Sophos security software: updates are failing and the Domain Controller reports Security Event 529

Issue
Updates are failing and Security Event 529 is logged on the Domain Controller by local SophosSAU accounts.

Sophos product and version
Sophos Anti-Virus for Windows 2000+

Operating system
Microsoft Windows Server

What to do

1. Please download and install the Microsoft service pack available from this Microsoft knowledgebase article:
   http://support.microsoft.com/?kbid=811082
   
2. In the Windows Registry, add the AutoUpdate account as a Domain user:

HKLM\Software\Sophos\AutoUpdate\Service\

Download User=<DOMAIN>\<USER> with relevant password

Technical Information

The following event is logged twice in the Security log in the domain controller:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: domain controller computer name
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Sophos_ALC_Service
Domain: client computer name
Logon Type: 3
Logon Process: KSecDD
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: client computer name

For more information, see the Microsoft Help and Support Center at http://support.microsoft.com.