Troubleshoot Sophos Endpoint installation systematically
A message such as “Installation failed” describes only the end of a chain. The fault may have occurred during download, certificate validation, removal of a competing product, component installation, registration or the first policy synchronisation.
Troubleshooting therefore follows the installation phases and starts with facts rather than repeated installer launches.
Prepare the diagnosis
Before making a change, record:
- operating system, architecture and patch level,
- installer used and download time,
- complete command without exposed Secrets,
- start and failure time with time zone,
- exit code and visible error message,
- proxy, Relay and network path,
- existing security software,
- previous Sophos installation or device objects.
The installer is bound to the tenant. Do not copy it into tickets, public shares or the repository.
Phase 1: Requirements and operating system
First check whether the platform, architecture and version are currently supported. Legacy platforms may require an Extended Support licence and do not necessarily receive all functions.
On Windows, root certificates in particular must be current and trusted. Disabled automatic root-certificate updates or TLS Inspection using an untrusted CA can prevent installation and Central communication.
Intentionally disabling Windows root-certificate updates is not automatically wrong if another controlled process keeps the trust store current. Without such a process, however, the installer lacks required trust anchors. Current installation components require DigiCert CS RSA4096 Root G5; older installers may additionally reference DigiCert Trusted Root G4. Obtain certificates only directly from DigiCert or through the managed Microsoft trust process, and verify fingerprints and signatures. A certutil download may trigger an expected XDR/MDR detection, which should be closed only after matching it to the documented administrator action.
On macOS, System Extensions, Network Extensions, Full Disk Access and other privacy approvals are required in addition to a supported version. For an MDM rollout, deploy the profiles before the software.
Phase 2: Download and launch
On Windows, check that SophosSetup.exe was downloaded completely and launched with administrative permissions. AppLocker, Windows Defender Application Control, EDR rules or a Web Proxy can block the bootstrap process.
Always use a freshly downloaded installer from the correct Central tenant. An old stub package may start but, after bootstrap requirements have changed, leave only an interface showing No Sophos security products installed. In this case, compare the Stage 1 version in CloudInstaller.log with the current download rather than treating the empty interface as a successful installation.
If the installer reports No Products available for this Operating system on Windows 10 or Windows Server 2019, also check Settings > Apps > Apps & features > Choose where to get apps. Certain Windows updates can set this to The Microsoft Store only. The managed setting must allow Sophos applications, for example with Anywhere. If the setting is correct, check an expired trial as a second known cause with Sophos Support or the partner.
Downloaded installers expire after 90 days. The current bootstrap does not create a complete offline installer; for larger rollouts, an Update Cache reduces downloads. The installer obtains available caches from the Central Update policy and selects one itself. There is no parameter for pinning a specific cache server.
On current macOS versions, do not extract the ZIP in Documents, Downloads or on the desktop. Sophos recommends a directory in the user’s home folder. If the quarantine attribute is problematic after extraction, inspect it in a controlled manner:
xattr ~/SophosInstall/Sophos\ Installer.app
Remove the attribute from the specific installer only when com.apple.quarantine is the documented cause:
sudo xattr -r -d com.apple.quarantine ~/SophosInstall/Sophos\ Installer.app
Phase 3: Network, DNS and proxy
A browser test to central.sophos.com does not prove that every agent service can reach its destinations. The current Sophos list of domains and ports is authoritative. Working DNS, TCP 443 and, for Message Relay, TCP 8190 are particularly important.
Check:
- Resolution of the required Sophos domains.
- Direct or intended proxy route from the system context.
- TLS certificate chain without unauthorised modification.
- PAC or proxy authentication for non-interactive services.
- Reachability of a configured Message Relay.
Proxy passwords on command lines can appear in process lists and deployment logs. Prefer a Secret function in the deployment platform.
Phase 4: Competing protection and previous installation
Automatic Competitor Removal can remove known products. An unknown driver, damaged uninstaller or self-protected competing agent can still stop the process.
--nocompetitorremoval is not a general repair switch. For a full Sophos Endpoint, coexistence must be explicitly supported. XDR Sensor is the intended option alongside a separate protection product.
Handle services, drivers and active Tamper Protection left by a previous Sophos installation in a controlled manner. Registry deletions and manual removal of individual MSI components without a support Runbook can make the state worse.
If a repair installation fails because Tamper Protection is active, do not repeatedly install over the existing installation. Disable protection for the specific device in a controlled manner, uninstall Sophos Endpoint Agent normally under Installed Apps, and restart Windows. Only then run the current tenant-bound installer again. The precise override is documented in Disable Sophos Central Tamper Protection safely.
If AVremove.log reports Competitor Removal Tool exit code 16 or return code 1603, identify the detected product name directly below Info: Removing detected products. If the competing product is still installed, disable its Tamper Protection according to the vendor’s instructions and repair or remove the software normally. If it is no longer listed, clean up only the orphaned registry keys named exactly by the log and only after a backup. A general registry search for the vendor name would be too risky.
All Invincea products, including Dell Protected Workspace, must be removed before Sophos. If its uninstaller fails with Unable to load SBox.DLL, first install the latest Dell Protected Workspace version over the existing installation and then uninstall it normally again. Restart Windows before installing Sophos.
If the installer reports a competitor product that cannot be removed even though none is installed, check AVremove.log. Errors GetServiceKeyName 1060 or createSecurityCentreInformation failed indicate a missing, disabled or damaged Windows Security Center service. Repair or reset the Windows Security app first. --nocompetitorremoval can bypass the step, but does not repair the defective Windows Security Center and is therefore not the preferred solution.
Phase 5: Windows installer logs
The main bootstrap logs are normally stored under:
C:\ProgramData\Sophos\CloudInstaller\Logs
Use the log that corresponds to the failure time. Work backwards from the first error to identify the component rather than looking only at the final generic return message.
The Thin Installer first extracts to %TEMP%, downloads SophosSetup_Stage2.exe and registers the tenant using the Customer Token and MCS Customer ID. In addition to the bootstrap log, component logs are written to %TEMP% and C:\Windows\Temp. Particularly useful are AVremove.log for competitor removal, Sophos Management Communications System Install Log.txt for MCS and registration, and the installation log of the component named in the error. The MCS log can contain registration tokens and must be handled like a secret.
--traillogging makes the installer generate additional diagnostic data. Use this option deliberately on a pilot device because the logs can be larger and more sensitive.
Common causes include:
- download or signature validation failed,
- root certificate is not trusted,
- proxy or DNS is blocked,
- competing product cannot be removed,
- restart is pending,
- insufficient disk space or permissions,
- incorrect or expired installer,
- component is incompatible with the platform.
If CloudInstaller.log contains WinHttpSendRequest failed with error 15100 or 15105, a damaged or missing Windows system file may be preventing the WinHTTP request. Run sfc /scannow first and inspect the CBS result. Copy a file only from a device with exactly the same Windows version and patch level; an arbitrary DLL from the internet is not a repair.
If TLS cipher suites are hardened by GPO, at least one suite offered by Sophos MCS must remain enabled. Compare the effective SSL Cipher Suite Order with a working device and the current Sophos list, correct it in the managed domain GPO, and retest after the required restart. There is no need for a broad return to obsolete cipher suites.
Endpoint Defense does not start with error 31
If the installer shows Failed to start service - Sophos Endpoint Defense with error 31 and the Endpoint Defense mini-filter is Stopped in Self Help, check the Windows value type at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute. Windows expects REG_MULTI_SZ; a third-party change to REG_SZ prevents the installer from appending its entry. Back up the registry and record the existing content before any correction. Restore the value as a multi-string only for this exact error pattern, then reinstall. This is not a general Endpoint Defense reset.
If the Endpoint Defense setup log contains Failed to copy SophosEL.sys into ELAM driver Backup Path and previously shows file-system error code 1, check whether C:\Windows\ELAMBKUP is missing. Create the Windows ELAMBKUP directory only for this exact log pattern, then run Update Now. This does not repair other ELAM or driver errors.
If Sophos Network Threat Protection does not start after installation, first check the Microsoft Visual C++ Runtime and the Windows Base Filtering Engine service. A missing or damaged BFE is an operating-system problem. Do not import registry permissions or complete BFE keys wholesale from another device; matching builds, a backup and a current Microsoft or Sophos Runbook are prerequisites.
If the Network Threat Protection installation log under C:\Windows\Temp explicitly contains E DLL verification error: -2146869243 and a manual service start ends with error 1053, check the certificate-store ACL for LOCAL SERVICE:
Get-Acl Registry::HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates | Format-List
Get-Acl Registry::HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\SystemCertificates\CA | Format-List
LOCAL SERVICE requires full control over both keys. Correct differing permissions only after backing up the registry and identifying the cause, such as a security baseline or GPO. Then restart and trigger another Endpoint update. Copying arbitrary ACLs from another device is also wrong for this error pattern.
If setupapi.dev.log shows code 0xe0000248 for NTP64: General error and a device class {4d36e972-e325-11ce-bfc1-08002be10318} blocked by policy, a Windows GPO is preventing network-adapter installation. Correct the restriction at its managed GPO source, run gpupdate /force, and then start Update Now. Merely deleting the local registry entry is not durable while the GPO remains effective.
If the installer incorrectly reports missing Azure Code Signing support while CloudInstaller.log also shows that Application Control blocked SophosACSenabledTest.exe, the patch level is not the primary cause. The third-party policy, such as WDAC or Intune Application Control, must permit this specific signed Sophos test process during installation.
If Airlock Whitelist Application blocks an upgrade because a cached Sophos Health MSI supposedly has an invalid signature, do not disable signature validation globally. Sophos Health is no longer a separate MSI component in current versions. Preserve the Sophos Health uninstall log and Airlock event, then use the current Sophos Central Endpoint installer for a supported repair installation.
If NTP setup reports Failed to grab execution mutex. System error 258 after ten attempts involving an active installer, another msiexec.exe instance is blocking Windows Installer. First identify the legitimate installation job concerned and wait for it or terminate it in a controlled manner. Do not blindly kill an unknown msiexec process; trigger the Sophos update again once the installer is free.
If the previous MSI registered by Windows Installer is missing during an upgrade, first determine the affected Sophos component and version. A matching MSI may be restored only from the Sophos cache of a device running exactly the same product version and under the filename expected by the installer in C:\Windows\Installer. A foreign MSI or arbitrary newer version further damages installer state; escalate to Sophos Support if no identical source exists.
NTP error 0x80070057 when calling netcfg.exe can indicate a damaged Windows network configuration value under HKLM\SYSTEM\CurrentControlSet\Control\Network. Reproduce the error first with netcfg.exe -s n. Make a registry correction only after exporting the key and according to the current Sophos Runbook because this area affects every Windows network adapter.
Error 0x8004a029 means Windows has reached the default limit of eight NDIS filter drivers. First work with the network and VPN owners to identify and properly uninstall filters that are no longer required. If the documented Windows limit must be raised, Sophos specifies a maximum value of 14; a higher registry value provides no additional slots and only obscures the cause.
If Windows merely reports another installation or update is in progress, identify and wait for the owner of the active installation. Clean up an orphaned Installer\InProgress state only after checking restarts and processes and backing up the registry, never while software deployment is active.
Errors 0xC0190005 or Failed to open transacted registry key: 6801 indicate a damaged or stuck Windows registry transaction state, not a Sophos policy. The official repair steps modify TxR and SMI transaction files and therefore require a backup, a maintenance window and a current Microsoft or Sophos Runbook. Do not use them as generic installer cleanup.
For Health service exit code 3221226505, check whether C:\Windows\SysWOW64\config\systemprofile\AppData\Local is missing. Create the directory and restart the update only for this exact log pattern. StartService failed with error 1053, by contrast, may result from changed C:\ProgramData permissions. Compare effective ACLs and the responsible GPO with Windows defaults; do not broaden permissions indiscriminately across the tenant.
CreateDirectory ... HitmanPro.Alert\Logs failed with error 3 can indicate an orphaned uninstall entry after an interrupted installation. Before removing the key named in the current Sophos KBA, preserve component status, key contents and a registry backup. Do not clean up other uninstall entries merely because their names look similar.
MCS installation error 997 can be related to the Windows Installer Secure Repair function. Do not disable Secure Repair globally. After confirming the error in the MCS installation log, at most add the exactly documented Sophos product code to SecureRepairWhitelist, then review the change against the applicable Windows hardening policy after the repair succeeds.
The numeric installer return code is only a pointer. The decisive evidence is the first ERROR preceding it, the component identifier named there and that component’s own installation log. Do not use old bootstrap-code tables as the sole diagnosis because installer phases and components have changed.
SFS64 reports a missing path
If the Sophos File Scanner log shows Windows error 3 The system cannot find the path specified when copying filerep.dat, the directory C:\ProgramData\Sophos\Sophos File Scanner\Data may be missing. After preserving the logs, create the directory according to the current Sophos KBA and copy filerep.dat and signrep.dat from C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sfs64 into it. Then trigger the update again. This repair applies only to this exact log pattern and is not a general File Scanner reset.
Phase 6: macOS installation and permissions
On a Mac, distinguish the installation itself from missing security permissions. The agent can be installed while Central reports poor Health because a System Extension, Full Disk Access or Network Extension approval is missing.
Check permissions locally, through Terminal and in the MDM platform. Current instructions are available in Sophos Endpoint macOS CLI and permissions.
Phase 7: Registration in Central
After a successful local installation, the device must appear in the correct tenant. If it does not, check Customer Token, MCS reachability, system time, proxy and management communication.
If a duplicate appears, check computer-name, domain or image overrides and earlier Gold Image preparation. Do not hastily delete a device from Central while its Tamper Protection password and diagnostic information are still required.
--registeronly can register an existing healthy Sophos installation again. It does not repair damaged components.
Phase 8: Agent Mode and policy
A completed installation can still be incomplete. Under My Environment > Computers & Servers, check:
- Agent Mode and announced software change,
- Health and Last Active,
- computer group and tags,
- installed components,
- effective policies,
- restart and update Alerts.
Software changes are normally processed at the next update and can take time. Constantly rerunning the installer does not accelerate this process.
When SDU is useful
If bootstrap succeeded but services, updates, communication or Health remain faulty, use Endpoint Self Help and SDU. The support package includes the time range, command, installer logs, SDU and a comparison with a working device.