SCCM - App being removed - Despite not being told to

[CHiLL]

We have deployed Sophos Connect as our VPN solution to all our staff laptops and it's been working fine for the most part. However, I have recently had reports that Sophos Connect has disappeared from multiple laptops. I actually saw this happen on my partner's laptop at home last night, she was connected to Sophos, then she was disconnected and it was missing from the Task Bar and the shortcut didn't work.

 

I have another member of staff's laptop with me at the moment who had the same issue.

 

Looking at the Application log in Event Viewer, I can see that on 20/03/2023 at 17:08:36, the uninstall of Sophos Connect was initiated by msiexec.

Looking at AppEnforce.log for the same time period, I see this:

+++ Starting Uninstall enforcement for App DT "Sophos Connect 2.2.75" ApplicationDeliveryType - ScopeId_52DA5FC5-B299-4EB5-9230-3EAD92748ACD/DeploymentType_dadd89c3-0032-4708-b4a7-27f688587795, Revision - 2, ContentPath - C:\WINDOWS\ccmcache\37, Execution Context - System
   Performing detection of app deployment type Sophos Connect 2.2.75(ScopeId_52DA5FC5-B299-4EB5-9230-3EAD92748ACD/DeploymentType_dadd89c3-0032-4708-b4a7-27f688587795, revision 2) for system.
+++ Discovered application [AppDT Id: ScopeId_52DA5FC5-B299-4EB5-9230-3EAD92748ACD/DeploymentType_dadd89c3-0032-4708-b4a7-27f688587795, Revision: 2]
   App enforcement environment: 
Context: Machine
Command line: msiexec /x {47055399-87A8-47D5-8E6D-E916B3FEADC4} /q /norestart
Allow user interaction: No
UI mode: 0
User token: null
Session Id: 4294967295
Content path: C:\WINDOWS\ccmcache\37
Working directory: 
   Prepared working directory: C:\WINDOWS\ccmcache\37
Found executable file msiexec with complete path C:\WINDOWS\system32\msiexec.exe
   Prepared command line: "C:\WINDOWS\system32\msiexec.exe" /x {47055399-87A8-47D5-8E6D-E916B3FEADC4} /q /norestart /qn
   Executing Command line: "C:\WINDOWS\system32\msiexec.exe" /x {47055399-87A8-47D5-8E6D-E916B3FEADC4} /q /norestart /qn with system context
   Working directory C:\WINDOWS\ccmcache\37
   Post install behavior is BasedOnExitCode
   Waiting for process 18616 to finish.  Timeout = 30 minutes.
   Process 18616 terminated with exitcode: 0
   Looking for exit code 0 in exit codes table...
   Matched exit code 0 to a Success entry in exit codes table.
   Performing detection of app deployment type Sophos Connect 2.2.75(ScopeId_52DA5FC5-B299-4EB5-9230-3EAD92748ACD/DeploymentType_dadd89c3-0032-4708-b4a7-27f688587795, revision 2) for system.
+++ Application not discovered. [AppDT Id: ScopeId_52DA5FC5-B299-4EB5-9230-3EAD92748ACD/DeploymentType_dadd89c3-0032-4708-b4a7-27f688587795, Revision: 2]
++++++ App enforcement completed (11 seconds) for App DT "Sophos Connect 2.2.75" [scopeId_52DA5FC5-B299-4EB5-9230-3EAD92748ACD/DeploymentType_dadd89c3-0032-4708-b4a7-27f688587795], Revision: 2, User SID: ] ++++++

So I have checked the application in SCCM and I have confirmed that there is no uninstall or supersedence applying to this application. Just an install deployment that is pushed to all staff laptops. I have also clarifyed that the option in Deployment Settings "When a resource is no longer a member of the collection, uninstall this application" is NOT checked.

 

What is also concerning is the actual uninstall command that was used:

msiexec.exe /x {47055399-87A8-47D5-8E6D-E916B3FEADC4} /q /norestart /qn

As the uninstall command specified in SCCM doesn't include the /qn at the end and is just:

msiexec /x {47055399-87A8-47D5-8E6D-E916B3FEADC4} /q /norestart

 

I've also noticed that Sophos Connect doesn't appear in the list of applications in Software Center on a client device, despite double and triple checking that the device is in the collection Sophos is deployed to in SCCM and reporting as active/online.

 

Can anyone help shed some light on why SCCM is uninstalling this application? I'm getting hounded by staff who can't work at home.

Edited March 21, 2023 by CHiLL