Sophos

Online support

Product maintenance

Contact support

Support services

Sophos Anti-Virus SBE: error 529 present in Sophos Control Center server event log

On Sophos Anti-Virus Small Business Edition (SBE) you could see the following logon failure errors in the Sophos Control Center server's Event Log:

Source Event ID Last Occurrence Total Occurrences
Security 529 [date and time]
Logon Failure:
Reason: Unknown user name or bad password

This happens because Sophos Anti-Virus SBE creates a new user account, Sophos_AU_Client, on each workstation during installation, and that user is not known to the Windows audit policy.

What to do

You will need to change the Sophos_AU_Client username and password in the Windows registry. Please read the warning about editing the registry.

  1. Go to the server running the Sophos Control Center.
  2. Open the registry editor.
  3. Browse to HKEY_LOCAL_MACHINE\Software\Sophos\SBE\Management Tools\SAUUser
  4. Double click 'Download Password'.
  5. Press Ctrl-C to copy the password to the clipboard.

You now need to apply this password to all of the affected workstations:

  1. Still in the registry editor, select File|Connect Network Registry.
  2. Type the name of one of the affected computers.
  3. Browse to the following registry entry:
    [computer_name]\HKEY_LOCAL_MACHINE\Software\Sophos\Autoupdate\Service
  4. Double-click 'Download User'.
  5. Replace the account listed there with "[domain]\Sophos_AU_Client" (where [domain] is your domain name).
  6. Double-click 'Download Password'.
  7. Use Ctrl-V to paste the password.
  8. Repeat this process for all of the other workstations.
  9. Close the registry editor.

Check that the workstations are updating correctly, and check the log to see that 529 errors are no longer being reported.

If you need more information or guidance, then please contact technical support.