Thank you very much for posting this. I was unable to contact Sophos Support directly (creating tickets, sending emails, calling support) nor was my local partner able to help so I'm really glad I happened across this.
Our Sophos update account passwords were out-of-sync causing installation to fail on some clients, and requiring me to manually override the passwords on others. To resolve it all I needed to do was to change the password on the AD object, then enter that same password into the Sophos Enterprise Console, then force an update on all workstations.