sophos problem

[ricki]

HI

 

I have had several computers windows xp machines over the last few days that are refusing to update sophos and I have worked through all the normal techniques of fixing them like.

 

Remove and reinstall.

Remove with removal script from sophos and reinstall

Remove and install from console.

Remove and install locally.

 

I have also followed the instructions for the generic error with no luck. I am getting a error 1920 and from the enterprise console

 

Installation failed

Time Code Description

12/10/2009 09:41:15 fffffffd This computer is not yet managed by Enterprise Console. It is protected but has not yet reported its status to Enterprise Console.

 

 

Outstanding alerts and errors

 

Sophos AutoUpdate status

Time Code Description

09/10/2009 09:32:38 00000067 Failed to install SAVXP: The MSI has failed

 

I am having to resort to ghosting. Has anyone got any ideas what they have broken this time.

 

Thanks for all your help.

 

Richard

[andyriach]

I had a similar problem a while ago, something to do with the SID of the machines.

 

Sophos provided me with two scripts to run which corrected our problem.

 

Try running these on the affected machines - sophos-1.bat then sophos-2.bat

 

Let me know how you get on

 

Andy

sophos-2.zip

[FN-GM]

try running a standard MSI file and see if that will instal

[ricki]

Hi

 

No the standard msi will not install. In the eventvwr it says the file name is too short.

 

Richard

[FN-GM]

Hi

 

No the standard msi will not install. In the eventvwr it says the file name is too short.

 

Richard

 

Its sounds like windows is screwed then rather than Sophos. It sounds like a problem with Windows Installer.

[ricki]

HI

 

Maybe but the strange thing is that some of the machines with problems are only a month old and have the same ghost image on them as the rest of the set that dont have problems. I have tested the hardware and it appears ok. Everything else appears to work ok and group policy will install and unistall programs. I have done sfc /scannow and that passes ok.

 

Oh what fun dealing with the mysteries of sophos.

 

Richard

[rockin]

Hi Ricki,

 

These are 2 different issues.

 

the '..not yet managed..' problem is to do with the remote management side:

Sophos small business solutions: 'Error fffffffd' is reported in the Sophos Control Center

 

(either not installed, firewall issues, or different certificates - due to console reinstall?)

 

 

The 1920 error is usually failure to start the service, if it is for SAVXP (with the autoupdate log will show), then you can check the MSI logs:

 

usually %temp%\

 

Good trick with MSI logs is searching for "value 3" - above this should tell you the customaction / entrypoint / function it was doing before it failed.

 

If it is a 1920 error:

Sophos Anti-Virus for Windows 2000+: troubleshooting error 1920 during installation

 

It is usually a permission problem on the system. Registry of files, or msxml.

 

Hope that helps

 

Rockin.

[FN-GM]

HI

 

Maybe but the strange thing is that some of the machines with problems are only a month old and have the same ghost image on them as the rest of the set that dont have problems. I have tested the hardware and it appears ok. Everything else appears to work ok and group policy will install and unistall programs. I have done sfc /scannow and that passes ok.

 

Oh what fun dealing with the mysteries of sophos.

 

Richard

 

Does another .msi file work such as adobe reader?

[actarus777]

I had a similar problem a while ago, something to do with the SID of the machines.

 

Sophos provided me with two scripts to run which corrected our problem.

 

Try running these on the affected machines - sophos-1.bat then sophos-2.bat

 

Let me know how you get on

 

Andy

 

 

Where are the attached files? There is only one and when I download it I can't open it.

Can u please repost them?

Thanks