Error a0490001 Failed to connect to the on-access driver (0x80070002)

  • Artikel-ID: 13773
  • Aktualisiert: 13 Jan 2014

Issue

Enterprise Console reports the following error for the affected endpoint computer:

  • a0490001 Failed to connect to the on-access driver (0x80070002)

The following issues will also be seen on the affected endpoint computer:

  • The on-access scanning displays 'Unknown' in the Sophos Endpoint Security and Control UI
  • Failed to connect to the on-access driver (0x80070002) appears in the SAV.txt file
  • Failed to initialize the on-access Group Security Descriptor appears in the System event log as Event ID 43

First seen in

Sophos Endpoint Security and Control
Enterprise Console

Cause

Various - different solutions listed below.

What To Do

Verify the registry permission are set correctly

Note: Before you make any changes to the registry, ensure that you read the warning about editing the registry.

  1. Open the registry editor (Start | Run | Type: regedit.exe | Press return)
  2. Expand the left hand tree to the following key:

    XP or 2003
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAVOnAccessControl

    Vista+
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAVOnAccess

  3. Right click on this key and click on Permissions
  4. Ensure the following permissions are set:

    XP or 2003

    Administrators - Full Control
    CREATOR OWNER - Special (Subkeys only)
    Power User - Read
    SYSTEM - Full Control
    Users - Read

    Vista+

    Administrators - Full Control
    CREATOR OWNER - Special (Subkeys only)
    SYSTEM - Full Control
    Users - Read

Check that SavOnAccessSid exists

  1. In the same registry key check a value called SavOnAccessSid exists in the right hand pane
  2. If it does not exist then uninstall Sophos Anti-Virus from add/remove programs (Programs & Features on Vista+)
  3. Reboot the endpoint machine
  4. Run the Sophos Endpoint Security and Control installation again once restarted

Recreate the SAV driver files

To recreated the SAV driver files correctly you must first uninstall the Sophos Anti-Virus component and then re-install.

Note: Do not simply re-install over the top of the current installation.  A reboot after removal is recommended.

 
Wenn Sie weitere Informationen oder Unterstützung benötigen, wenden Sie sich bitte an den technischen Support.

Artikel bewerten

Ungenügend Hervorragend

Anmerkungen