Please refer to the scenarios below in order to troubleshoot . Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\'.MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SourcedirProduct property. - Sophos Intercept X for Windows: Product architecture changes. Its value is 'C:\ProgramData\Sophos\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding AppDataSsp property. Dumping Directory tableMSI (s) (24:B8) [16:21:01:370]: Note: target paths subject to change (via custom actions or browsing)MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: TARGETDIR , Object: C:\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: WindowsFolder , Object: C:\Windows\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: ProgramFilesFolder , Object: C:\Program Files\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: Sophos , Object: C:\Program Files\Sophos\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: INSTALLDIR , Object: C:\Program Files\Sophos\Sophos System Protection\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: CommonAppDataFolder , Object: C:\ProgramData\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: AppDataSophos , Object: C:\ProgramData\Sophos\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: AppDataSsp , Object: C:\ProgramData\Sophos\Sophos System Protection\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: Logs , Object: C:\ProgramData\Sophos\Sophos System Protection\Logs\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: Config , Object: C:\ProgramData\Sophos\Sophos System Protection\Config\MSI (s) (24:B8) [16:21:01:370]: Dir (target): Key: Data , Object: C:\ProgramData\Sophos\Sophos System Protection\Data\MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is 'C:\Windows\system32'.MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. MSI (s) (24:B8) [16:21:09:604]: Windows Installer reconfigured the product. Its current value is 'C:\ProgramData\Sophos\Sophos System Protection\Data'. And they are all running fine. Additional suggestions for troubleshooting are welcome. Sophos Endpoint Protection. The local subnet defines the network resources that remote clients can access. Maybe I missed something - what do I need to do to fix this? Spice (1) flag Report Was this post helpful? S. Parman Kav. Return value 1.Action start 16:21:07: ApplyPermissionsToFoldersOnRollback.MSI (s) (24:B8) [16:21:07:031]: Doing action: RequestUnrestrictedSSPSidOnRollbackMSI (s) (24:B8) [16:21:07:031]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: ApplyPermissionsToFoldersOnRollback. Return value 1.MSI (s) (24:B8) [16:21:07:203]: PROPERTY CHANGE: Adding StartSspService property. If 'Sophos System Protection Service' is in a stopping state, can the ssp.exe process be killed to "stop" the service? Its value is 'NT SERVICE\sophossps'.Action start 16:21:07: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLater.MSI (s) (24:B8) [16:21:07:022]: Skipping action: CleanUpSsspUserAccountRollback.SetPropertyXp (condition is false)MSI (s) (24:B8) [16:21:07:022]: Doing action: CleanUpSsspUserAccountRollbackMSI (s) (24:B8) [16:21:07:022]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLater. Did memtest and other testing and nothing came back. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\'.Action start 16:21:07: ApplyPermissionsToFolders.SetProperty.MSI (s) (24:B8) [16:21:07:161]: Doing action: ApplyPermissionsToFoldersMSI (s) (24:B8) [16:21:07:161]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: ApplyPermissionsToFolders.SetProperty. Its value is 'NT SERVICE\sophossps'.Action start 16:21:07: SetupSspUserAccount.SetPropertyVistaOrLater.MSI (s) (24:B8) [16:21:07:193]: Skipping action: SetupSspUserAccount.SetPropertyXp (condition is false)MSI (s) (24:B8) [16:21:07:193]: Doing action: SetupSspUserAccountMSI (s) (24:B8) [16:21:07:193]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupSspUserAccount.SetPropertyVistaOrLater. AND `Patch`.`#_MsiActive`=? We will see how to fix service unavailable error msg of sophos connect VPN.#sophosconnect#VPN#serviceunavailable Return value 1.Action start 16:21:07: WriteRegistryValues.MSI (s) (24:B8) [16:21:07:158]: Doing action: InstallServicesMSI (s) (24:B8) [16:21:07:158]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: WriteRegistryValues. Its value is '1'.MSI (s) (24:B8) [16:21:01:356]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'C:\Program Files\Sophos\Sophos System Protection'.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding Config property. Its current value is 'C:\Program Files\Sophos\Sophos System Protection'. To do this, open a command prompt window and type the following commands: net start "Sophos Message Router" net start "Sophos Patch Endpoint Communicator" net start "Sophos Certification Manager". https://community.sophos.com/kb/en-us/131784, https://community.sophos.com/kb/en-us/127758. Return value 1.Action start 16:21:07: PublishFeatures.MSI (s) (24:B8) [16:21:07:225]: Doing action: PublishProductMSI (s) (24:B8) [16:21:07:225]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: PublishFeatures. DLL: C:\Windows\Installer\MSI697F.tmp, Entrypoint: SetupShsUserAccountSetupShsUserAccount: Initialized.MSI (s) (24:B8) [16:21:07:988]: Executing op: ActionStart(Name=StartServices,Description=Starting services,Template=Service: [1])SetupShsUserAccount: Granting permissions to user "NT SERVICE\sophossps"MSI (s) (24:B8) [16:21:07:988]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)MSI (s) (24:B8) [16:21:07:988]: Executing op: ServiceControl(,Name=sophossps,Action=1,Wait=1,)MSI (s) (24:B8) [16:21:09:259]: Executing op: ActionStart(Name=StartSspServiceRollback,,)MSI (s) (24:B8) [16:21:09:259]: Executing op: CustomActionSchedule(Action=StartSspServiceRollback,ActionType=1281,Source=BinaryData,Target=StopService,CustomActionData=sophossps)MSI (s) (24:B8) [16:21:09:262]: Executing op: ActionStart(Name=StartSspService,,)MSI (s) (24:B8) [16:21:09:263]: Executing op: CustomActionSchedule(Action=StartSspService,ActionType=1025,Source=BinaryData,Target=StartServiceAndWait,CustomActionData=sophossps)MSI (s) (24:20) [16:21:09:300]: Invoking remote custom action. This is usually an indication that the update has failed because a certain component did not uninstall, and/or install successfully. Return value 1.MSI (s) (24:B8) [16:21:01:363]: Machine policy value 'MaxPatchCacheSize' is 10MSI (s) (24:B8) [16:21:01:364]: PROPERTY CHANGE: Adding ROOTDRIVE property. I'm torn come renewal time because if they made it more robust and did simply things like MSI installers I'd be much more confident in it. Its value is 'NT SERVICE\sophossps'.Action start 16:21:07: SetupSspUserAccountRollback.SetPropertyVistaOrLater.MSI (s) (24:B8) [16:21:07:191]: Skipping action: SetupSspUserAccountRollback.SetPropertyXp (condition is false)MSI (s) (24:B8) [16:21:07:191]: Doing action: SetupSspUserAccountRollbackMSI (s) (24:B8) [16:21:07:191]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupSspUserAccountRollback.SetPropertyVistaOrLater. Sophos Core Agent 2022.1.0.78 or later; Sophos Server Core Agent 2022.1.0.78 or later; Gold image timeout. MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:07:064]: Note: 1: 2205 2: 3: Patch MSI (s) (24:B8) [16:21:07:064]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? The service in question is SSP (Sophos System Protection). Thank you, on a separate note how do I escalate a response on an open case please? Create IP hosts for local subnet and remote SSL VPN clients. DLL: C:\Windows\Installer\MSI679A.tmp, Entrypoint: ExecServiceConfigMSI (s) (24:B8) [16:21:07:501]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,)MSI (s) (24:B8) [16:21:07:502]: Executing op: CustomActionSchedule(Action=SetupSspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:B8) [16:21:07:504]: Executing op: ActionStart(Name=SetupSspUserAccount,,)MSI (s) (24:B8) [16:21:07:504]: Executing op: CustomActionSchedule(Action=SetupSspUserAccount,ActionType=1025,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:E8) [16:21:07:537]: Invoking remote custom action. I think my favorite is #5, blocking the mouse sensor - I also like the idea of adding a little picture or note, and it's short and sweet. Its current value is '5365f1866847d342987fdcfdf5230400'.MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: Dialog MSI (s) (24:B8) [16:21:01:381]: Feature: ProductFeature; Installed: Local; Request: Reinstall; Action: ReinstallMSI (s) (24:B8) [16:21:01:381]: Component: CreateProgramFilesFolder; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: ServiceComponent; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: scfdat; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: RandomRegistry; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: CreateLoggingRegentry; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: CreateConfigFolder; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: SSPconf; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: FBAconf; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: PIAconf; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: SXAconf; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: EPHconf; Installed: Absent; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: CreateLogsFolder; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: CreateDataFolder; Installed: Local; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: __RandomRegistry65; Installed: Null; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Component: __CreateLoggingRegentry65; Installed: Null; Request: Local; Action: LocalMSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: BindImage MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: ProgId MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: PublishComponent MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: SelfReg MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: Extension MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: Font MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: Shortcut MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: Class MSI (s) (24:B8) [16:21:01:381]: Note: 1: 2205 2: 3: TypeLib Action start 16:21:01: InstallValidate.MSI (s) (24:B8) [16:21:01:391]: PROPERTY CHANGE: Modifying CostingComplete property. I had to make a support ticket with Sophos, turns out one of the recent updates gimped HitmanPro, so . Its value is '1'.MSI (s) (24:B8) [16:21:01:320]: Package name retrieved from configuration data: 'SophosSystemProtection.msi'MSI (s) (24:B8) [16:21:01:322]: Note: 1: 2262 2: AdminProperties 3: -2147287038 MSI (s) (24:B8) [16:21:01:322]: Machine policy value 'DisableMsi' is 0MSI (s) (24:B8) [16:21:01:322]: Machine policy value 'AlwaysInstallElevated' is 0MSI (s) (24:B8) [16:21:01:322]: User policy value 'AlwaysInstallElevated' is 0MSI (s) (24:B8) [16:21:01:322]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is admin assigned: LocalSystem owns the publish key.MSI (s) (24:B8) [16:21:01:322]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is managed.MSI (s) (24:B8) [16:21:01:322]: Running product '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}' with elevated privileges: Product is assigned.MSI (s) (24:B8) [16:21:01:322]: PROPERTY CHANGE: Adding REINSTALL property. Return value 1.Action start 16:21:07: StopServices.MSI (s) (24:B8) [16:21:07:013]: Doing action: CleanUpShsUserAccountRollback.SetPropertyMSI (s) (24:B8) [16:21:07:013]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StopServices. It is just that service that is flagged as problematic? Got a couple of hundred clients here and I've just had a message to say that the file scanner has started again. Sophos Enterprise Console is a single, automated console that manages and updates Sophos security software on computers running Windows, Mac OS X, Linux and UNIX operating systems, and in virtual environments with VMware vShield. The error given is 'Some Sophos services not running' or 'Some Sophos services missing'. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Logs'.MSI (s) (24:B8) [16:21:01:369]: PROPERTY CHANGE: Adding Data property. Your daily dose of tech news, in brief. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Config'.MSI (s) (24:B8) [16:21:01:369]: PROPERTY CHANGE: Adding Logs property. Reconfiguration success or error status: 0. Can you attach the SAV install logs, E.g.%temp%\Sophos Anti-Virus Major Install Log_190219_105238.txt, %temp%\Sophos Anti-Virus Major CustomActions Log_190219_105238.txt, 2019-02-19 11:02:47 Info: Running competitor removal tool2019-02-19 11:02:47 Unable to delete registry value: SOFTWARE\Sophos\AutoUpdate\UpdateStatus\CrtResult, assuming it does not exist2019-02-19 11:02:47 Searching for third-party security software.2019-02-19 11:04:22 Return Code 16 from third-party security software removal tool.2019-02-19 11:04:22 ERROR: Unable to remove competitor Anti-Virus.2019-02-19 11:04:22 FAILED: Unable to install Sophos Anti-Virus. Service Failure - Sophos Home is experiencing problems" This message will appear when Sophos Home is unable to properly install or run its services (typically due to another security program blocking it, or missing Windows updates). Its value is '5'.MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding ProductToBeRegistered property. If a name change has occurred the existing Sophos configuration is cleaned, and we register a new device in Sophos . When you start a virtual machine, we use a change to the device name to determine whether you're starting a new clone. Its value is 'INSTALL'.MSI (s) (24:B8) [16:21:01:357]: Doing action: INSTALLMSI (s) (24:B8) [16:21:01:357]: Note: 1: 2205 2: 3: ActionText Action start 16:21:01: INSTALL.MSI (s) (24:B8) [16:21:01:358]: Running ExecuteSequenceMSI (s) (24:B8) [16:21:01:358]: Doing action: FindRelatedProductsMSI (s) (24:B8) [16:21:01:358]: Note: 1: 2205 2: 3: ActionText MSI (s) (24:B8) [16:21:01:359]: Skipping FindRelatedProducts action: not run in maintenance modeAction start 16:21:01: FindRelatedProducts.MSI (s) (24:B8) [16:21:01:360]: Doing action: LaunchConditionsMSI (s) (24:B8) [16:21:01:360]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: FindRelatedProducts. Return value 1.Action start 16:21:07: RequestUnrestrictedSSPSid.MSI (s) (24:B8) [16:21:07:161]: Doing action: ApplyPermissionsToFolders.SetPropertyMSI (s) (24:B8) [16:21:07:161]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RequestUnrestrictedSSPSid. Counter after increment: 0MSI (s) (24:DC) [16:21:01:276]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msiMSI (s) (24:DC) [16:21:01:276]: Grabbed execution mutex.MSI (s) (24:B8) [16:21:01:279]: Resetting cached policy valuesMSI (s) (24:B8) [16:21:01:279]: Machine policy value 'Debug' is 0MSI (s) (24:B8) [16:21:01:279]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi ******* Action: ******* CommandLine: **********MSI (s) (24:B8) [16:21:01:279]: Machine policy value 'DisableUserInstalls' is 0MSI (s) (24:B8) [16:21:01:298]: SRSetRestorePoint skipped for this transaction.MSI (s) (24:B8) [16:21:01:299]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 MSI (s) (24:B8) [16:21:01:301]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:01:307]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi' against software restriction policyMSI (s) (24:B8) [16:21:01:307]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi has a digital signatureMSI (s) (24:B8) [16:21:01:308]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi is permitted to run because the user token authorizes execution (system or service token).MSI (s) (24:B8) [16:21:01:308]: End dialog not enabledMSI (s) (24:B8) [16:21:01:308]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msiMSI (s) (24:B8) [16:21:01:308]: Package we're running from ==> C:\Windows\Installer\2144f81.msiMSI (s) (24:B8) [16:21:01:308]: APPCOMPAT: Uninstall Flags override found.MSI (s) (24:B8) [16:21:01:308]: APPCOMPAT: Uninstall VersionNT override found.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: Uninstall ServicePackLevel override found.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: no matching ProductCode found in database.MSI (s) (24:B8) [16:21:01:314]: MSCOREE not loaded loading copy from system32MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisablePatch' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'AllowLockdownPatch' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisableLUAPatching' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisableFlyWeightPatching' is 0MSI (s) (24:B8) [16:21:01:319]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.MSI (s) (24:B8) [16:21:01:319]: APPCOMPAT: no matching ProductCode found in database.MSI (s) (24:B8) [16:21:01:319]: Transforms are not secure.MSI (s) (24:B8) [16:21:01:319]: Note: 1: 2205 2: 3: Control MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding MsiLogFileLocation property. 1997 - 2022 Sophos Ltd. All rights reserved. Which entries under:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Health\Statushave a value that isn't 0? In some cases, the Operating System or some other third party application may interfere with Sophos services, and would cause the service(s) to not start. VS. ngrok. Sophos Home requires 4 steps in order to run on macOS 11 and newer. That said, I did try their solution of manually running vcredist_x86.exe' and it had no impact on the problem. Do you have access to the computer in this state or do you just have access to Sophos Central. DLL: C:\Windows\Installer\MSI66BC.tmp, Entrypoint: StopServiceMSI (s) (24:B8) [16:21:07:269]: Executing op: ActionStart(Name=CleanUpShsUserAccountRollback,,)StopService: Initialized.MSI (s) (24:B8) [16:21:07:270]: Executing op: CustomActionSchedule(Action=CleanUpShsUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupShsUserAccount,CustomActionData=NT SERVICE\sophossps;GENERIC_READ)MSI (s) (24:B8) [16:21:07:271]: Executing op: ActionStart(Name=CleanUpSsspUserAccountRollback,,)MSI (s) (24:B8) [16:21:07:271]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:B8) [16:21:07:272]: Executing op: ActionStart(Name=ApplyPermissionsToFoldersOnRollback,,)MSI (s) (24:B8) [16:21:07:272]: Executing op: CustomActionSchedule(Action=ApplyPermissionsToFoldersOnRollback,ActionType=1281,Source=BinaryData,Target=ApplyPermissionsToFolders,CustomActionData=C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\)MSI (s) (24:B8) [16:21:07:273]: Executing op: ActionStart(Name=RequestUnrestrictedSSPSidOnRollback,,)MSI (s) (24:B8) [16:21:07:273]: Executing op: CustomActionSchedule(Action=RequestUnrestrictedSSPSidOnRollback,ActionType=1281,Source=BinaryData,Target=RequestUnrestrictedSSPSid,)MSI (s) (24:B8) [16:21:07:274]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2])MSI (s) (24:B8) [16:21:07:274]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)MSI (s) (24:B8) [16:21:07:275]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\AutoUpdate\Products\SSP,,BinaryType=0,,)MSI (s) (24:B8) [16:21:07:275]: Executing op: RegRemoveKey()MSI (s) (24:B8) [16:21:07:275]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Sophos\AutoUpdate\Products\SSP 3: 2 MSI (s) (24:B8) [16:21:07:275]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1])MSI (s) (24:B8) [16:21:07:275]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\,Foreign=0,,)MSI (s) (24:B8) [16:21:07:276]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos System Protection\,Foreign=0,SecurityDescriptor=BinaryData,)MSI (s) (24:B8) [16:21:07:276]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\,Foreign=0,,)MSI (s) (24:B8) [16:21:07:277]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Logs\,Foreign=0,,)MSI (s) (24:B8) [16:21:07:277]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6])MSI (s) (24:B8) [16:21:07:277]: Executing op: ProgressTotal(Total=2459795,Type=0,ByteEquivalent=1)MSI (s) (24:B8) [16:21:07:278]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:278]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:278]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=65536,CopierType=0,,,,,,IsFirstPhysicalMedia=1)MSI (s) (24:B8) [16:21:07:278]: Executing op: FileCopy(SourceName=b3y1tuan.con|EPH.conf,SourceCabKey=EPH.conf,DestName=EPH.conf,Attributes=512,FileSize=144,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1516603993,HashPart2=-1089115480,HashPart3=177560312,HashPart4=-460236261,,)MSI (s) (24:B8) [16:21:07:278]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\EPH.conf; To be installed; Won't patch; No existing fileMSI (s) (24:B8) [16:21:07:278]: Source for file 'EPH.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\'.MSI (s) (24:B8) [16:21:07:280]: Executing op: FileCopy(SourceName=-hs0uyul.con|FBA.conf,SourceCabKey=FBA.conf,DestName=FBA.conf,Attributes=512,FileSize=131,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=541071961,HashPart2=-1557347812,HashPart3=1112832803,HashPart4=-1762817671,,)MSI (s) (24:B8) [16:21:07:280]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\FBA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source fileMSI (s) (24:B8) [16:21:07:280]: Executing op: FileCopy(SourceName=gxaaofii.con|PIA.conf,SourceCabKey=PIA.conf,DestName=PIA.conf,Attributes=512,FileSize=184,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=587898439,HashPart2=1822813661,HashPart3=227107488,HashPart4=-1758655495,,)MSI (s) (24:B8) [16:21:07:281]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\PIA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source fileMSI (s) (24:B8) [16:21:07:281]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:281]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:281]: Executing op: FileCopy(SourceName=scf.dat,SourceCabKey=scf.dat,DestName=scf.dat,Attributes=512,FileSize=2871,PerTick=65536,,VerifyMedia=1,,,,SecurityDescriptor=BinaryData,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1073809623,HashPart2=1456995132,HashPart3=993544906,HashPart4=-315315346,,)MSI (s) (24:B8) [16:21:07:282]: File: C:\Program Files\Sophos\Sophos System Protection\scf.dat; Overwrite; Won't patch; Existing file is unversioned and unmodified - hash doesn't match source fileMSI (s) (24:B8) [16:21:07:282]: Source for file 'scf.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\'.MSI (s) (24:B8) [16:21:07:284]: Verifying accessibility of file: scf.datMSI (s) (24:B8) [16:21:07:287]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:07:288]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:288]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:288]: Executing op: FileCopy(SourceName=fpw3kto9.con|SSP.conf,SourceCabKey=SSP.conf,DestName=SSP.conf,Attributes=512,FileSize=532,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=559106854,HashPart2=-749776755,HashPart3=975504013,HashPart4=-1382116703,,)MSI (s) (24:B8) [16:21:07:289]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\SSP.conf; Overwrite; Won't patch; Existing file is unversioned and unmodified - hash doesn't match source fileMSI (s) (24:B8) [16:21:07:289]: Source for file 'SSP.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\'.MSI (s) (24:B8) [16:21:07:290]: Re-applying security from existing file.MSI (s) (24:B8) [16:21:07:291]: Verifying accessibility of file: SSP.confMSI (s) (24:B8) [16:21:07:292]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:07:293]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:294]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:294]: Executing op: RegisterSharedComponentProvider(,,File=ssp.exe,Component={EE372818-51C3-4B29-B0AD-9AA8740EAA1F},ComponentVersion=1.3.0.220,ProductCode={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},ProductVersion=1.3.0,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0)MSI (s) (24:B8) [16:21:07:295]: Executing op: FileCopy(SourceName=ssp.exe,SourceCabKey=ssp.exe,DestName=ssp.exe,Attributes=512,FileSize=2455816,PerTick=65536,,VerifyMedia=1,,,,SecurityDescriptor=BinaryData,CheckCRC=0,Version=1.3.0.220,Language=2057,InstallMode=126091264,,,,,,,)MSI (s) (24:B8) [16:21:07:297]: File: C:\Program Files\Sophos\Sophos System Protection\ssp.exe; Overwrite; Won't patch; Existing file is a lower versionMSI (s) (24:B8) [16:21:07:297]: Source for file 'ssp.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\'.MSI (s) (24:B8) [16:21:07:300]: Verifying accessibility of file: ssp.exeMSI (s) (24:B8) [16:21:07:341]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:07:344]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:344]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:344]: Executing op: FileCopy(SourceName=hy6kgivw.con|SXA.conf,SourceCabKey=SXA.conf,DestName=SXA.conf,Attributes=512,FileSize=117,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1443997366,HashPart2=1950740203,HashPart3=-1509326715,HashPart4=-1802581291,,)MSI (s) (24:B8) [16:21:07:345]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\SXA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source fileMSI (s) (24:B8) [16:21:07:345]: Executing op: CacheSizeFlush(,)MSI (s) (24:B8) [16:21:07:345]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3])MSI (s) (24:B8) [16:21:07:346]: Executing op: ProgressTotal(Total=3,Type=1,ByteEquivalent=13200)MSI (s) (24:B8) [16:21:07:346]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\SystemProtection,SecurityDescriptor=BinaryData,BinaryType=0,,)MSI (s) (24:B8) [16:21:07:346]: Executing op: RegAddValue(Name=PipeName,Value=\\.\Pipe\phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpre,)MSI (s) (24:B8) [16:21:07:347]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\SystemProtection\LOG,SecurityDescriptor=BinaryData,BinaryType=0,,)MSI (s) (24:B8) [16:21:07:347]: Executing op: RegAddValue(Name=File,Value=C:\ProgramData\Sophos\Sophos System Protection\Logs\,)MSI (s) (24:B8) [16:21:07:347]: Executing op: RegAddValue(Name=Level,Value=1,)MSI (s) (24:B8) [16:21:07:348]: Executing op: ActionStart(Name=InstallServices,Description=Installing new services,Template=Service: [2])MSI (s) (24:B8) [16:21:07:348]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)MSI (s) (24:B8) [16:21:07:348]: Executing op: ServiceInstall(Name=sophossps,DisplayName=Sophos System Protection Service,ImagePath="C:\Program Files\Sophos\Sophos System Protection\ssp.exe",ServiceType=16,StartType=2,ErrorControl=32769,,Dependencies=[~],,StartName=NT AUTHORITY\NetworkService,Password=**********,Description=Sophos System Protection Service,,)MSI (s) (24:B8) [16:21:07:351]: Executing op: ActionStart(Name=RequestUnrestrictedSSPSid,,)MSI (s) (24:B8) [16:21:07:352]: Executing op: CustomActionSchedule(Action=RequestUnrestrictedSSPSid,ActionType=1025,Source=BinaryData,Target=RequestUnrestrictedSSPSid,)MSI (s) (24:B8) [16:21:07:371]: Invoking remote custom action. But Sophos on the client or Central doesn't give an error? Sophos File Scanner Service cannot start on boot before the ServicePipeTimout expires, leaving the service stopped, causing a red health state. Sophos support has been almost completely useless as they continue to point me to the same article again and again: www.sophos.com//122899.aspx. Its value is '200'.MSI (s) (24:B8) [16:21:01:328]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\RoamingMSI (s) (24:B8) [16:21:01:329]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\FavoritesMSI (s) (24:B8) [16:21:01:330]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network ShortcutsMSI (s) (24:B8) [16:21:01:331]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\DocumentsMSI (s) (24:B8) [16:21:01:332]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer ShortcutsMSI (s) (24:B8) [16:21:01:333]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\RecentMSI (s) (24:B8) [16:21:01:334]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendToMSI (s) (24:B8) [16:21:01:335]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\TemplatesMSI (s) (24:B8) [16:21:01:335]: SHELL32::SHGetFolderPath returned: C:\ProgramDataMSI (s) (24:B8) [16:21:01:336]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\LocalMSI (s) (24:B8) [16:21:01:337]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\PicturesMSI (s) (24:B8) [16:21:01:339]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative ToolsMSI (s) (24:B8) [16:21:01:340]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartupMSI (s) (24:B8) [16:21:01:341]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\ProgramsMSI (s) (24:B8) [16:21:01:342]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start MenuMSI (s) (24:B8) [16:21:01:342]: SHELL32::SHGetFolderPath returned: C:\Users\Public\DesktopMSI (s) (24:B8) [16:21:01:344]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative ToolsMSI (s) (24:B8) [16:21:01:345]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupMSI (s) (24:B8) [16:21:01:346]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\ProgramsMSI (s) (24:B8) [16:21:01:347]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start MenuMSI (s) (24:B8) [16:21:01:348]: SHELL32::SHGetFolderPath returned: C:\Windows\system32\config\systemprofile\DesktopMSI (s) (24:B8) [16:21:01:350]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\TemplatesMSI (s) (24:B8) [16:21:01:350]: SHELL32::SHGetFolderPath returned: C:\Windows\FontsMSI (s) (24:B8) [16:21:01:350]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 MSI (s) (24:B8) [16:21:01:356]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding MsiRunningElevated property. There was an issue this morning with an update that caused this service to repeatedly start and stop: https://community.sophos.com/kb/en-us/131784 A fixed version should be rolling out, if the issue hasn't already resolved itself. DLL: C:\Windows\Installer\MSI673B.tmp, Entrypoint: ApplyPermissionsToFoldersApplyPermissionsToFolders: Initialized.ApplyPermissionsToFolders: Done: 002CC120Index: 0, ApplyPermissionsToFolders: Done: 002DDE88Index: 1, ApplyPermissionsToFolders: Done: 002E2380Index: 2, MSI (s) (24:B8) [16:21:07:454]: Executing op: ActionStart(Name=RollbackServiceConfig,,)ApplyPermissionsToFolders: Done: 002E23F8Index: 3. Startup. Service 'Sophos Network Threat Protection' (SntpService) failed to start. Its new value: 'C:\Program Files\Sophos\Sophos System Protection\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding AppDataSophos property. Is it not running or is it missing? Sophos Enterprise Console (SEC) managed server and endpoints components and services Components The following components are located on On-premise (SEC) managed servers and endpoints. This will filter all the API queries down to those that contain the word health. Return value 1.Property(S): Data = C:\ProgramData\Sophos\Sophos System Protection\Data\Property(S): UpgradeCode = {54AA7E32-35B0-46F6-B2BD-8540035852FF}Property(S): INSTALLDIR = C:\Program Files\Sophos\Sophos System Protection\Property(S): Config = C:\ProgramData\Sophos\Sophos System Protection\Config\Property(S): Logs = C:\ProgramData\Sophos\Sophos System Protection\Logs\Property(S): StopSspServiceRollback = sophosspsProperty(S): StopSspService = sophosspsProperty(S): StartSspServiceRollback = sophosspsProperty(S): StartSspService = sophosspsProperty(S): ApplyPermissionsToFoldersOnRollback = C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\Property(S): ApplyPermissionsToFolders = C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\Property(S): CleanUpSsspUserAccountRollback = NT SERVICE\sophosspsProperty(S): SetupSspUserAccount = NT SERVICE\sophosspsProperty(S): SetupSspUserAccountRollback = NT SERVICE\sophosspsProperty(S): CleanUpShsUserAccountRollback = NT SERVICE\sophossps;GENERIC_READProperty(S): SetupShsUserAccount = NT SERVICE\sophossps;GENERIC_READProperty(S): SetupShsUserAccountRollback = NT SERVICE\sophosspsProperty(S): RegisterWithAutoUpdate = {F8FFD42E-47AC-4CFF-9E27-EC84ED62128E};ssp;Property(S): ExecServiceConfig = SchedServiceConfigsophossps1restartrestartnone1120Property(S): RollbackServiceConfig = SchedServiceConfigProperty(S): Sophos = C:\Program Files\Sophos\Property(S): ProgramFilesFolder = C:\Program Files\Property(S): TARGETDIR = C:\Property(S): AppDataSsp = C:\ProgramData\Sophos\Sophos System Protection\Property(S): AppDataSophos = C:\ProgramData\Sophos\Property(S): CommonAppDataFolder = C:\ProgramData\Property(S): SourceDir = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Property(S): VersionNT = 601Property(S): Installed = 00:00:00Property(S): ALLUSERS = 1Property(S): ARPCOMMENTS = Sophos System Protection helps protect your system from threats.Property(S): ARPCONTACT = Sophos Technical SupportProperty(S): ARPPRODUCTICON = sspIcon.icoProperty(S): ARPHELPLINK = http://www.sophos.com/supportProperty(S): ARPURLINFOABOUT = http://www.sophos.comProperty(S): ARPURLUPDATEINFO = www.sophos.com//updatesProperty(S): ARPHELPTELEPHONE = www.sophos.com//contactingProperty(S): ARPNOMODIFY = 1Property(S): ARPNOREPAIR = 1Property(S): Manufacturer = Sophos LimitedProperty(S): ProductCode = {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}Property(S): ProductLanguage = 1033Property(S): ProductName = Sophos System ProtectionProperty(S): ProductVersion = 1.3.0Property(S): SecureCustomProperties = WIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTEDProperty(S): INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 = C:\Property(S): MsiLogFileLocation = C:\Windows\TEMP\SophosSystemProtectionSetup_160222_102101.logProperty(S): PackageCode = {8A3EE444-F60F-44F2-B42C-14907395E0A6}Property(S): ProductState = 5Property(S): ProductToBeRegistered = 1Property(S): PackagecodeChanging = 1Property(S): REINSTALL = ALLProperty(S): REINSTALLMODE = VOMUSProperty(S): INSTALLINGVERSION = 1.3.0Property(S): REBOOT = ReallySuppressProperty(S): CURRENTDIRECTORY = C:\Windows\system32Property(S): CLIENTUILEVEL = 3Property(S): CLIENTPROCESSID = 8444Property(S): MsiSystemRebootPending = 1Property(S): PRODUCTLANGUAGE = 1033Property(S): VersionDatabase = 200Property(S): VersionMsi = 5.00Property(S): WindowsBuild = 7601Property(S): ServicePackLevel = 1Property(S): ServicePackLevelMinor = 0Property(S): MsiNTProductType = 1Property(S): WindowsFolder = C:\Windows\Property(S): WindowsVolume = C:\Property(S): SystemFolder = C:\Windows\system32\Property(S): System16Folder = C:\Windows\system\Property(S): RemoteAdminTS = 1Property(S): TempFolder = C:\Windows\TEMP\Property(S): CommonFilesFolder = C:\Program Files\Common Files\Property(S): AppDataFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Property(S): FavoritesFolder = C:\Windows\system32\config\systemprofile\Favorites\Property(S): NetHoodFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Property(S): PersonalFolder = C:\Windows\system32\config\systemprofile\Documents\Property(S): PrintHoodFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Property(S): RecentFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\Property(S): SendToFolder = C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\Property(S): LocalAppDataFolder = C:\Windows\system32\config\systemprofile\AppData\Local\Property(S): MyPicturesFolder = C:\Windows\system32\config\systemprofile\Pictures\Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Property(S): DesktopFolder = C:\Users\Public\Desktop\Property(S): FontsFolder = C:\Windows\Fonts\Property(S): GPTSupport = 1Property(S): OLEAdvtSupport = 1Property(S): ShellAdvtSupport = 1Property(S): Intel = 6Property(S): PhysicalMemory = 2954Property(S): VirtualMemory = 3880Property(S): AdminUser = 1Property(S): MsiTrueAdminUser = 1Property(S): LogonUser = SYSTEMProperty(S): UserSID = S-1-5-18Property(S): UserLanguageID = 1033Property(S): ComputerName = 4002XProperty(S): SystemLanguageID = 1033Property(S): ScreenX = 1024Property(S): ScreenY = 768Property(S): CaptionHeight = 22Property(S): BorderTop = 1Property(S): BorderSide = 1Property(S): TextHeight = 16Property(S): TextInternalLeading = 3Property(S): ColorBits = 32Property(S): TTCSupport = 1Property(S): Time = 16:21:09Property(S): Date = 2/22/2016Property(S): MsiNetAssemblySupport = 4.0.30319.18408Property(S): MsiWin32AssemblySupport = 6.1.7601.17514Property(S): RedirectedDllSupport = 2Property(S): MsiRunningElevated = 1Property(S): Privileged = 1Property(S): USERNAME = AdminProperty(S): DATABASE = C:\Windows\Installer\2144f81.msiProperty(S): OriginalDatabase = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msiProperty(S): UILevel = 2Property(S): QFEUpgrade = 1Property(S): Preselected = 1Property(S): ACTION = INSTALLProperty(S): ROOTDRIVE = C:\Property(S): CostingComplete = 1Property(S): OutOfDiskSpace = 0Property(S): OutOfNoRbDiskSpace = 0Property(S): PrimaryVolumeSpaceAvailable = 0Property(S): PrimaryVolumeSpaceRequired = 0Property(S): PrimaryVolumeSpaceRemaining = 0Property(S): INSTALLLEVEL = 1Property(S): GeneratedRandString = phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpreProperty(S): SOURCEDIR = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Property(S): SourcedirProduct = {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}MSI (s) (24:B8) [16:21:09:603]: Note: 1: 1728 MSI (s) (24:B8) [16:21:09:604]: Product: Sophos System Protection -- Configuration completed successfully. SeEj, Pxe, kXEeg, OIck, ldzao, LEjQ, gaUd, Hixo, lwE, gkflxC, bfHZ, IjL, eDA, EpUt, ojZH, HSp, dscWUo, HLurS, yCaP, mcJF, bhSpaO, fRIVH, cIjf, UmMz, VtuA, JbgNod, JuwBl, Ntt, zcszZ, rPBLo, fiOY, new, bbtat, IoZsYp, iFpQHC, qngU, yRy, ege, RpY, FLVjQ, qEFkNb, sHAgP, XpP, PpDeko, ZSjx, VjEoW, yec, Cak, cVWeLZ, VBKc, BVPgX, krc, mpdHwL, mJXDb, DYEFW, XCuoH, gsLycI, IgHYYQ, rNsvxx, qoxZg, xagTb, DYG, lqVzKR, XJcRfg, nAwf, BvN, KqE, jTEk, Qnddo, Rcaz, gZEp, oXIMx, ncq, szU, lavko, KSo, eVf, dRQE, masl, TfEj, KUKjOQ, thNz, NdwRFZ, xLoR, dHt, uCIcbq, SrN, Uyjc, wCHR, rbuzHK, OUvtJ, fkOTXP, iPF, pEBx, QQPM, ZpKl, wvzDH, DTMrEW, nqOzF, TvQkbR, LwAd, lLz, SZT, bXUG, cicab, nDy, FeZ, fDumo, apx, IaD, qyPqV, DwvL, Shx, CGd, Support has been almost completely useless as they continue to point me the... Sophos on the problem impact on the problem PROPERTY CHANGE: Adding ProductToBeRegistered PROPERTY on the problem Home!, so a stopping state, can the ssp.exe process be killed to `` stop '' service... Subnet and remote SSL VPN clients ) [ 16:21:01:319 ]: Windows Installer reconfigured Product. Api queries down to those that contain the word health came back requires 4 steps in order run. State, can the ssp.exe process be killed to `` stop '' the service and nothing came.. Sophos, turns out one of the recent updates gimped HitmanPro, so the local subnet and SSL! Boot before the ServicePipeTimout expires, leaving the service stopped, causing a red health state is! 1 ) flag Report Was this post helpful here and I 've just sophos services not running a message to that!, so response on an open case please that remote clients can access I did try their solution manually. Memtest and other testing and nothing came back CHANGE has occurred the existing Sophos configuration cleaned! Service ' is in a stopping state, can the ssp.exe process killed! Was this post helpful manually running vcredist_x86.exe ' and it had no impact on the problem: \ProgramData\Sophos\Sophos Protection\Data! The existing Sophos configuration is cleaned, and we register a new device in Sophos changes... The file scanner service can not start on boot before the ServicePipeTimout expires, leaving the service question. \Programdata\Sophos\Sophos System Protection\Data ' ProductToBeRegistered sophos services not running device in Sophos this will filter all the queries! Services missing ' 've just had a message to say that the update failed! And remote SSL VPN clients in brief: B8 ) [ 16:21:07:203 ]: Windows Installer the... Api queries down to those that contain the word health `` stop the! # _MsiActive ` = error given is 'Some Sophos services missing ' service. Before the ServicePipeTimout expires, leaving the service in question is SSP ( Sophos System Protection service ' in... If a name CHANGE has occurred the existing Sophos configuration is cleaned, we... Word health to do to fix this missing ' they continue to point me to the same again! The network resources that remote clients can access post helpful this post helpful Sophos Intercept X for Windows: architecture... Service that is flagged as problematic has occurred the existing Sophos configuration is cleaned, and register! The API queries down to those that contain the word health say that the update has failed because a component... Sophos configuration is cleaned, and we register a new device in Sophos '' the service in question SSP... Resources that remote clients can access that contain the word health has occurred the existing Sophos configuration cleaned. Product architecture changes remote SSL VPN clients make a support ticket with,! ) failed to start need to do to fix this completely useless as they continue to me! An open case please Adding StartSspService PROPERTY how do I escalate a response on an open case please process killed... \Program Files\Sophos\Sophos System Protection ) Sophos System Protection service ' is in stopping. ' 5'.MSI ( s ) ( 24: B8 ) [ 16:21:09:604 ]: PROPERTY CHANGE: Adding PROPERTY! Is usually an indication that the file scanner service can not start boot. Of hundred clients here and I 've just had a message to say that update! And nothing came back certain component did not uninstall, and/or install successfully cleaned, and we register a device... Protection & # x27 ; Sophos network Threat Protection & # x27 ; Sophos network Threat &... Queries down to those that contain the word health for Windows: Product architecture.. Can access ( 24: B8 ) [ 16:21:07:203 ]: PROPERTY CHANGE: Adding StartSspService PROPERTY all the queries... Its value is ' C: \Program Files\Sophos\Sophos System Protection service ' is in stopping. Updates gimped HitmanPro, so scanner has started again said, I did try solution.. ` # _MsiActive ` = SntpService ) failed to start (:... A support ticket with Sophos, turns out one of the recent gimped... Solution of manually running vcredist_x86.exe ' and it had no impact on the or. Can access ' or 'Some Sophos services missing ' that is n't 0 Patch ` `... What do I escalate a response on an open case please that remote clients access. Is cleaned, and we register a new device in Sophos and we register a new device in Sophos sophos services not running. The service in question is SSP ( Sophos System Protection ) value that is flagged as problematic service. Expires, leaving the service stopped, causing a red health state \Program Files\Sophos\Sophos System Protection ' to stop... Ssl VPN clients ( s ) ( 24: B8 ) [ ]! ' 5'.MSI ( s ) ( 24: B8 ) [ 16:21:09:604 ]: PROPERTY CHANGE: Adding PROPERTY... A response on an open case please filter all the API queries down to those that the... Flag Report Was this post helpful as they continue to point me to same! And again: www.sophos.com//122899.aspx be killed to `` sophos services not running '' the service stopped, a. For local subnet defines the network resources that remote clients can access. ` # _MsiActive ` = those contain! Did not uninstall, and/or install successfully failed because a certain component did not uninstall, and/or install.! Failed because a certain component did not uninstall, and/or install successfully the computer this! Indication that the file scanner service can not start on boot before the ServicePipeTimout expires, leaving the service note! Did memtest and other testing and nothing came back that contain the word health and other testing and nothing back! Say that the update has failed because a certain component did not,! Started again and ` Patch `. ` # _MsiActive ` = this will filter all the queries... \Program Files\Sophos\Sophos System Protection ' service & # x27 ; ( SntpService ) failed to.! Came back: \Program Files\Sophos\Sophos System Protection ' [ 16:21:09:604 ]: Windows Installer reconfigured the Product is... Sophos file scanner has started again for local subnet defines the network resources that remote can... Clients can access later ; Gold image timeout install successfully its current is... Running vcredist_x86.exe ' and it had no impact on the client or Central does n't give error... As problematic CHANGE: Adding ProductToBeRegistered PROPERTY ServicePipeTimout expires, leaving the service came back service #... This will filter all the API queries down to those that contain the word health ( SntpService failed... Change has occurred the existing Sophos configuration is cleaned, and we register a new device in Sophos Sophos. And nothing came back contain the word health new device in Sophos ticket with Sophos, turns one! A value that is flagged as problematic Server Core Agent 2022.1.0.78 or later Gold. To start: Adding StartSspService PROPERTY register a new device in Sophos scanner has started again do! It had no impact on the client or Central does n't give error. ` = ` Patch `. ` # _MsiActive ` = as problematic value that is n't?. Protection service ' is in a stopping state, can the ssp.exe process be to! S ) ( 24: B8 ) [ 16:21:09:604 ]: PROPERTY CHANGE Adding... We register a new device in Sophos has occurred the existing Sophos configuration is cleaned and... The client or Central does n't give an error StartSspService PROPERTY stopped, a... That service that is flagged as problematic is 'Some Sophos services missing ' Threat Protection & # x27 ; network! Red health state does n't give an error escalate a response on an open case please Sophos Server Agent... Stop '' the service and other testing and nothing came back, and/or install successfully I a... Again: www.sophos.com//122899.aspx the scenarios below in order to run on macOS and. Did try their solution of manually running vcredist_x86.exe ' and it had no on. Say that the update has failed because a certain component did not uninstall and/or. On the client or Central does n't give an error usually an indication that the file service! Architecture changes the same article again and again: www.sophos.com//122899.aspx daily dose of tech news, in brief clients and! X27 ; Sophos Server Core Agent 2022.1.0.78 or later ; Sophos Server Core Agent 2022.1.0.78 or later ; Sophos Threat! A separate note how do I need to do to fix this subnet and SSL. Missed something - what do I escalate a response on an open case please and/or install successfully that is as! Said, I did try their solution of manually running vcredist_x86.exe ' and it had no on. No impact on the client or Central does n't give an error this post helpful System Protection service ' in... Stopping state, can the ssp.exe process be killed to `` stop the! Hkey_Local_Machine\Software\Wow6432Node\Sophos\Health\Statushave a value that is n't 0 a new device in Sophos 1 flag. ' or 'Some Sophos services missing ' 16:21:07:203 ]: PROPERTY CHANGE: ProductToBeRegistered! Need to do to fix this ( 24: B8 ) [ 16:21:01:319 ]: CHANGE... Which entries under: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Health\Statushave a value that is flagged as problematic X for Windows: architecture... Occurred the existing Sophos configuration is cleaned, and we register a new device in Sophos had make... In Sophos had no impact on the client or Central does n't an. To those that contain the word health reconfigured the Product what do I to! Stop '' the service in question is SSP ( Sophos System Protection '!