minimoo

just rename the hmpalert.dll in c:\windows\system32 and c:\windows\syswow64 as an admin

I'm struggling to see how this would be a Data protection issue - if anything I'd argue that not including both a photo + name is an issue as per @elsiegee40's comment on safeguarding. I mean, using the logic above - If the school chooses to set homework and the students are required to take their exercise book home to do said homework, as the exercise book contains the students name and work, it's personal data. Therefore school's should stop setting homework after the May

FYI - The installer Smart Notebook 10.8 also has issues with the sophos behaviour. Latest comment I've had from sophos is they are still working on getting a fix out this year

I asked sophos earlier on whether they'd tested additional example programs I sent (that they thought they might be able to test today), but didn't get a response today. Equally, said I was willing to confirm/test the fix.

@apearce - I more meant, where does one stand if they want to make use of minecraft etc 'now' - but are in a 3yr. I know with some benefits the software assurance stuff kicks in - other times not. As opposed to saying I didn't like the change

@apearce what happens with existing 3-year 'legacy' ees agreements (and things like minecraft)?

And as i just said in another post - probably worht seeing https://blogs.technet.microsoft.com/configurationmgr/2017/08/18/high-cpuhigh-memory-in-wsus-following-update-tuesdays/ regarding wsus settings.

We had the UK sales guy from clickview out earlier this month - and he was saying how they have an office in North london not far from us - will direct them to this thread for a comment.

@Cache - might not be related but something you could try / investigate: a) https://blogs.technet.microsoft.com/configurationmgr/2017/08/18/high-cpuhigh-memory-in-wsus-following-update-tuesdays/ might related (might not be) b) increase the iis pool size https://www.404techsupport.com/2016/03/21/iis-wsus-private-memory/

If you are interested in something (or angry about something) you can generate lots of work quite with little effort. I mean - it would take me about 10 minutes to construct a list of questions querying how many energy saving light bulbs schools have vs traditional bulbs. I could probably find some data source that would give me an email address to a few thousand schools in the country within about 30 minutes no doubt. So 1 hour effort and you could effectively ask lots of people to walk around counting light bulbs - and even saying go away would probably take 10 minutes of someone's time. Correct me if i'm wrong - if a response wasn't received to the request you could then forward it to the ICO (i'm thinking it's someone else in this case?) complaining. I've wasted more time this week on hold to suppliers than it would take doing the above @Banjo - what LA do you work for - we can test this theory out? )

and whilst we got that template - my follow up to that got met with "The fix applied resolves the ungraceful termination of processes to many applications" - so might mean it comes back to the other issues they've acknowledged e.g. hyper-v

Wise installshield wizard runs, extracts files/installer to a folder in temp (for the case of sims itself - that's an app that extracts a bunch of temp files or a bunch of temp files) - for the simpler case of the FMS sql client - that's an app that contains 2 msi files. Once extracted, the child process is then run - that then closes successfully with a status code of 0: NtTerminateProcess arg 0: 0xffffffff (type=HANDLE, size=0x4) arg 1: 0x0 (type=NTSTATUS, size=0x4) From what I can tell, with the Capita and non-Capita example files this bit works fine to this point. So then control is passed back to the original Application - which deletes the file in temp and closes the handle to that file: 172753 04:07.7 1 sqlncli_2005.exe DeleteFileA ( "C:\Users\plr\AppData\Local\Temp\GLBF751.tmp" ) 172754 04:07.7 1 KERNELBASE.dll RtlInitAnsiStringEx ( 0x0018f8f0, "C:\Users\plr\AppData\Local\Temp\GLBF751.tmp" ) 172755 04:07.7 1 KERNELBASE.dll RtlAnsiStringToUnicodeString ( 0x0018f908, 0x0018f8f0, TRUE ) 172756 04:07.7 1 KERNELBASE.dll RtlDosPathNameToRelativeNtPathName_U_WithStatus ( "C:\Users\plr\AppData\Local\Temp\GLBF751.tmp", 0x0018f8d8, NULL, 0x0018f8c0 ) 172757 04:07.7 1 KERNELBASE.dll NtOpenFile ( 0x0018f8f0, DELETE | FILE_READ_ATTRIBUTES, 0x0018f8a8, 0x0018f8e0, FILE_SHARE_DELETE | FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_NON_DIRECTORY_FILE | FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT ) 172758 04:07.7 1 KERNELBASE.dll NtQueryInformationFile ( 0x00000110, 0x0018f8e0, 0x0018f8d0, 8, FileAttributeTagInformation ) 172759 04:07.7 1 KERNELBASE.dll RtlReleaseRelativeName ( 0x0018f8c0 ) 172760 04:07.7 1 KERNELBASE.dll RtlFreeHeap ( 0x003a0000, 0, 0x00d7e1a0 ) 172761 04:07.7 1 KERNELBASE.dll NtSetInformationFile ( 0x00000110, 0x0018f8e0, 0x0018f903, 1, FileDispositionInformation ) 172762 04:07.7 1 KERNELBASE.dll NtClose ( 0x00000110 ) At this point, a system call to: 172764 04:07.7 1 KERNEL32.dll RtlExitUserThread ( STATUS_SUCCESS ) takes place - and it's somewhere around here that things start going wrong - at that point hmpalert.dll for the first time comes into play: 172765 04:07.7 1 hmpalert.dll EnterCriticalSection ( 0x752acaf0 ) 172766 04:07.7 1 hmpalert.dll LeaveCriticalSection ( 0x752acaf0 ) 172767 04:07.7 1 hmpalert.dll EnterCriticalSection ( 0x752acad8 ) 172768 04:07.7 1 hmpalert.dll LeaveCriticalSection ( 0x752acad8 ) 172769 04:07.7 1 hmpalert.dll HeapFree ( 0x003a0000, 0, 0x00d06f90 ) 172770 04:07.7 1 KERNEL32.dll RtlFreeHeap ( 0x003a0000, 0, 0x00d06f90 ) followed by the sophos detours library (and assuming they have named that after the original microsoft research project - https://www.microsoft.com/en-us/research/project/detours/ - we know what that does): 172779 04:07.7 1 SOPHOS~1.DLL EnterCriticalSection ( 0x751db048 ) 172780 04:07.7 1 SOPHOS~1.DLL InterlockedDecrement ( 0x02991e38 ) 172781 04:07.7 1 SOPHOS~1.DLL LeaveCriticalSection ( 0x751db048 ) 172782 04:07.7 1 SOPHOS~1.DLL EnterCriticalSection ( 0x751db030 ) 172783 04:07.7 1 SOPHOS~1.DLL InterlockedDecrement ( 0x751d87c0 ) 172784 04:07.7 1 SOPHOS~1.DLL InterlockedDecrement ( 0x751d8b34 ) 172785 04:07.7 1 SOPHOS~1.DLL LeaveCriticalSection ( 0x751db030 ) 172786 04:07.7 1 SOPHOS~1.DLL HeapFree ( 0x02990000, 0, 0x029907d0 ) Then the I believe the final detach tries to happen: 172787 04:07.7 1 KERNEL32.dll RtlFreeHeap ( 0x02990000, 0, 0x029907d0 ) 172788 04:07.7 1 KERNEL32.dll RtlFreeHeap ( 0x02b50000, 0, 0x02b507d0 ) 172789 04:07.7 1 ntdll.dll DllMain ( 0x756c0000, DLL_THREAD_DETACH, NULL ) 172790 04:07.7 1 ntdll.dll DllMain ( 0x76560000, DLL_THREAD_DETACH, NULL ) 172791 04:07.7 1 IMM32.DLL GetKeyboardLayout ( 0 ) 172792 04:07.7 1 ntdll.dll DllMain ( 0x76830000, DLL_THREAD_DETACH, NULL ) 172793 04:07.7 1 MSCTF.dll GetCurrentThreadId ( ) 172794 04:07.7 1 MSCTF.dll InterlockedExchange ( 0x768b58a8, 14240 ) 172795 04:07.7 1 MSCTF.dll InterlockedExchange ( 0x768b58a8, 0 ) 172796 04:07.7 1 ntdll.dll DllMain ( 0x75d80000, DLL_THREAD_DETACH, NULL ) 172797 04:07.7 1 ADVAPI32.dll GetCurrentThreadId ( ) 172798 04:07.7 1 ADVAPI32.dll WaitForSingleObject ( 0x0000007c, 60000 ) 172799 04:07.7 1 KERNELBASE.dll NtWaitForSingleObject ( 0x0000007c, FALSE, 0x0018fb4c ) 172800 04:07.7 1 ADVAPI32.dll RtlLookupElementGenericTableAvl ( 0x75df73a0, 0x0018fcb8 ) 172801 04:07.7 1 ADVAPI32.dll ReleaseMutex ( 0x0000007c ) 172802 04:07.7 1 KERNELBASE.dll NtReleaseMutant ( 0x0000007c, NULL ) 172803 04:07.7 1 ntdll.dll DllMain ( 0x75490000, DLL_THREAD_DETACH, NULL ) 172804 04:07.7 1 ntdll.dll DllMain ( 0x753e0000, DLL_THREAD_DETACH, NULL ) 172805 04:07.7 1 ntdll.dll DllMain ( 0x76390000, DLL_THREAD_DETACH, NULL ) 172806 04:07.7 1 msvcrt.dll FlsGetValue ( 3 ) 172807 04:07.7 1 msvcrt.dll FlsSetValue ( 3, NULL ) 172808 04:07.7 1 ntdll.dll DllMain ( 0x75200000, DLL_THREAD_DETACH, NULL ) 172809 04:07.7 1 hmpalert.dll GetCurrentThreadId ( ) 172810 04:07.7 1 hmpalert.dll EnterCriticalSection ( 0x752ada0c ) 172811 04:07.7 1 hmpalert.dll WaitForSingleObject ( 0x0000005c, INFINITE ) 172812 04:07.7 1 KERNELBASE.dll NtWaitForSingleObject ( 0x0000005c, FALSE, NULL ) 172813 04:07.7 1 hmpalert.dll HeapAlloc ( 0x003a0000, 0, 16 ) 172814 04:07.7 1 hmpalert.dll HeapFree ( 0x003a0000, 0, 0x00d09e18 ) 172815 04:07.7 1 KERNEL32.dll RtlFreeHeap ( 0x003a0000, 0, 0x00d09e18 ) 172816 04:07.7 1 hmpalert.dll LeaveCriticalSection ( 0x752ada0c ) 172817 04:07.7 1 hmpalert.dll FlsGetValue ( 1 ) 172818 04:07.7 1 ntdll.dll DllMain ( 0x758c0000, DLL_THREAD_DETACH, NULL ) 172819 04:07.7 1 KERNEL32.dll RtlCleanUpTEBLangLists ( ) 172820 04:07.7 1 ntdll.dll DllMain ( 0x75d30000, DLL_THREAD_DETACH, NULL ) And that's about the point system calls stop happening and the app just sits there. What I couldn't work out, was whether the DLL gets detached and the app hangs at that point, or whether the dll never detaches and the app sits their waiting. I think it *might* be the former from the below: My comment on my case yesterday was whether they could triage it as "Legacy Wise installation wizard setup programs hang with hitman pro" rather than 'capita's installer breaks'. Equally, I would love to know if my analysis above is completely off or anywhere near the truth - but I doubt I will ever find that out

The hyper-v issue is different - as you can exclude the process to get around it. In terms of repackaging - you've lost me - if you mean "can i take the .exe file and push it out via an MSI" - that isn't going to work. If you mean, can I grab the files and copy them down to a workstation, that would work - the sims installers support /x to extract them (or you can use universal extractor) - but then it's probably easier to just temporarily move the hitman dll out the way. At the same time - whilst I only did FMS (so 6 workstations) and stopped before doing sims to 600 - presumably in the case of sims, it's not a complete disaster for existing workstations as they only run a single workstation upgrade - so I expect the upgrade happens, the process never terminates so it never reports back but to the user sims works? - with the problem area being a) FMS - which pushes out the SQL native client before the workstation setup each time b) if you run intercept x on a server where you might have multiple packages to install.

In terms of this issue, I've reached the conclusion that it's wider than just capita/sims/solus, and have supplied Sophos with non-capita files that exhibit exactly the same behaviour today. Whilst i'm definitely at about my limit, I'm starting to come to the conclusion that these legacy ( could have a nice debate on that with capita) files seems to be trying to exit, calling RtlExitUserProcess - which tries to call NtTerminateProcess and at some point in that chain that never happens - as a challenge was trying to have a look at that under a debugger for some fun but have given up now. In any case, would need a friend to poke around who understands assembly language more to actually see whether i'm right there - and i'm not sure i'm that keen In any case, having found non-capita files that behave the same way, i'm happy that it's definitely not a problem on Capita's side (that was pretty obvious though). Now.. I mentioned the word 'legacy'... wise installer... that got bought out by symantec... MSI files came along... symantec end of life'd the product in 2013 the internet suggests... pretty sure there's an edugeek thread somewhere on "why dont capita use MSIs" - whilst I think I can understand not using msi's... if i'm indeed correct about how old it is - using 5-10 year logic for an installer is just a problem waiting to happen?

Probably the quickest way to get around this is to rename the hmpalert.dll in c:\windows\system32 and c:\windows\syswow64, run the update and rename the files back when done

If it's a certificate saying "trust capita's 2012 digital signing certificate" that would cover anything signed by them - I'm thinking Applocker behaviour

As a side note, looking at the release notes of the preview version of intercept X (Although i've not tried it yet) - I'd be interested to know if that works - as I believe they are adding a new "allowed applications" policy - that seems to suggest it will check again a hash/certificate of the application. @thatley you've probably seen already but they posted a KB article on the hyper-v issue on the 10th @ https://community.sophos.com/kb/en-us/127797

In the case i've got open they seemed to suggest that it should be possible to add an exclusion: "Hitman pro did detect this but did not stop the application. From Sophos Central Dashboard go to Global Settings Under General Click on Exploit Mitigation Exclusions...." Although I know that doesn't work so bounced it back to the engineer within about 5 minutes of the suggestion

My issue with that is support then bounce it back as being unsupported. I customised the .bat file previously to fix some an issue we were having and support refused to escalate a case as we'd modified the file.

I've had a case open with the helpdesk for a while regarding solus not sending out an update after an initial install of the agent - if the agent already has a record in the database. i.e. it's a reinstall. However, note, we use the .bat file from sims (if you hit export agent installer in the software) and the predefined targets functionality in 3.12 to do the initial install. (IMO this should be easiest method as it can be added to a task sequence in mdt for a zero touch install - once capita fix the "deployment on a reinstall" bug). Would really appreciate it if anyone is trying to do exactly the same as that to know - as capita seem to think i'm the only person trying to do this sort of thing ;/

I seem to recall that the GDPR defines data controllers and data processors as a role - then says DPO checks strategy and compliance (for large companies). Presumably the proposal is that schools would only need to define data controllers/processors, and to ensure they are looking after personal data as per the act - but not appoint a designated DPO. Having a DPO in a every school (especially small primary schools) is probably overkill. And if every DPO contacted capita to ask their own questions to ensure they are happy with how capita cover the GDPR - that's 11,000 conversations - that doesn't really make that much sense either. Presumably you'd move to a model where an academy trust appointed a single DPO and an state schools were covered by the LA's DPO.

@rrafluap / @Esteban_Child_of_the_Sun: From my experience, I've found two things a) the helpdesk won't support custom scripts being used for deploying solus 3 if you then log issues with solus 3 b) the behaviour in solus 3.12 for the predefined target / manual installs doesn't work properly if you reinstall a workstation

@Chriss31 / @dapaulio - What method do you use to install the agent ? i.e. are you pushing the agent out from solus - or grabbing the installer and deploying that and letting the agent connect to solus in the first instance?

At the same time - sims have been replying to support cases they do not support .net 4.7. To quote from a support case on the 12th October: "Please be aware that despite .net 4.7 being deployed alongside Windows 10, we cannot offer support for that version of .net framework at this time. Work is being done around getting around this as it's caused numerous issues with several aspects of our products, not just Solus. If you can test this on a non .net 4.7 machine then we can progress this, if this isn't possible then we cannot do much more on this issue as officially it is not supported, therefore I cannot pass this to our 3rd line."

You need the policies in place to store the key in AD before you enable bitlocker - so might be GPO's not kicking in int ime.