Net stop scvpn. Its installation always fail. Beloware possibletroubleshooting steps (and KB articles for reference) to take when you see an alert in Sophos Central that says"One or more Sophos services are missing or not running" for machines running Sophos Central Endpoint. Product and Environment Sophos Endpoint Self Help Tool Related information Did memtest and other testing and nothing came back. To troubleshoot authentication, you will typically need access to both Sophos Firewall and the authentication server as well as a client device that is failing authentication. If counter >= 0, shutdown will be denied. Return value 1.Action start 16:21:07: RemoveFiles.MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupData.SetProperty (condition is false)MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupData (condition is false)MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupLogs.SetProperty (condition is false)MSI (s) (24:B8) [16:21:07:046]: Skipping action: CleanupLogs (condition is false)MSI (s) (24:B8) [16:21:07:046]: Doing action: RemoveFoldersMSI (s) (24:B8) [16:21:07:046]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RemoveFiles. EcholoN. It only affected servers, and to correct, I manually used update in central which seemed to clear it up. I also analyzed the dump file and showed something along the lines of corrupted memory. Its value is 'sophossps'.Action start 16:21:06: StopSspServiceRollback.SetProperty.MSI (s) (24:B8) [16:21:06:998]: Doing action: StopSspServiceRollbackMSI (s) (24:B8) [16:21:06:998]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: StopSspServiceRollback.SetProperty. To perform the troubleshooting steps in this article: Sophos Tamper Protection must be turned off, or the password is known. I am waiting for Sophos' 2nd line support engineer reply. In some cases, the Operating System or some other third party application may interfere with Sophos services, and would cause the service(s) to not start. Check the install (or uninstall files) files for error codes. Its value is '0'.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Sometimes, after installing Sophos Endpoint on a machine, some Sophos services requiring system-level access to detect and clean threats do not get granted automatically. Return value 0.Action start 16:21:01: LaunchConditions.MSI (s) (24:B8) [16:21:01:361]: Doing action: ValidateProductIDMSI (s) (24:B8) [16:21:01:361]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: LaunchConditions. I have tried un-install and re-install, remove update cache then update. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying Logs property. Its value is '1'.MSI (s) (24:B8) [16:21:01:356]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding USERNAME property. Got a couple of hundred clients here and I've just had a message to say that the file scanner has started again. Sophos Lockdown Service is stopped Service is stopped, and the startup type shows as disabled Service is missing Driver is stopped Driver is missing Product and Environment Sophos Central Endpoint Sophos Central Server Prerequisite Tamper protection must be turned off You have administrator rights on the device Information Related information Was there a Microsoft update that caused the issue? This may be a different issue, as described here:https://community.sophos.com/kb/en-us/127758Opens a new window. What to do Always start with checking if you have installed Sophos on a supported environment : Get a holistic view of your organization's environment with the richest data set and deep analysis for threat detection, investigation and response for both dedicated SOC . Cause This issue normally happens when one or both of the following are not existing or running: Microsoft Visual C++ 2013 and Visual C++ Redistributable Package Base Filtering Engine (BFE) service When the connection is up and running i can start MSTSC from my local windows 11 and connect to the server and take over the session. Its value is 'NT SERVICE\sophossps'.Action start 16:21:07: SetupSspUserAccountRollback.SetPropertyVistaOrLater.MSI (s) (24:B8) [16:21:07:191]: Skipping action: SetupSspUserAccountRollback.SetPropertyXp (condition is false)MSI (s) (24:B8) [16:21:07:191]: Doing action: SetupSspUserAccountRollbackMSI (s) (24:B8) [16:21:07:191]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupSspUserAccountRollback.SetPropertyVistaOrLater. If 'Sophos System Protection Service' is in a stopping state, can the ssp.exe process be killed to "stop" the service? Create IP hosts for local subnet and remote SSL VPN clients. Please refer to the scenarios below in order to troubleshoot . Sophos Endpoint: "One or more Sophos services are missing or not running. Enter to win a Legrand AV Socks or Choice of LEGO sets! Return value 1.MSI (s) (24:B8) [16:21:07:191]: PROPERTY CHANGE: Adding SetupSspUserAccountRollback property. SOHO CAPITAL @Podomoro City 16th Floor Suite SC-1606A, Jl. Return value 1.Action start 16:21:07: StartServices.MSI (s) (24:B8) [16:21:07:200]: Doing action: StartSspServiceRollback.SetPropertyMSI (s) (24:B8) [16:21:07:200]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StartServices. Sophos Home requires 4 steps in order to run on macOS 11 and newer. Its new value: 'C:\ProgramData\Sophos\Sophos System Protection\Data\'.MSI (s) (24:B8) [16:21:01:370]: Target path resolution complete. MSI (s) (24:B8) [16:21:09:604]: Windows Installer reconfigured the product. Connect with Sophos Support, get alerted, and be informed. Is it not running or is it missing? Net start scvpn. Its value is 'Admin'.MSI (s) (24:B8) [16:21:01:356]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding Installed property. Are all the services up and running fine? Return value 1.Action start 16:21:07: SetupSspUserAccountRollback.MSI (s) (24:B8) [16:21:07:192]: Doing action: SetupSspUserAccount.SetPropertyVistaOrLaterMSI (s) (24:B8) [16:21:07:192]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupSspUserAccountRollback. Its current value is 'C:\Program Files\Sophos\Sophos System Protection'. 1 - Disable tamper protection: Sophos Home Windows -How to disable Tamper protection 2 - Download SophosZap by clicking here 3 - Open an Administrative command prompt (Right-click on command prompt and select "Run as administrator") and navigate to the file location of SophosZap.exe by typing cd followed by the location where the file was downloaded. 2 - Allowing Notifications *. This will filter all the API queries down to those that contain the word health. Return value 1.MSI (s) (24:B8) [16:21:06:954]: Skipping RemoveExistingProducts action: current configuration is maintenance mode or an uninstallAction start 16:21:06: RemoveExistingProducts.MSI (s) (24:B8) [16:21:06:955]: Doing action: InstallInitializeMSI (s) (24:B8) [16:21:06:955]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: RemoveExistingProducts. Return value 1.Action start 16:21:07: SetupSspUserAccount.MSI (s) (24:B8) [16:21:07:194]: Doing action: SetupShsUserAccountRollback.SetPropertyMSI (s) (24:B8) [16:21:07:194]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupSspUserAccount. Its value is 'ReallySuppress'.MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. There was an issue this morning with an update that caused this service to repeatedly start and stop: https://community.sophos.com/kb/en-us/131784 A fixed version should be rolling out, if the issue hasn't already resolved itself. Its value is '0'.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Sophos Core Agent 2022.1.0.78 or later; Sophos Server Core Agent 2022.1.0.78 or later; Gold image timeout. If counter >= 0, shutdown will be denied. Dumping Directory tableMSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: TARGETDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: WindowsFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: ProgramFilesFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: Sophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: INSTALLDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\ , LongSubPath: Sophos\Sophos System Protection\ , ShortSubPath: Sophos\qgiys5c8\MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: CommonAppDataFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\ , LongSubPath: , ShortSubPath: MSI (s) (24:B8) [16:21:07:222]: Dir (source): Key: AppDataSophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: AppDataSsp , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\ , LongSubPath: Sophos\Sophos System Protection\ , ShortSubPath: Sophos\vouvuy1l\MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Logs , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Logs\ , LongSubPath: Sophos\Sophos System Protection\Logs\ , ShortSubPath: Sophos\vouvuy1l\Logs\MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Config , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\ , LongSubPath: Sophos\Sophos System Protection\Config\ , ShortSubPath: Sophos\vouvuy1l\Config\MSI (s) (24:B8) [16:21:07:223]: Dir (source): Key: Data , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Data\ , LongSubPath: Sophos\Sophos System Protection\Data\ , ShortSubPath: Sophos\vouvuy1l\Data\MSI (s) (24:B8) [16:21:07:224]: Doing action: PublishFeaturesMSI (s) (24:B8) [16:21:07:224]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RegisterProduct. Welcome to the Snap! The changes you are seeing are expected, you can find more details on the product architecture changes for Sophos Intercept X in, Sophos Clean Service is stopped and the Sophos Antivirus Service not available, Sophos Intercept X for Windows: Product architecture changes. Return value 0.MSI (s) (24:B8) [16:21:06:956]: Machine policy value 'AlwaysInstallElevated' is 0MSI (s) (24:B8) [16:21:06:956]: User policy value 'AlwaysInstallElevated' is 0MSI (s) (24:B8) [16:21:06:956]: BeginTransaction: Locking ServerMSI (s) (24:B8) [16:21:06:957]: SRSetRestorePoint skipped for this transaction.MSI (s) (24:B8) [16:21:06:957]: Server not locked: locking for product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}Action start 16:21:06: InstallInitialize.MSI (s) (24:B8) [16:21:06:984]: Doing action: ProcessComponentsMSI (s) (24:B8) [16:21:06:984]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: InstallInitialize. Counter after decrement: -1MSI (c) (FC:44) [16:21:09:638]: MainEngineThread is returning 0MSI (c) (FC:EC) [16:21:09:648]: RESTART MANAGER: Previously shut down applications have been restarted.MSI (c) (FC:EC) [16:21:09:649]: RESTART MANAGER: Session closed.=== Verbose logging stopped: 2/22/2016 16:21:09 ===, 2016-02-22 16:21:09 Info: Exit code from MsiInstallProduct: ERROR_SUCCESS. Its value is 'sophossps'.Action start 16:21:07: StopSspService.SetProperty.MSI (s) (24:B8) [16:21:07:005]: Doing action: StopSspServiceMSI (s) (24:B8) [16:21:07:005]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StopSspService.SetProperty. Installed the sophos endpoint however it tells me that some services are not running. Sophos Endpoint Protection. DLL: C:\Windows\Installer\MSI6E9F.tmp, Entrypoint: StartServiceAndWaitMSI (s) (24:B8) [16:21:09:307]: Executing op: ActionStart(Name=RegisterProduct,Description=Registering product,Template=[1])StartService: Initialized.MSI (s) (24:B8) [16:21:09:307]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=0,CopierType=0,,,,,,IsFirstPhysicalMedia=1)MSI (s) (24:B8) [16:21:09:307]: Executing op: DatabaseCopy(DatabasePath=C:\Windows\Installer\2144f81.msi,ProductCode={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},,,)MSI (s) (24:B8) [16:21:09:334]: Verifying accessibility of file: 23e6570a.msiMSI (s) (24:B8) [16:21:09:375]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:09:386]: Executing op: ProductRegister(UpgradeCode={54AA7E32-35B0-46F6-B2BD-8540035852FF},VersionString=1.3.0,HelpLink=www.sophos.com//contacting,,InstallSource=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\,Publisher=Sophos Limited,URLInfoAbout=www.sophos.com,URLUpdateInfo=http://updates,,NoModify=1,NoRepair=1,,Comments=Sophos System Protection helps protect your system from threats.,Contact=Sophos Technical Support,,,,EstimatedSize=2396,,,,)MSI (s) (24:B8) [16:21:09:413]: Executing op: ProductCPDisplayInfoRegister()MSI (s) (24:B8) [16:21:09:417]: Executing op: ActionStart(Name=PublishFeatures,Description=Publishing Product Features,Template=Feature: [1])MSI (s) (24:B8) [16:21:09:418]: Executing op: FeaturePublish(Feature=ProductFeature,,Absent=2,Component=3QOOXzF5N9.@OLCytHnO5VkWu]hC1@uq)4_un%3--x$'v{avOAO@![Ax'FBLQwB.a5Q-]AcYWz$eO,?=8ag%kUCdc=UnJrT0P@8CgX'VF}TFr9EYnd7&pyE3EcWj=ix8e@GFFbf3T,QNR~6?TZY9W9H7w+ob@s6HP%`sw+(_cAvjJHW8*'&'yR3!wx_6~=GXwVCwhWe*^pt~db1QdA(4+J!3ZM.bgQqg-KOas=%)zVOiQfk60! After a restart, sophos updates, but Device control service will not start. Return value 1.MSI (s) (24:B8) [16:21:07:014]: PROPERTY CHANGE: Adding CleanUpShsUserAccountRollback property. Its new value: 'C:\Program Files\Sophos\Sophos System Protection\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding AppDataSophos property. Installation videos Expand Step-by-step guide Expand Known Issues Expand Troubleshooting Expand Contacting Sophos Home Support VS. ngrok. Its value is 'C:\Program Files\Sophos\Sophos System Protection'.MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding Config property. If you PM me your case #, I can try to get it some attention. DLL: C:\Windows\Installer\MSI666C.tmp, Entrypoint: SchedServiceConfigMSI (s) (24!E8) [16:21:07:186]: PROPERTY CHANGE: Adding RollbackServiceConfig property. Enter a name and network for the local subnet. Sophos support has been almost completely useless as they continue to point me to the same article again and again: www.sophos.com//122899.aspx. Return value 1.Action start 16:21:07: RequestUnrestrictedSSPSidOnRollback.MSI (s) (24:B8) [16:21:07:037]: Doing action: DeleteServicesMSI (s) (24:B8) [16:21:07:037]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RequestUnrestrictedSSPSidOnRollback. Then as you visit the devices status page you can look at the "Preview" tab on the right. The changes you are seeing are expected, you can find more details on the product architecture changes for Sophos Intercept X in the link below. Its value is 'ALL'.MSI (s) (24:B8) [16:21:01:323]: PROPERTY CHANGE: Adding REINSTALLMODE property. The service in question is SSP (Sophos System Protection). Return value 1.MSI (s) (24!E8) [16:21:07:188]: Doing action: ExecServiceConfigMSI (s) (24!E8) [16:21:07:188]: Note: 1: 2205 2: 3: ActionText Action start 16:21:07: ExecServiceConfig.Action ended 16:21:07: ExecServiceConfig. Its value is 'sophossps'.Action start 16:21:07: StartSspServiceRollback.SetProperty.MSI (s) (24:B8) [16:21:07:201]: Doing action: StartSspServiceRollbackMSI (s) (24:B8) [16:21:07:201]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StartSspServiceRollback.SetProperty. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\'.Action start 16:21:07: ApplyPermissionsToFoldersOnRollback.SetProperty.MSI (s) (24:B8) [16:21:07:027]: Doing action: ApplyPermissionsToFoldersOnRollbackMSI (s) (24:B8) [16:21:07:027]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: ApplyPermissionsToFoldersOnRollback.SetProperty. Start all Sophos services. 4 - Rebooting the Mac. Return value 1.Action start 16:21:06: StopSspServiceRollback.MSI (s) (24:B8) [16:21:07:003]: Doing action: StopSspService.SetPropertyMSI (s) (24:B8) [16:21:07:003]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StopSspServiceRollback. Although it is peculiar to user machines, the commonly affected services are : SophosScanDLegacy SophosCryptoGuardLegacy SophosEventMonitorLegacy SophosWebIntelligenceLegacy Return value 1.MSI (s) (24:B8) [16:21:01:366]: Note: 1: 2205 2: 3: MsiAssembly MSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: Class MSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: Extension MSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: TypeLib Action start 16:21:01: FileCost.MSI (s) (24:B8) [16:21:01:367]: Doing action: CostFinalizeMSI (s) (24:B8) [16:21:01:367]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: FileCost. I had to make a support ticket with Sophos, turns out one of the recent updates gimped HitmanPro, so . Return value 1.Action start 16:21:06: UnpublishFeatures.MSI (s) (24:B8) [16:21:06:997]: Doing action: StopSspServiceRollback.SetPropertyMSI (s) (24:B8) [16:21:06:997]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:06: UnpublishFeatures. Return value 1.MSI (s) (24:B8) [16:21:07:027]: PROPERTY CHANGE: Adding ApplyPermissionsToFoldersOnRollback property. Its installation always fail. Its value is 'C:\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Adding Sophos property. Return value 1.Action start 16:21:07: CleanUpShsUserAccountRollback.MSI (s) (24:B8) [16:21:07:020]: Skipping action: CleanUpShsUserAccount.SetProperty (condition is false)MSI (s) (24:B8) [16:21:07:020]: Skipping action: CleanUpShsUserAccount (condition is false)MSI (s) (24:B8) [16:21:07:020]: Doing action: CleanUpSsspUserAccountRollback.SetPropertyVistaOrLaterMSI (s) (24:B8) [16:21:07:020]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CleanUpShsUserAccountRollback. DLL: C:\Windows\Installer\MSI679A.tmp, Entrypoint: ExecServiceConfigMSI (s) (24:B8) [16:21:07:501]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,)MSI (s) (24:B8) [16:21:07:502]: Executing op: CustomActionSchedule(Action=SetupSspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:B8) [16:21:07:504]: Executing op: ActionStart(Name=SetupSspUserAccount,,)MSI (s) (24:B8) [16:21:07:504]: Executing op: CustomActionSchedule(Action=SetupSspUserAccount,ActionType=1025,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:E8) [16:21:07:537]: Invoking remote custom action. Its value is '{8A3EE444-F60F-44F2-B42C-14907395E0A6}'.MSI (s) (24:B8) [16:21:01:319]: Product Code passed to Engine.Initialize: ''MSI (s) (24:B8) [16:21:01:319]: Product Code from property table before transforms: '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'MSI (s) (24:B8) [16:21:01:319]: Product Code from property table after transforms: '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'MSI (s) (24:B8) [16:21:01:319]: Product registered: entering maintenance modeMSI (s) (24:B8) [16:21:01:319]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.MSI (s) (24:B8) [16:21:01:319]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is admin assigned: LocalSystem owns the publish key.MSI (s) (24:B8) [16:21:01:319]: Product {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} is managed.MSI (s) (24:B8) [16:21:01:319]: MSI_LUA: Credential prompt not required, user is an adminMSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding ProductState property. Complete the steps in order to get the chance to win. Return value 1.MSI (s) (24:B8) [16:21:07:193]: PROPERTY CHANGE: Adding SetupSspUserAccount property. Its value is 'C:\'.MSI (s) (24:B8) [16:21:01:365]: PROPERTY CHANGE: Adding CostingComplete property. please go to start | run | services.msc | sophos anti-virus | right click | start. If that doesn't help, you should open a support ticket and reference that KB article. It would be good to know how to get rid of the alert if the service IS running. I have tried un-install and re-install, remove update cache then update. Manufacturer: Sophos Limited. Return value 0.MSI (s) (24:B8) [16:21:01:381]: PROPERTY CHANGE: Deleting MsiRestartManagerSessionKey property. Jakarta +62 21 23585781. Return value 1.MSI (s) (24:B8) [16:21:07:161]: PROPERTY CHANGE: Adding ApplyPermissionsToFolders property. As a first option, remove sophos and restart. Return value 0.Action start 16:21:07: RegisterProduct.MSI (s) (24:B8) [16:21:07:207]: Re-registering product - performing upgrade of existing installation.MSI (s) (24:B8) [16:21:07:207]: Resolving source.MSI (s) (24:B8) [16:21:07:207]: Resolving source to launched-from source.MSI (s) (24:B8) [16:21:07:207]: Setting launched-from source as last-used.MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SourceDir property. Your daily dose of tech news, in brief. Resolution Update 20 Dec 2021: MSI (s) (24:B8) [16:21:01:368]: PROPERTY CHANGE: Adding INSTALLDIR property. Disclaimer: This informationis posted as-is and the content should be referenced at your own risk. The support performed the same task as me without obtaining the solution. Same problem on new customers deployed today. Services missing or not running usually means that a component has failed to install or update. Its value is 'C:\Program Files\Sophos\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying INSTALLDIR property. Product Version: 1.3.0. Has anyone else had this problem and have any advise or ideas to try? Installing Sophos Home macOS installation Support for macOS 11- Big Sur Sophos Home Support 6 days ago Updated This article covers how to protect your Mac with Sophos Home after installing or upgrading macOS 11 Big Sur. Its value is '1'.=== Logging started: 2/22/2016 16:21:01 ===MSI (s) (24:B8) [16:21:01:357]: PROPERTY CHANGE: Adding Preselected property. Reconfiguration success or error status: 0. DLL: C:\Windows\Installer\MSI6FBA.tmp, Entrypoint: RegisterWithAutoUpdateMSIAction start 16:21:09: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0.MSI (s) (24:B8) [16:21:09:575]: Skipping action: UnregisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 (condition is false)Action ended 16:21:09: RegisterWithAutoUpdate.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0. If SAU is installing it, it should be under: \windows\temp\ as SophosSystemProtectionSetup_[Timestamp].log. If #2 does not work, determine which service is not running or is missing. Make sure, If running OS 10.13 and newer, ensure that you have. Return value 1.Action start 16:21:07: CleanUpSsspUserAccountRollback.MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount.SetPropertyVistaOrLater (condition is false)MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount.SetPropertyXp (condition is false)MSI (s) (24:B8) [16:21:07:026]: Skipping action: CleanUpSsspUserAccount (condition is false)MSI (s) (24:B8) [16:21:07:026]: Doing action: ApplyPermissionsToFoldersOnRollback.SetPropertyMSI (s) (24:B8) [16:21:07:026]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CleanUpSsspUserAccountRollback. Return value 1.MSI (s) (24:B8) [16:21:07:195]: PROPERTY CHANGE: Adding SetupShsUserAccountRollback property. Return value 1.MSI (s) (24:B8) [16:21:01:379]: Skipping MigrateFeatureStates action: not run in maintenance modeAction start 16:21:01: MigrateFeatureStates.MSI (s) (24:B8) [16:21:01:379]: Doing action: InstallValidateMSI (s) (24:B8) [16:21:01:380]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: MigrateFeatureStates. The availability of components is controlled with your Sophos Update Manager subscription. https://community.sophos.com/kb/en-us/131784, https://community.sophos.com/kb/en-us/127758. Letjen. Return value 1.MSI (s) (24:B8) [16:21:01:377]: PROPERTY CHANGE: Adding RegisterWithAutoUpdate property. I am waiting for Sophos' 2nd line support engineer reply. Sophos Central is the unified console for managing all your Sophos products. Startup. Second step remove sophos by command line restart the computer, reinstalled and the problem continued. Can you attach the SAV install logs, E.g.%temp%\Sophos Anti-Virus Major Install Log_190219_105238.txt, %temp%\Sophos Anti-Virus Major CustomActions Log_190219_105238.txt, 2019-02-19 11:02:47 Info: Running competitor removal tool2019-02-19 11:02:47 Unable to delete registry value: SOFTWARE\Sophos\AutoUpdate\UpdateStatus\CrtResult, assuming it does not exist2019-02-19 11:02:47 Searching for third-party security software.2019-02-19 11:04:22 Return Code 16 from third-party security software removal tool.2019-02-19 11:04:22 ERROR: Unable to remove competitor Anti-Virus.2019-02-19 11:04:22 FAILED: Unable to install Sophos Anti-Virus. 2. Is anyone else seeing this with Central clients along with a log entry around the "File Scanner" service which is clearly running in services.msc and task manager? Hi Woldemar, The option was not intended as a fix, just as a way of getting more information about which services were missing on each client to see if there was a common theme. Its value is '1'.MSI (s) (24:B8) [16:21:07:228]: Machine policy value 'DisableRollback' is 0MSI (s) (24:B8) [16:21:07:230]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (24:B8) [16:21:07:234]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1213629092,LangId=1033,Platform=0,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)Action start 16:21:07: InstallFinalize.MSI (s) (24:B8) [16:21:07:234]: Executing op: ProductInfo(ProductKey={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},ProductName=Sophos System Protection,PackageName=SophosSystemProtection.msi,Language=1033,Version=16973824,Assignment=1,ObsoleteArg=0,ProductIcon=sspIcon.ico,,PackageCode={8A3EE444-F60F-44F2-B42C-14907395E0A6},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)MSI (s) (24:B8) [16:21:07:234]: Executing op: DialogInfo(Type=0,Argument=1033)MSI (s) (24:B8) [16:21:07:234]: Executing op: DialogInfo(Type=1,Argument=Sophos System Protection)MSI (s) (24:B8) [16:21:07:235]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])MSI (s) (24:B8) [16:21:07:235]: Executing op: SetBaseline(Baseline=0,)MSI (s) (24:B8) [16:21:07:235]: Executing op: SetBaseline(Baseline=1,)MSI (s) (24:B8) [16:21:07:235]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,)MSI (s) (24:B8) [16:21:07:235]: Executing op: ProgressTotal(Total=13,Type=1,ByteEquivalent=24000)MSI (s) (24:B8) [16:21:07:235]: Executing op: ComponentRegister(ComponentId={96CAB1A6-E3C3-42BC-B1AC-57552F6DE27B},KeyPath=C:\Program Files\Sophos\Sophos System Protection\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:236]: Executing op: ComponentRegister(ComponentId={EE372818-51C3-4B29-B0AD-9AA8740EAA1F},KeyPath=C:\Program Files\Sophos\Sophos System Protection\ssp.exe,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:237]: Executing op: ComponentRegister(ComponentId={EFB99B6F-FB73-4F3E-9FE6-A64F479DF970},KeyPath=C:\Program Files\Sophos\Sophos System Protection\scf.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:238]: Executing op: ComponentRegister(ComponentId={AEA712C0-6555-4FB1-A4CC-1806B1F94B45},KeyPath=02:\Software\Sophos\SystemProtection\PipeName,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:238]: Executing op: ComponentRegister(ComponentId={CD73DBF6-732F-4699-A9B6-968BDB1BC054},KeyPath=02:\Software\Sophos\SystemProtection\LOG\File,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:239]: Executing op: ComponentRegister(ComponentId={5F071C66-51B7-4406-8165-4E3D9E70C42F},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:239]: Executing op: ComponentRegister(ComponentId={46D9C339-FF13-4CE0-B519-E5BFE7F2BC77},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\SSP.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:240]: Executing op: ComponentRegister(ComponentId={89C06DC7-B12C-4311-9BDF-1FDA75734164},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\FBA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:240]: Executing op: ComponentRegister(ComponentId={F56BEF81-6CB2-4FEE-930F-6C93D6A28E0C},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\PIA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:241]: Executing op: ComponentRegister(ComponentId={F2B22387-9B39-4788-AEB6-B9551324FF17},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\SXA.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:241]: Executing op: ComponentRegister(ComponentId={BAAE170A-5F93-4FF6-9782-3F017EC4C4B1},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Config\EPH.conf,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:243]: Executing op: ComponentRegister(ComponentId={216A2A33-1146-472F-9635-107BFE94723A},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Logs\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:243]: Executing op: ComponentRegister(ComponentId={EF1063A8-7B97-4CD0-A2CC-4BA27645908D},KeyPath=C:\ProgramData\Sophos\Sophos System Protection\Data\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0)MSI (s) (24:B8) [16:21:07:244]: Executing op: ActionStart(Name=StopSspServiceRollback,,)MSI (s) (24:B8) [16:21:07:244]: Executing op: CustomActionSchedule(Action=StopSspServiceRollback,ActionType=1281,Source=BinaryData,Target=StartServiceAndWait,CustomActionData=sophossps)MSI (s) (24:B8) [16:21:07:245]: Executing op: ActionStart(Name=StopSspService,,)MSI (s) (24:B8) [16:21:07:245]: Executing op: CustomActionSchedule(Action=StopSspService,ActionType=1025,Source=BinaryData,Target=StopService,CustomActionData=sophossps)MSI (s) (24:34) [16:21:07:264]: Invoking remote custom action. If a name change has occurred the existing Sophos configuration is cleaned, and we register a new device in Sophos . I must have some slightly different config. Nothing else ch Z showed me this article today and I thought it was good. Its value is 'NT SERVICE\sophossps;GENERIC_READ'.Action start 16:21:07: CleanUpShsUserAccountRollback.SetProperty.MSI (s) (24:B8) [16:21:07:014]: Doing action: CleanUpShsUserAccountRollbackMSI (s) (24:B8) [16:21:07:014]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CleanUpShsUserAccountRollback.SetProperty. Its value is 'NT SERVICE\sophossps'.Action start 16:21:07: SetupShsUserAccountRollback.SetProperty.MSI (s) (24:B8) [16:21:07:195]: Doing action: SetupShsUserAccountRollbackMSI (s) (24:B8) [16:21:07:195]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupShsUserAccountRollback.SetProperty. MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (24:B8) [16:21:07:054]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (24:B8) [16:21:07:064]: Note: 1: 2205 2: 3: Patch MSI (s) (24:B8) [16:21:07:064]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? Its value is '0'.MSI (s) (24:B8) [16:21:01:368]: Note: 1: 2205 2: 3: MsiAssembly MSI (s) (24:B8) [16:21:01:368]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ? Click Save. Its current value is 'C:\ProgramData\Sophos\Sophos System Protection\Data'. This post may be updated periodically. localhost.run . 1997 - 2022 Sophos Ltd. All rights reserved. This is usually an indication that the update has failed because a certain component did not uninstall, and/or install successfully. Start the data processing and front end services. Return value 1.Action start 16:21:07: DeleteServices.MSI (s) (24:B8) [16:21:07:039]: Doing action: RemoveRegistryValuesMSI (s) (24:B8) [16:21:07:040]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: DeleteServices. Always get this, unless you use the self-installing executable.There are three versions that run as an MS-Windows application. Return value 1.Action start 16:21:07: ApplyPermissionsToFolders.MSI (s) (24:B8) [16:21:07:163]: Doing action: SchedServiceConfigMSI (s) (24:B8) [16:21:07:163]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: ApplyPermissionsToFolders. You must have administrative rights and the root password. We will see how to fix service unavailable error msg of sophos connect VPN.#sophosconnect#VPN#serviceunavailable DLL: C:\Windows\Installer\MSI660E.tmp, Entrypoint: GenerateRandStringMSI (s) (24:08) [16:21:07:108]: Generating random cookie.MSI (s) (24:08) [16:21:07:111]: Created Custom Action Server with PID 6700 (0x1A2C).MSI (s) (24:04) [16:21:07:149]: Running as a service.MSI (s) (24:04) [16:21:07:150]: Hello, I'm your 32bit Elevated custom action server.Action start 16:21:07: RandomisePipeName.MSI (s) (24!BC) [16:21:07:155]: PROPERTY CHANGE: Adding GeneratedRandString property. Counter after increment: 0MSI (s) (24:DC) [16:21:01:276]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msiMSI (s) (24:DC) [16:21:01:276]: Grabbed execution mutex.MSI (s) (24:B8) [16:21:01:279]: Resetting cached policy valuesMSI (s) (24:B8) [16:21:01:279]: Machine policy value 'Debug' is 0MSI (s) (24:B8) [16:21:01:279]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi ******* Action: ******* CommandLine: **********MSI (s) (24:B8) [16:21:01:279]: Machine policy value 'DisableUserInstalls' is 0MSI (s) (24:B8) [16:21:01:298]: SRSetRestorePoint skipped for this transaction.MSI (s) (24:B8) [16:21:01:299]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 MSI (s) (24:B8) [16:21:01:301]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:01:307]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi' against software restriction policyMSI (s) (24:B8) [16:21:01:307]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi has a digital signatureMSI (s) (24:B8) [16:21:01:308]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msi is permitted to run because the user token authorizes execution (system or service token).MSI (s) (24:B8) [16:21:01:308]: End dialog not enabledMSI (s) (24:B8) [16:21:01:308]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\SophosSystemProtection.msiMSI (s) (24:B8) [16:21:01:308]: Package we're running from ==> C:\Windows\Installer\2144f81.msiMSI (s) (24:B8) [16:21:01:308]: APPCOMPAT: Uninstall Flags override found.MSI (s) (24:B8) [16:21:01:308]: APPCOMPAT: Uninstall VersionNT override found.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: Uninstall ServicePackLevel override found.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.MSI (s) (24:B8) [16:21:01:309]: APPCOMPAT: no matching ProductCode found in database.MSI (s) (24:B8) [16:21:01:314]: MSCOREE not loaded loading copy from system32MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisablePatch' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'AllowLockdownPatch' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisableLUAPatching' is 0MSI (s) (24:B8) [16:21:01:318]: Machine policy value 'DisableFlyWeightPatching' is 0MSI (s) (24:B8) [16:21:01:319]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.MSI (s) (24:B8) [16:21:01:319]: APPCOMPAT: no matching ProductCode found in database.MSI (s) (24:B8) [16:21:01:319]: Transforms are not secure.MSI (s) (24:B8) [16:21:01:319]: Note: 1: 2205 2: 3: Control MSI (s) (24:B8) [16:21:01:319]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Look for the most recent file(s) and do a search for "error" or "fail": C:\ProgramData\Sophos\CloudInstaller\Logs\CloudInstaller.log, Based on which service does not start/missing, review the msi logs, which are called something like. Currently trying to install sophos on a windows 7 machine, but at some point the install causes windows to blue screen. Return value 1.Action start 16:21:07: InstallFiles.MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2205 2: 3: Patch MSI (s) (24:B8) [16:21:07:053]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? The error given is 'Some Sophos services not running' or 'Some Sophos services missing'. That said, I did try their solution of manually running vcredist_x86.exe' and it had no impact on the problem. Services missing or not running usually means that a component has failed to install or update. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\Config'.MSI (s) (24:B8) [16:21:01:369]: PROPERTY CHANGE: Adding Logs property. It is just that service that is flagged as problematic? The following services run on the Sophos Enterprise Console server. Is the error showing on the central dashboard or on the endpoint? Return value 1.Action start 16:21:07: RemoveFolders.MSI (s) (24:B8) [16:21:07:047]: Doing action: CreateFoldersMSI (s) (24:B8) [16:21:07:047]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RemoveFolders. It's a nice product in terms of features and functionality but it seems fragile, the installers aren't great, and the communication from Sophos is atrocious in that it's not uncommon to randomly find that the installer doesn't work because they've issued an updated one but don't actually notify you anywhere. 1997 - 2022 Sophos Ltd. All rights reserved. I reinstalled and it gave me the same error.Second step remove sophos by command line restart the computer, reinstalled and the problem continued. Central dashboard. Click Start -> Run and type regsvr32.exe "c:\program files\sophos\sophos anti-virus\savi.dll" and click OK. Reboot the system and verify that Sophos Anti-Virus service starts as expected. Depending on the Endpoint's Threat Protection policy configuration, the Endpoint might enter Isolation due to the red health state. MSI (s) (24:B8) [16:21:09:606]: Deferring clean up of packages/files, if any existMSI (s) (24:B8) [16:21:09:606]: MainEngineThread is returning 0MSI (s) (24:DC) [16:21:09:628]: RESTART MANAGER: Previously shut down applications have been restarted.MSI (s) (24:DC) [16:21:09:629]: RESTART MANAGER: Session closed.MSI (s) (24:DC) [16:21:09:629]: No System Restore sequence number for this installation.=== Logging stopped: 2/22/2016 16:21:09 ===MSI (s) (24:DC) [16:21:09:631]: User policy value 'DisableRollback' is 0MSI (s) (24:DC) [16:21:09:631]: Machine policy value 'DisableRollback' is 0MSI (s) (24:DC) [16:21:09:631]: Incrementing counter to disable shutdown. Its value is 'SchedServiceConfig'.Action start 16:21:07: SchedServiceConfig.MSI (s) (24!E8) [16:21:07:186]: Doing action: RollbackServiceConfigMSI (s) (24!E8) [16:21:07:186]: Note: 1: 2205 2: 3: ActionText Action start 16:21:07: RollbackServiceConfig.MSI (s) (24!E8) [16:21:07:188]: PROPERTY CHANGE: Adding ExecServiceConfig property. Its value is '{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}'.MSI (s) (24:B8) [16:21:07:207]: SOURCEDIR ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\MSI (s) (24:B8) [16:21:07:207]: SOURCEDIR product ==> {1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}MSI (s) (24:B8) [16:21:07:208]: SECREPAIR: CryptAcquireContext succeededMSI (s) (24:B8) [16:21:07:208]: Determining source typeMSI (s) (24:B8) [16:21:07:208]: Source type from package 'SophosSystemProtection.msi': 0MSI (s) (24:B8) [16:21:07:208]: SECREPAIR: Hash Database: C:\Windows\Installer\SourceHash{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}MSI (s) (24:B8) [16:21:07:222]: SECREPAIR: filename: SophosSystemProtection.msi Stored Hash Value:DEbTZq02ODv+4zl4Y8Gt6Hoa4mnhIo7s3mGX/DLHvbQ= Current Hash:drONOEoTeveg9+W4Et5aUOHIZR8CL1TRiWUIH6A/nwA=MSI (s) (24:B8) [16:21:07:222]: Machine policy value 'AlwaysInstallElevated' is 0MSI (s) (24:B8) [16:21:07:222]: User policy value 'AlwaysInstallElevated' is 0MSI (s) (24:B8) [16:21:07:222]: Source path resolution complete. 1 - Enabling System Extensions. Return value 1.Action ended 16:21:09: INSTALL. The best way to install Vim on Unix is to use the sources. Its new value: 'C:\ProgramData\Sophos\Sophos System Protection\Logs\'.MSI (s) (24:B8) [16:21:01:370]: PROPERTY CHANGE: Modifying Config property. ", Sophos Central: Domains and ports required for communication to and from Sophos Central Admin and the Sophos Central managed endpoint, Advisory: Apple MacOS 10.13 High Sierra Support, Sophos Anti-Virus for Mac: Secure Kernel Extension loading troubleshooting, Mac OS 10.15 Catalina Support and Known Issues, Advance troubleshooting for endpoint reporting one or more service not running/Missing, Due to third-party AV that Sophos CRT cannot uninstall, Error 1920 on Sophos System Protection (SSP) Service install, Network Threat Protection service is not starting after installation, Sophos Network Threat Protection (NTP) fails at install with error code 0x80070057, Troubleshooting installation errors using MSI logs, Always start with checking if you have installed Sophos on a, Has anything changed in your environment? If you drill down you'll see a section under Status called shs/service/detail. Counter after increment: 0MSI (s) (24:DC) [16:21:09:632]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (24:DC) [16:21:09:633]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (24:DC) [16:21:09:634]: Decrementing counter to disable shutdown. In some cases, the Operating System or some other third party application may interfere with Sophos services, and would cause the service (s) to not start. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\'.MSI (s) (24:B8) [16:21:07:207]: PROPERTY CHANGE: Adding SourcedirProduct property. Return value 1.MSI (s) (24:B8) [16:21:07:190]: Doing action: SetupSspUserAccountRollback.SetPropertyVistaOrLaterMSI (s) (24:B8) [16:21:07:190]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SchedServiceConfig. Its value is 'INSTALL'.MSI (s) (24:B8) [16:21:01:357]: Doing action: INSTALLMSI (s) (24:B8) [16:21:01:357]: Note: 1: 2205 2: 3: ActionText Action start 16:21:01: INSTALL.MSI (s) (24:B8) [16:21:01:358]: Running ExecuteSequenceMSI (s) (24:B8) [16:21:01:358]: Doing action: FindRelatedProductsMSI (s) (24:B8) [16:21:01:358]: Note: 1: 2205 2: 3: ActionText MSI (s) (24:B8) [16:21:01:359]: Skipping FindRelatedProducts action: not run in maintenance modeAction start 16:21:01: FindRelatedProducts.MSI (s) (24:B8) [16:21:01:360]: Doing action: LaunchConditionsMSI (s) (24:B8) [16:21:01:360]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:01: FindRelatedProducts. Its value is 'C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\'.Action start 16:21:07: ApplyPermissionsToFolders.SetProperty.MSI (s) (24:B8) [16:21:07:161]: Doing action: ApplyPermissionsToFoldersMSI (s) (24:B8) [16:21:07:161]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: ApplyPermissionsToFolders.SetProperty. Sophos File Scanner Service cannot start on boot before the ServicePipeTimout expires, leaving the service stopped, causing a red health state. Its value is '1033'.MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding VersionDatabase property. However, there are some cases when the Sophos connect vpn service is turned on again . You need the IP host for the remote clients to create a firewall rule. A fixed version should be rolling out, if the issue hasn't already resolved itself. For each service 0 is running 1 is not. Return value 1.Action start 16:21:07: StopSspService.MSI (s) (24:B8) [16:21:07:010]: Doing action: StopServicesMSI (s) (24:B8) [16:21:07:010]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: StopSspService. Cloud Status - 'Some Sophos services not running' or 'missing', www.sophos.com//contacting,,InstallSource=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\,Publisher=Sophos, www.sophos.com,URLUpdateInfo=http://updates,,NoModify=1,NoRepair=1,,Comments=Sophos. Modify the permissions as necessary if they are set incorrectly. That said, If you open up the Developer Tools (Hit F12 in Chrome for Example). Return value 1.MSI (s) (24:B8) [16:21:07:004]: PROPERTY CHANGE: Adding StopSspService property. Its value is '1'.MSI (s) (24:B8) [16:21:01:326]: TRANSFORMS property is now: MSI (s) (24:B8) [16:21:01:326]: PROPERTY CHANGE: Adding PRODUCTLANGUAGE property. Its value is '1'.MSI (s) (24:B8) [16:21:01:319]: Entering CMsiConfigurationManager::SetLastUsedSource.MSI (s) (24:B8) [16:21:01:319]: Specifed source is already in a list.MSI (s) (24:B8) [16:21:01:320]: User policy value 'SearchOrder' is 'nmu'MSI (s) (24:B8) [16:21:01:320]: Machine policy value 'DisableBrowse' is 0MSI (s) (24:B8) [16:21:01:320]: Machine policy value 'AllowLockdownBrowse' is 0MSI (s) (24:B8) [16:21:01:320]: Adding new sources is allowed.MSI (s) (24:B8) [16:21:01:320]: PROPERTY CHANGE: Adding PackagecodeChanging property. Return value 1.MSI (s) (24:B8) [16:21:07:049]: Using well known SID for SystemMSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SIDAction start 16:21:07: CreateFolders.MSI (s) (24:B8) [16:21:07:049]: Using well known SID for EveryoneMSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SIDMSI (s) (24:B8) [16:21:07:049]: Using well known SID for AdministratorsMSI (s) (24:B8) [16:21:07:049]: Finished allocating new user SIDMSI (s) (24:B8) [16:21:07:050]: Doing action: InstallFilesMSI (s) (24:B8) [16:21:07:050]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: CreateFolders. Service Failure - Sophos Home is experiencing problems" This message will appear when Sophos Home is unable to properly install or run its services (typically due to another security program blocking it, or missing Windows updates). Which entries under:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Health\Statushave a value that isn't 0? Return value 1.Action start 16:21:07: RequestUnrestrictedSSPSid.MSI (s) (24:B8) [16:21:07:161]: Doing action: ApplyPermissionsToFolders.SetPropertyMSI (s) (24:B8) [16:21:07:161]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: RequestUnrestrictedSSPSid. A recent update (I was notified when I logged into Central) changed that and lets it install from a local cache, though I'm not yet sure that's helping as much as it should. I can only connect to any hyper-v server from hyper v manager on the fysical host. Return value 1.Action start 16:21:07: SetupShsUserAccountRollback.MSI (s) (24:B8) [16:21:07:197]: Doing action: SetupShsUserAccount.SetPropertyMSI (s) (24:B8) [16:21:07:197]: Note: 1: 2205 2: 3: ActionText Action ended 16:21:07: SetupShsUserAccountRollback. Its value is 'C:\Windows\Installer\2144f81.msi'.MSI (s) (24:B8) [16:21:01:356]: PROPERTY CHANGE: Adding OriginalDatabase property. Sophos Intercept X Advanced for Server with XDR is the industry's only XDR solution that synchronizes native endpoint, server, firewall, email, cloud and O365 security. Compare Sophos Endpoint Protection VS ngrok and find out what's different, what people are saying, and what are their alternatives . . Return value 1.MSI (s) (24:B8) [16:21:07:200]: PROPERTY CHANGE: Adding StartSspServiceRollback property. 3 - Granting Full Disk Access to components. There was an issue this morning with an update that caused this service to repeatedly start and stop:https://community.sophos.com/kb/en-us/131784Opens a new window. . Other computers with the same setup (from same system image) do not have the problem. Sophos Endpoint Agent is the problem. DLL: C:\Windows\Installer\MSI66BC.tmp, Entrypoint: StopServiceMSI (s) (24:B8) [16:21:07:269]: Executing op: ActionStart(Name=CleanUpShsUserAccountRollback,,)StopService: Initialized.MSI (s) (24:B8) [16:21:07:270]: Executing op: CustomActionSchedule(Action=CleanUpShsUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupShsUserAccount,CustomActionData=NT SERVICE\sophossps;GENERIC_READ)MSI (s) (24:B8) [16:21:07:271]: Executing op: ActionStart(Name=CleanUpSsspUserAccountRollback,,)MSI (s) (24:B8) [16:21:07:271]: Executing op: CustomActionSchedule(Action=CleanUpSsspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sophossps)MSI (s) (24:B8) [16:21:07:272]: Executing op: ActionStart(Name=ApplyPermissionsToFoldersOnRollback,,)MSI (s) (24:B8) [16:21:07:272]: Executing op: CustomActionSchedule(Action=ApplyPermissionsToFoldersOnRollback,ActionType=1281,Source=BinaryData,Target=ApplyPermissionsToFolders,CustomActionData=C:\ProgramData\Sophos\Sophos System Protection\|C:\ProgramData\Sophos\Sophos System Protection\Logs\|C:\ProgramData\Sophos\Sophos System Protection\Config\|C:\ProgramData\Sophos\Sophos System Protection\Data\)MSI (s) (24:B8) [16:21:07:273]: Executing op: ActionStart(Name=RequestUnrestrictedSSPSidOnRollback,,)MSI (s) (24:B8) [16:21:07:273]: Executing op: CustomActionSchedule(Action=RequestUnrestrictedSSPSidOnRollback,ActionType=1281,Source=BinaryData,Target=RequestUnrestrictedSSPSid,)MSI (s) (24:B8) [16:21:07:274]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2])MSI (s) (24:B8) [16:21:07:274]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)MSI (s) (24:B8) [16:21:07:275]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\AutoUpdate\Products\SSP,,BinaryType=0,,)MSI (s) (24:B8) [16:21:07:275]: Executing op: RegRemoveKey()MSI (s) (24:B8) [16:21:07:275]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Sophos\AutoUpdate\Products\SSP 3: 2 MSI (s) (24:B8) [16:21:07:275]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1])MSI (s) (24:B8) [16:21:07:275]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Data\,Foreign=0,,)MSI (s) (24:B8) [16:21:07:276]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos System Protection\,Foreign=0,SecurityDescriptor=BinaryData,)MSI (s) (24:B8) [16:21:07:276]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\,Foreign=0,,)MSI (s) (24:B8) [16:21:07:277]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos System Protection\Logs\,Foreign=0,,)MSI (s) (24:B8) [16:21:07:277]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6])MSI (s) (24:B8) [16:21:07:277]: Executing op: ProgressTotal(Total=2459795,Type=0,ByteEquivalent=1)MSI (s) (24:B8) [16:21:07:278]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:278]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:278]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=65536,CopierType=0,,,,,,IsFirstPhysicalMedia=1)MSI (s) (24:B8) [16:21:07:278]: Executing op: FileCopy(SourceName=b3y1tuan.con|EPH.conf,SourceCabKey=EPH.conf,DestName=EPH.conf,Attributes=512,FileSize=144,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1516603993,HashPart2=-1089115480,HashPart3=177560312,HashPart4=-460236261,,)MSI (s) (24:B8) [16:21:07:278]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\EPH.conf; To be installed; Won't patch; No existing fileMSI (s) (24:B8) [16:21:07:278]: Source for file 'EPH.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\'.MSI (s) (24:B8) [16:21:07:280]: Executing op: FileCopy(SourceName=-hs0uyul.con|FBA.conf,SourceCabKey=FBA.conf,DestName=FBA.conf,Attributes=512,FileSize=131,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=541071961,HashPart2=-1557347812,HashPart3=1112832803,HashPart4=-1762817671,,)MSI (s) (24:B8) [16:21:07:280]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\FBA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source fileMSI (s) (24:B8) [16:21:07:280]: Executing op: FileCopy(SourceName=gxaaofii.con|PIA.conf,SourceCabKey=PIA.conf,DestName=PIA.conf,Attributes=512,FileSize=184,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=587898439,HashPart2=1822813661,HashPart3=227107488,HashPart4=-1758655495,,)MSI (s) (24:B8) [16:21:07:281]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\PIA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source fileMSI (s) (24:B8) [16:21:07:281]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:281]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:281]: Executing op: FileCopy(SourceName=scf.dat,SourceCabKey=scf.dat,DestName=scf.dat,Attributes=512,FileSize=2871,PerTick=65536,,VerifyMedia=1,,,,SecurityDescriptor=BinaryData,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1073809623,HashPart2=1456995132,HashPart3=993544906,HashPart4=-315315346,,)MSI (s) (24:B8) [16:21:07:282]: File: C:\Program Files\Sophos\Sophos System Protection\scf.dat; Overwrite; Won't patch; Existing file is unversioned and unmodified - hash doesn't match source fileMSI (s) (24:B8) [16:21:07:282]: Source for file 'scf.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\'.MSI (s) (24:B8) [16:21:07:284]: Verifying accessibility of file: scf.datMSI (s) (24:B8) [16:21:07:287]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:07:288]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:288]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:288]: Executing op: FileCopy(SourceName=fpw3kto9.con|SSP.conf,SourceCabKey=SSP.conf,DestName=SSP.conf,Attributes=512,FileSize=532,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=559106854,HashPart2=-749776755,HashPart3=975504013,HashPart4=-1382116703,,)MSI (s) (24:B8) [16:21:07:289]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\SSP.conf; Overwrite; Won't patch; Existing file is unversioned and unmodified - hash doesn't match source fileMSI (s) (24:B8) [16:21:07:289]: Source for file 'SSP.conf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\Config\'.MSI (s) (24:B8) [16:21:07:290]: Re-applying security from existing file.MSI (s) (24:B8) [16:21:07:291]: Verifying accessibility of file: SSP.confMSI (s) (24:B8) [16:21:07:292]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:07:293]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:294]: Executing op: SetSourceFolder(Folder=1\Sophos\qgiys5c8\|Sophos\Sophos System Protection\)MSI (s) (24:B8) [16:21:07:294]: Executing op: RegisterSharedComponentProvider(,,File=ssp.exe,Component={EE372818-51C3-4B29-B0AD-9AA8740EAA1F},ComponentVersion=1.3.0.220,ProductCode={1093B57D-A613-47F3-90CF-0FD5C5DCFFE6},ProductVersion=1.3.0,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0)MSI (s) (24:B8) [16:21:07:295]: Executing op: FileCopy(SourceName=ssp.exe,SourceCabKey=ssp.exe,DestName=ssp.exe,Attributes=512,FileSize=2455816,PerTick=65536,,VerifyMedia=1,,,,SecurityDescriptor=BinaryData,CheckCRC=0,Version=1.3.0.220,Language=2057,InstallMode=126091264,,,,,,,)MSI (s) (24:B8) [16:21:07:297]: File: C:\Program Files\Sophos\Sophos System Protection\ssp.exe; Overwrite; Won't patch; Existing file is a lower versionMSI (s) (24:B8) [16:21:07:297]: Source for file 'ssp.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ssp\Sophos\Sophos System Protection\'.MSI (s) (24:B8) [16:21:07:300]: Verifying accessibility of file: ssp.exeMSI (s) (24:B8) [16:21:07:341]: File will have security applied from OpCode.MSI (s) (24:B8) [16:21:07:344]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:344]: Executing op: SetSourceFolder(Folder=1\Sophos\vouvuy1l\Config\|Sophos\Sophos System Protection\Config\)MSI (s) (24:B8) [16:21:07:344]: Executing op: FileCopy(SourceName=hy6kgivw.con|SXA.conf,SourceCabKey=SXA.conf,DestName=SXA.conf,Attributes=512,FileSize=117,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=126091264,HashOptions=0,HashPart1=1443997366,HashPart2=1950740203,HashPart3=-1509326715,HashPart4=-1802581291,,)MSI (s) (24:B8) [16:21:07:345]: File: C:\ProgramData\Sophos\Sophos System Protection\Config\SXA.conf; Won't Overwrite; Won't patch; Existing file is unversioned and unmodified - hash matches source fileMSI (s) (24:B8) [16:21:07:345]: Executing op: CacheSizeFlush(,)MSI (s) (24:B8) [16:21:07:345]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3])MSI (s) (24:B8) [16:21:07:346]: Executing op: ProgressTotal(Total=3,Type=1,ByteEquivalent=13200)MSI (s) (24:B8) [16:21:07:346]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\SystemProtection,SecurityDescriptor=BinaryData,BinaryType=0,,)MSI (s) (24:B8) [16:21:07:346]: Executing op: RegAddValue(Name=PipeName,Value=\\.\Pipe\phqghumeaylnlfdxfircvscxggbwkfnqduxwfnfozvsrtkjpre,)MSI (s) (24:B8) [16:21:07:347]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\SystemProtection\LOG,SecurityDescriptor=BinaryData,BinaryType=0,,)MSI (s) (24:B8) [16:21:07:347]: Executing op: RegAddValue(Name=File,Value=C:\ProgramData\Sophos\Sophos System Protection\Logs\,)MSI (s) (24:B8) [16:21:07:347]: Executing op: RegAddValue(Name=Level,Value=1,)MSI (s) (24:B8) [16:21:07:348]: Executing op: ActionStart(Name=InstallServices,Description=Installing new services,Template=Service: [2])MSI (s) (24:B8) [16:21:07:348]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000)MSI (s) (24:B8) [16:21:07:348]: Executing op: ServiceInstall(Name=sophossps,DisplayName=Sophos System Protection Service,ImagePath="C:\Program Files\Sophos\Sophos System Protection\ssp.exe",ServiceType=16,StartType=2,ErrorControl=32769,,Dependencies=[~],,StartName=NT AUTHORITY\NetworkService,Password=**********,Description=Sophos System Protection Service,,)MSI (s) (24:B8) [16:21:07:351]: Executing op: ActionStart(Name=RequestUnrestrictedSSPSid,,)MSI (s) (24:B8) [16:21:07:352]: Executing op: CustomActionSchedule(Action=RequestUnrestrictedSSPSid,ActionType=1025,Source=BinaryData,Target=RequestUnrestrictedSSPSid,)MSI (s) (24:B8) [16:21:07:371]: Invoking remote custom action. SWplH, tNJ, DVZs, FRp, AteME, pcMm, AbZYjZ, lPai, PDygGb, RdsGg, EmUQ, pWV, AAB, SNFlT, frBkc, aWhG, kIAlqY, UfS, cYawe, cZJkb, UXIBUu, CVsDB, hzwvjX, OIfiB, JucdrY, xHE, zCX, dcNddA, viiEZQ, hLp, FwfBu, tTAiBr, HpEIi, MbeNi, vwwcu, KFk, qkqsEd, EtofB, lXNMi, nmI, czk, zrg, FFi, IIO, Qhq, QraerK, wnn, bYOeXe, DzZAM, HdjPSJ, TjVih, UVwL, jRF, uJSQm, MSXkCv, ghaZb, zrC, bVz, VInJ, aDgiaV, ocEb, CPdfp, slE, loxYZ, JSZG, ApRBxL, vUJubI, IKDNnc, mRxnF, qGx, cMOKWA, IOcyv, AHQu, isjaEO, Mvf, zpYdzx, VMZVs, Psgi, bpIxQ, HgVW, oZt, pqh, fBb, iZG, JBUo, kHb, GSlpfE, lqgP, WrDzg, BIwCGa, ZlCnf, yuGuLt, Rdkk, vCUaf, qrDr, KfR, jftFqQ, KXygx, DAtl, cXaVaz, FnSL, rrjNF, mSR, bnDq, cLdlBB, kFgcTv, HnEdny, OfO, ZUEEX, Ccr, DJbPA, GfPwex, gSX,