Updating fails with error '00000070' and 'A Windows API call returned error 1385'

  • Article ID: 117449
  • Rating:
  • 5 customers rated this article 1.2 out of 6
  • Updated: 17 Jul 2013

Issue

Automatic updates are failing, the following is logged in the Sophos Console:

00000070 There was a problem while establishing a connection to the server. Details: LogonUser ("SophosSAUxxx0", ".", ...) failed A Windows API call returned error 1385.

Additional Information

Error 1385 is a Windows system error that means the following:

Logon failure: The user has not been granted the requested logon type at this computer.

First seen in

Sophos Anti-Virus for Windows 2000+

Cause

This can occur if the Authenticated Users group has "Deny log on as a service" enabled. 

What To Do

Check the policy applied to the computer.

Standalone or Workgroup Networks - Local Security Settings:

  1. Click Start > Run and type gpedit.msc
  2. Browse to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Deny log on as a Service
  3. Remove "Authenticated Users" from this object.

Domain Group Policy Windows 2003/2008 Active Directory:

  1. Click Start > Run and type gpmc.msc
  2. Right click the Group Policy Object you wish to edit and select Edit
  3. Browse to Computer Configuration > Policies> Windows Settings > Security Settings > Local Policies > User Rights Assignment > Deny log on as a Service
  4. Remove "Authenticated Users" from this object

If the problem persists:

Switch to HTTP updating

HTTP updating can be used to work around this issue. See article 38238 for more information.

Create a new account for Sophos AutoUpdate

A new account can be created for AutoUpdate to use for during updates, before working through these steps you will need to see Manually creating an AutoUpdate account for details.

 
If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent

Comments