Error: '0x80004005 Missing required file Program Directory: C:\Program Files\Sophos\Sophos Patch Agent\ File: mcescan.cab'

  • Article ID: 119393
  • Updated: 20 May 2013

Issue

A client computer fails to send Patch assessments back to the Patch Event Viewer within Sophos Enterprise Console. On the client, the xxxx_session.log in:

Windows XP/2003 - C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Patch Agent\Logs\

Windows Vista+ - C:\Program Data\Sophos\Sophos Patch Agent\Logs\

contains the below text:

Code: 0x80004005 Unspecified error Evidence: Info Msg: Missing required file Program Directory: C:\Program Files\Sophos\Sophos Patch Agent\ File: mcescan.cab

First seen in

Sophos Endpoint Security and Control 10.0

Cause

Sophos Enterprise Console 5.0 and 5.1 use a default 1 minute timeout for file transfer to Patch client computers, on some networks this may not allow enough time to download the large mcescan.cab file.

Sophos Enterprise Console 5.2 has this setting increased to 5 minutes by default.

What To Do

This issue needs to be resolved on the Sophos Enterprise Console server and all affected clients.

Resolving the issue on the Sophos Enterprise Console server

You need to take either of the below actions:

  • Upgrade to Sophos Enterprise Console 5.2
  • Increase the timeout for the download to 5 minutes:
    1. Stop the Sophos Patch Endpoint Communicator service (Start | Run | Type: services.msc | Press Enter)
    2. Browse to C:\Program Files\Sophos\Patch\PatchEndpointCommunicator\
    3. Make a backup copy of the existing PatchEndpointCommunicator.exe.config file
    4. Open the PatchEndpointCommunicator.exe.config file using Notepad
    5. Edit the below line:

      <binding name="PatchBindingConfiguration" maxReceivedMessageSize="2000000" transferMode="Streamed">

    6. Change this line to:

      <binding name="PatchBindingConfiguration" maxReceivedMessageSize="2000000" transferMode="Streamed" sendTimeout="00:05:00">

    7. Save the file and exit Notepad
    8. Start the Sophos Patch Endpoint Communicator service

Resolving the issue on the client computers

  1. Locate the most recent xxxx_session.log in:

    Windows XP/2003 - C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Patch Agent\Logs\

    Windows Vista+ - C:\Program Data\Sophos\Sophos Patch Agent\Logs\

  2. In the session log, look for the last error similar to the below extract:

    Http Retrieve file failed. Server: secserver.domain.com Port: 80 Action: /Sophos/Management/Patch/EndpointCommunicator/v101/file/0064d5e5c2d142f2a9b9f32d1d0a6d3a

  3. Note the file name - in the above extract this is 0064d5e5c2d142f2a9b9f32d1d0a6d3a
  4. Delete this file from a sub-folder within the Windows Temporary Internet Files:

    Windows XP/2003 - C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\

    Windows Vista+ - C:\Windows\System32\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\

    Note: The 'Hide protected operating system files' option needs to be disabled within Windows Explorer to view this folder

  5. Log on to the Sophos Enterprise Console server and select the Dashboard view within Sophos Enterprise Console
  6. Right-click the affected client computer | select 'Comply with' | 'Group Patch policy', this will initiate a download of the mcescan.cab file to the affected computer

 
If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent

Comments