Sophos EM refuses to work!

[Ric_]

I have a server that runs WSUS and Sophos EM. Something random happened to it and both stopped working. I fixed WSUS quite easily but Sophos is being a PITA.

 

I have re-installed multiple times, including re-installs of SQL Express (both 2005 and 2008) wioth no luck. Every time it comes up with an error which the Sophos knowledge base reckons has somethign to do with the user account that the management service is trying to run as - this 'magical' management service just refuses to start!

 

I was beginning to think it hated x64 Windows (Server 2003) buit then I remembered that it did work.

 

Ideas?

[m1ddy]

Weird mate.

 

Only thing I can think of is that a user account it uses has somehow been moved to a different OU or taken out of a security group somewhere?

[Ric_]

Weird mate.

 

Only thing I can think of is that a user account it uses has somehow been moved to a different OU or taken out of a security group somewhere?

 

It uses the local system account.

[mullet_man]

Have you tried logging in via the local account and running Sophos?

[Ric_]

Have you tried logging in via the local account and running Sophos?

 

You cannot login with the local system account - it is an account for running services and therefore is denied local logon rights. The service does not start however.

 

Upon closer inspection, it appears to be a database connection issue... hmmm.

[User3204]

You cannot login with the local system account - it is an account for running services and therefore is denied local logon rights. The service does not start however.

 

Upon closer inspection, it appears to be a database connection issue... hmmm.

 

Actually, you can logon as the system account, you just SHOULDN'T.

 

Is there nothing useful in the Eventlog or whatever Sophos uses to log "events" ?

 

 

The number of times I've had to re-install the equivalent Mcafee EPO server, due to it buggering itself up... I run it as a VM now, and just keep a working backup copy.

[Ric_]

Actually, you can logon as the system account, you just SHOULDN'T.

 

You can't unless you explicitly allow it... obviously I'm not going to do this because you shouldn't.

 

I discovered that I had forgotten to allow 'named pipes' for SQL but it seems that the Management Server database is simply not being created

 

I've tried v3.0.0 and v3.1.0 and I'm now at the point of finding the manual adjuster so that I can teach it a lesson!

 

It should just work... I hate it!

[PcDude]

You haven't mentioned what error you are getting? Something like "0x8004005 Unspecified error"?

 

The Sophos Management service needs to (1) get to the database and (2) authenticate with the SQL server when it gets there.

 

The database could be local, remote. Housed in an instance called whatever you like. Be MSDE or SQL. The SQL server might require SQL authenication or Windows AD. First check the SOPHOS3.mdf and SOPHOS3_log.ldf actually exist and you know where you are going (local, remote... read above).

 

Check in the registry under Sophos\EE\Management Tools for DatabaseConnectionMS

 

That's the string that tells the service where to go. You can do a UDL test (create a new txt document on the Desktop and call it anything.udl). Run it and select from the provider tab "CannotRememberRememberHowItStartsButItEnds..... for SQL Server" (about three-quarters down) and click next. Then enter the serverName\instanceName, select "Windows Intergrated" and then choose the SOPHOS3 database from the list. Click "Test connection" and hopefully it should work. Click OK and then edit the UDL with notepad and compare the provider string with what's shown in the DatabaseConnectionMS string.

 

While you're in the registry check a key beneath the "Management Tools" key called "DatabaseUser". If the windows intergrated option in the UDL file worked you don't need any credentials in here. Rename the "DatabaseUser" key to "DatabaseUserOLD" and try and start the service.

 

 

TTFN

[Ric_]

@PcDude: Thanks for that... the SOPHOS3 database doesn't seem to be getting created, despite trying several user credentials. Something needs a good kick!

[Ric_]

What a muppet! Since re-trying the install on a x86 server, the one thing I hadn't tried was using the inbuilt MSDE instance.

 

The thing now works (I think) so all is well.

[lukang]

No it is a database issue that can be seen in the registry that prevented the Management service from working.

Go to the registry in

HKLM\software\sophos\EE\Management tools\ databaseconnectionsMS

Then make sure that the information for the server is correct.

 

Also in the database user key ( one rung lower ) you will see a reg key that says UseClearText that info should be 0 and the information above it should be blank.

I have seen information in this location cause the console to not open.