- One or more endpoint computers report to the console:
0000006d Restart needed for updates to take effect
- In the endpoint's ALC.log file you see the following:
WARNING: Restart needed for updates to take effect
Having rebooted the computer, even multiple times, the alert remains as outstanding.
Important: Sophos AutoUpdate 184.108.40.2067 (as released with Sophos Anti-Virus 10.0.7 in August 2012) changed the mechanism for storing the 'Reboot Required' state on the endpoint.
The registry value that now records this state is now created under the following volatile key:
A volatile key means the information is stored in memory and is not preserved when the corresponding registry hive is unloaded. For keys under HKLM, this occurs only when the system initiates a full shutdown. This guarantees that the key will be cleared on reboot and the correct state reflected in the console.
First seen in
Enterprise Console 3.0
A registry value is created on the endpoint computer when a reboot is required. If the registry key creation or removal is affected by a third-party application or the message sent from the endpoint does not reach or get processed by the Sophos Management Server then the alert can remain in the console even after the endpoint has performed a reboot. This is because the endpoint does not send a reboot message on every reboot - only when the registry value is present and set to the correct value.
What to do
It is suggested that you upgrade to a version of Sophos Anti-Virus which includes a version of Sophos AutoUpdate greater than 220.127.116.117. For example, Sophos Anti-Virus 10.0.7 and later as the mechanism for storing the reboot required state is less problematic.
If required, you can clear the alert by recreating the registry value on the endpoint and allowing the computer to report it has rebooted. Alternatively, if there is a large number of computers affected, you can clear the alert directly from the Sophos database.
From the endpoint
- Go to the computer identified in the alert. You will need to create a registry key. Ensure that you have read the warning about editing the registry, and that you feel confident to do so.
- Create a new registry value:
- For 32-bit systems this must be a
DWORD value called
RebootRequired and set to
- For 64-bit systems this must be under:
- Perform an update now of the computer, either from Enterprise Console or initiated at the client. To do so from the client, right click on the Sophos notification tray icon (shield) and choose 'Update now'). Note: This will send a reboot message to the server.
- Change the value of the key created in step 2 to
- Perform a second update now of the computer as before in step 3.
Note: You may want to script the above (e.g., VB Script). You should create your own script for writing and modifying the registry and fully test. To learn how to activate Sophos AutoUpdate via VBS see article 36262 under the 'ALSvc.exe' (AutoUpdate process) section.
Clear outstanding alerts directly from database
Warning: We recommend you have recent backup of the Sophos database before modifying the database. See article 114299 (console 5.x only) or 110380 (all versions).
Use the PurgeDB.exe tool to clear the particular warning by running the command:
PurgeDB.exe -action=delete -category=errors -historylengthindays=0 -type=AutoUpdate -code=109