we are already working on a fix for it ...

14:06 Jeff 3: thanks.

[thatley]

14:03 Adithyan Thangaraj: You have been extremely cooperative and patient .. Thank you .. We do not expect immeidate solution as I suspect Dev team may hve to be involved in this .. I will update you as and when I receive updates form the Global Esclations Team .

14:03 Jeff 3: ok - there are a lot of schools and users around the country awaiting a solution!

14:04 Jeff 3: To throw something else at Intercept X - we've just discovered that it stops Hyper-V machines starting on Windows 10. Disabled Hitman.Pro in registry, boom, Hyper-v works.

 

What have Sophos done!

14:04 Jeff 3: this is from the thread on edugeek forum that I started!

14:04 Jeff 3:

14:04 Jeff 3: oh dear

14:05 Adithyan Thangaraj: Honestly ....

14:05 Adithyan Thangaraj: The Hyper V issue is someting we know ... we are already working on a fix for it ...

14:06 Jeff 3: thanks.

 

Oh dear - doesn't look like we'll get anything anytime soon!

 

Thanks for showing him the Hyper-v issue - interesting that they know about it too. And thanks for going through all that testing on yours and everyone's behalf.

 

Don't know what else to say.

 

----Update------

 

Sophos Platinum Support have now been given my direct number as I was told they want to contact me to see the problem in manual/script installs. Worth a try - I'm staring at the phone now waiting!

Edited November 10, 2017 by thatley