Share via

Uninstallation SOPHOS

Duchemin, Dominique 2,006 Reputation points
2022-08-09T05:19:59.597+00:00

Hello,

I have the following:
229250-2022-08-08-22-45-43-sophos-uninstall-00.png

Should it be
Install & Available
Install & Required
Uninstall & Available
Uninstall & Required

229309-2022-08-08-22-13-39-sophos-uninstall-01.png

then
229386-2022-08-08-22-14-10-sophos-uninstall-02.png

The result is when SOPHOS exists on the machine it is compliant and does not run the command "SOPHOS Uninstallation.bat"? Is the detection method wrong?
If I ran the command "SOPHOS Uninstallation.bat" locally on the client it uninstall SOPHOS perfectly...

Batch File:

REM Uninstallation of Sophos

REM Stop the AutoUpdate Service
net stop "Sophos AutoUpdate Service"

REM Sophos Remote Management System
REM HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall{FED1005D-CBC8-45D5-A288-FFC7BB304121}
MsiExec.exe /X{FED1005D-CBC8-45D5-A288-FFC7BB304121} /qn /L*v %windir%\Temp\Uninstall_SRMS_Log.txt

REM Sophos Anti-Virus
REM HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall{723D5504-CE98-4785-AF5F-E91E250086B3}
MsiExec.exe /X{723D5504-CE98-4785-AF5F-E91E250086B3} /qn /L*v %windir%\Temp\Uninstall_SAV_Log.txt

REM Sophos AutoUpdate
REM HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall{644ADF05-0B2E-452C-B720-3CF1580A9368}
MsiExec.exe /X{644ADF05-0B2E-452C-B720-3CF1580A9368} /qn /L*v %windir%\Temp\Uninstall_SAU_Log.txt

REM Sophos Endpoint Defense
REM HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Sophos Endpoint Defense
"C:\Program Files\Sophos\Endpoint Defense\SEDuninstall.exe" /qn /L*v %windir%\Temp\Uninstall_SDE_Log.txt

229350-2022-08-08-22-56-52-sophos-uninstall-dps.png
I do not see anything in the c:\Windows\ccmcache on the client, is it normal?

Thanks,
Dom

Microsoft Security | Intune | Configuration Manager | Other
0 comments

6 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rahul Jindal [MVP] 10,911 Reputation points MVP
    2022-08-09T05:55:15.423+00:00

    Configure both installation and uninstallation command lines in the application deployment type. Deploy uninstall as action type and ConfigMgr will take care of the reverse detection logic.

    1 person found this answer helpful.
    0 comments
  2. Garth 5,801 Reputation points
    2022-08-09T09:56:53.483+00:00

    Review the logs, it will tell you if it is detected or not.

    1 person found this answer helpful.
  3. Duchemin, Dominique 2,006 Reputation points
    2022-08-09T06:32:12.207+00:00

    Something like this?
    229443-2022-08-08-23-02-14-sophos-uninstall-03.png

    I Updated the content and did a deployment with Action Type Uninstall
    I ran Machine Policy and Deployment Cycle on the client

    It still running for .... when I run it locally it is fast !!!

    Anything to look for any delay...

    Thanks,
    DOm

    0 comments
  4. Duchemin, Dominique 2,006 Reputation points
    2022-08-09T15:51:28.783+00:00

    Hello,

    The last deployment was better,
    229599-2022-08-09-7-08-59-sophos-uninstall-status.png
    229625-2022-08-09-7-00-30-vstloadgen05-sophos.png

    At least one machine - fresh deployment - got the SOPHOS software uninstalled and failed at the end of the process!!! Which log(s) should I check for this failure?

    The other machine might have been corrupted by the previous attempt and not the latest deployment is yet to be seen!!!

    Thanks,
    Dom

    0 comments
  5. Duchemin, Dominique 2,006 Reputation points
    2022-08-09T16:45:31.847+00:00

    Hello,

    For the machine getting the Timeout:

    VSTLOADGEN04

    AppDiscovery.log 

    Performing detection of app deployment type ISS - Servers - Uninstallation SOPHOS(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, revision 3) for system. AppDiscovery 8/8/2022 11:37:48 PM 62816 (0xF560)

    +++ Discovered application [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, Revision: 3] AppDiscovery 8/8/2022 11:37:48 PM 62816 (0xF560)
    +++ Detected app deployment type ISS - Servers - Uninstallation SOPHOS(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, revision 3) for system. AppDiscovery 8/8/2022 11:37:48 PM 62816 (0xF560)
    ActionType - Uninstall will use Content Id: Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d + Content Version: 1 for AppDT "ISS - Servers - Uninstallation SOPHOS" [ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1], Revision - 3 AppDiscovery 8/8/2022 11:37:48 PM 62816 (0xF560)
    Method EnforceApp failed with error 87D00213 AppDiscovery 8/9/2022 1:10:16 AM 95528 (0x17528)
    CAppProvider::ExecMethodAsync failed. Error 87d00213 AppDiscovery 8/9/2022 1:10:16 AM 95528 (0x17528)

    AppEnforce.log

    +++ Starting Uninstall enforcement for App DT "ISS - Servers - Uninstallation SOPHOS" ApplicationDeliveryType - ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, Revision - 3, ContentPath - C:\Windows\ccmcache\7, Execution Context - System AppEnforce 8/8/2022 11:10:15 PM 95528 (0x17528)
    Performing detection of app deployment type ISS - Servers - Uninstallation SOPHOS(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, revision 3) for system. AppEnforce 8/8/2022 11:10:15 PM 95528 (0x17528)
    +++ Discovered application [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, Revision: 3] AppEnforce 8/8/2022 11:10:16 PM 95528 (0x17528)
    App enforcement environment:
    Context: Machine
    Command line: "SOPHOS Uninstallation.bat"
    Allow user interaction: No
    UI mode: 1
    User token: null
    Session Id: 4294967295
    Content path: C:\Windows\ccmcache\7
    Working directory: AppEnforce 8/8/2022 11:10:16 PM 95528 (0x17528)
    Prepared working directory: C:\Windows\ccmcache\7 AppEnforce 8/8/2022 11:10:16 PM 95528 (0x17528)
    Prepared command line: "C:\Windows\ccmcache\7\SOPHOS Uninstallation.bat" AppEnforce 8/8/2022 11:10:16 PM 95528 (0x17528)
    Executing Command line: "C:\Windows\ccmcache\7\SOPHOS Uninstallation.bat" with system context AppEnforce 8/8/2022 11:10:16 PM 95528 (0x17528)
    Working directory C:\Windows\ccmcache\7 AppEnforce 8/8/2022 11:10:16 PM 95528 (0x17528)
    Post install behavior is BasedOnExitCode AppEnforce 8/8/2022 11:10:16 PM 95528 (0x17528)
    Waiting for process 92912 to finish. Timeout = 120 minutes. AppEnforce 8/8/2022 11:10:16 PM 95528 (0x17528)
    Exceeded timeout of 120 minutes while waiting for process 92912 to finish. AppEnforce 8/9/2022 1:10:16 AM 95528 (0x17528)
    WaitForRunningProcess failed. Error 0x87d00213. AppEnforce 8/9/2022 1:10:16 AM 95528 (0x17528)
    CScriptHandler::CompleteEnforcement failed with 0x87d00213 AppEnforce 8/9/2022 1:10:16 AM 95528 (0x17528)
    CAppProvider::CompleteEnforcement failed with error 0x87d00213 AppEnforce 8/9/2022 1:10:16 AM 95528 (0x17528)
    ++++++ Failed to enforce app. Error 0x87d00213. ++++++ AppEnforce 8/9/2022 1:10:16 AM 95528 (0x17528)

    AppIntentEval.log

    • Evaluating Application policies for Machine AppIntentEval 8/8/2022 11:37:48 PM 70024 (0x11188)
      ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1/3 :- Current State = Installed, Applicability = Applicable, ResolvedState = NotInstalled, ConfigureState = NotNeeded, Title = ISS - Servers - Uninstallation SOPHOS AppIntentEval 8/8/2022 11:37:48 PM 70024 (0x11188)
      ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/Application_fc688e8b-6158-4cc0-a62b-e961bbb9b5f3/4 :- Current State = Installed, Applicability = Applicable, ResolvedState = NotInstalled, ConfigureState = NotNeeded, Title = ISS - Servers - Uninstallation SOPHOS AppIntentEval 8/8/2022 11:37:48 PM 70024 (0x11188)
      ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/ProhibitedApplication_fc688e8b-6158-4cc0-a62b-e961bbb9b5f3/4 :- Current State = NonCompliant, Applicability = Applicable, ResolvedState = Compliant, ConfigureState = NotNeeded, Title = ApplicationIntentPolicy AppIntentEval 8/8/2022 11:37:48 PM 70024 (0x11188)

    ExecMgr.log

    CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : END Event execmgr 8/8/2022 5:00:00 AM 59404 (0xE80C)
    CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : START Event execmgr 8/8/2022 10:00:00 PM 96288 (0x17820)
    User policy is disabled on multi-user terminal server execmgr 8/8/2022 10:00:00 PM 96288 (0x17820)
    CExecutionRequestManager::OnServiceWindowEvent for START execmgr 8/8/2022 10:00:00 PM 96288 (0x17820)
    Auto Install is set to false. Do Nothing. execmgr 8/8/2022 10:00:00 PM 96288 (0x17820)
    CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : END Event execmgr 8/9/2022 5:00:00 AM 101604 (0x18CE4)

    LocationServices.log

    Executing Task LSRefreshLocationsTask LocationServices 8/8/2022 10:26:06 PM 96288 (0x17820)
    Current AD site of machine is SDC LocationServices 8/8/2022 11:10:06 PM 4704 (0x1260)
    CcmGetLocationOverride LocationServices 8/8/2022 11:10:06 PM 4704 (0x1260)
    LocationOverride flags detected on Client LocationServices 8/8/2022 11:10:06 PM 4704 (0x1260)
    ContentLocationRequest : <ContentLocationRequest SchemaVersion="1.00" BGRVersion="1" ClientInOperation="PT0M" ExcludeFileList=""><Package ID="UID:Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d" Version="1" DeploymentFlags="9223372036855632594"/><AssignedSite SiteCode="UCP"/><ClientLocationInfo LocationType="SMSUpdate" DistributeOnDemand="0" UseAzure="1" AllowWUMU="0" UseInternetDP="0" AllowHTTP="1" AllowSMB="0" AllowMulticast="0" AllowSuperPeer="1" DPTokenAuth="1"><ADSite Name="SDC"/><Forest Name="ad"/><Domain Name="ad"/><IPAddresses><IPAddress SubnetAddress="10.12.173.0" Address="10.12.173.39"/></IPAddresses><Adapters><Adapter Name="Ethernet" IfType="6" PhysicalAddressExists="1" DnsSuffix="" Description="vmxnet3 Ethernet Adapter"/></Adapters><BoundaryGroups BoundaryGroupListRetrieveTime="2022-08-08T23:17:56.443" IsOnVPN="0"><BoundaryGroup GroupID="16777219" GroupGUID="CBE303DF-7E0D-4393-AF2F-0FCA1721F057" GroupFlag="0"/></BoundaryGroups></ClientLocationInfo></ContentLocationRequest>
    LocationServices 8/8/2022 11:10:06 PM 4704 (0x1260)
    Created and Sent Location Request '{F5E603C7-AECF-48E9-95D7-51794CEB9134}' for package Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d LocationServices 8/8/2022 11:10:06 PM 4704 (0x1260)
    Current AD site of machine is SDC LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    sRelatedContentIDs is <RelatedContentIDs><RelatedContentID ID="Content_65b200c4-f614-4bc9-9e83-80a73219a738.1"/></RelatedContentIDs>. Length = 110 LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    This machine is not a workstation, returning false for MDMIsExternallyManaged. LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Calling back with the following distribution points LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='http://VSPSCCMDP01.ad/SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://VSPSCCMDP01.ad/SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='http://DGIT-DP-SCCM-P1.ad/SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://DGIT-DP-SCCM-P1.ad/SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='http://DGIT-DP-SCCM-P1.ad/NOCERT_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://DGIT-DP-SCCM-P1.ad/NOCERT_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='http://VSPSCCMDP01.ad/NOCERT_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://VSPSCCMDP01.ad/NOCERT_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='https://VSPSCCMDP01.ad/CCMTOKENAUTH_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/><Property Name="AuthMethod" Value="1024"/></Capabilities>', Signature='https://VSPSCCMDP01.ad/CCMTOKENAUTH_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='https://DGIT-DP-SCCM-P1.ad/CCMTOKENAUTH_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/><Property Name="AuthMethod" Value="1024"/></Capabilities>', Signature='https://DGIT-DP-SCCM-P1.ad/CCMTOKENAUTH_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Called back with 6 locations for location request {F5E603C7-AECF-48E9-95D7-51794CEB9134} LocationServices 8/8/2022 11:10:08 PM 81108 (0x13CD4)
    Executing Task LSRefreshLocationsTask LocationServices 8/8/2022 11:26:06 PM 4704 (0x1260)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 12:26:06 AM 8368 (0x20B0)
    LocationServices.log
    Executing Task LSRefreshLocationsTask LocationServices 8/8/2022 10:26:06 PM 96288 (0x17820)
    Current AD site of machine is SDC LocationServices 8/8/2022 11:10:06 PM 4704 (0x1260)
    CcmGetLocationOverride LocationServices 8/8/2022 11:10:06 PM 4704 (0x1260)
    LocationOverride flags detected on Client LocationServices 8/8/2022 11:10:06 PM 4704 (0x1260)
    ContentLocationRequest : <ContentLocationRequest SchemaVersion="1.00" BGRVersion="1" ClientInOperation="PT0M" ExcludeFileList=""><Package ID="UID:Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d" Version="1" DeploymentFlags="9223372036855632594"/><AssignedSite SiteCode="UCP"/><ClientLocationInfo LocationType="SMSUpdate" DistributeOnDemand="0" UseAzure="1" AllowWUMU="0" UseInternetDP="0" AllowHTTP="1" AllowSMB="0" AllowMulticast="0" AllowSuperPeer="1" DPTokenAuth="1"><ADSite Name="SDC"/><Forest Name="ad"/><Domain Name="ad"/><IPAddresses><IPAddress SubnetAddress="10.12.173.0" Address="10.12.173.39"/></IPAddresses><Adapters><Adapter Name="Ethernet" IfType="6" PhysicalAddressExists="1" DnsSuffix="" Description="vmxnet3 Ethernet Adapter"/></Adapters><BoundaryGroups BoundaryGroupListRetrieveTime="2022-08-08T23:17:56.443" IsOnVPN="0"><BoundaryGroup GroupID="16777219" GroupGUID="CBE303DF-7E0D-4393-AF2F-0FCA1721F057" GroupFlag="0"/></BoundaryGroups></ClientLocationInfo></ContentLocationRequest>
    LocationServices 8/8/2022 11:10:06 PM 4704 (0x1260)
    Created and Sent Location Request '{F5E603C7-AECF-48E9-95D7-51794CEB9134}' for package Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d LocationServices 8/8/2022 11:10:06 PM 4704 (0x1260)
    Current AD site of machine is SDC LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    sRelatedContentIDs is <RelatedContentIDs><RelatedContentID ID="Content_65b200c4-f614-4bc9-9e83-80a73219a738.1"/></RelatedContentIDs>. Length = 110 LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    This machine is not a workstation, returning false for MDMIsExternallyManaged. LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Calling back with the following distribution points LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='http://VSPSCCMDP01.ad/SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://VSPSCCMDP01.ad/SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='http://DGIT-DP-SCCM-P1.ad/SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://DGIT-DP-SCCM-P1.ad/SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='http://DGIT-DP-SCCM-P1.ad/NOCERT_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://DGIT-DP-SCCM-P1.ad/NOCERT_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='http://VSPSCCMDP01.ad/NOCERT_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://VSPSCCMDP01.ad/NOCERT_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='https://VSPSCCMDP01.ad/CCMTOKENAUTH_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/><Property Name="AuthMethod" Value="1024"/></Capabilities>', Signature='https://VSPSCCMDP01.ad/CCMTOKENAUTH_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Distribution Point='https://DGIT-DP-SCCM-P1.ad/CCMTOKENAUTH_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/><Property Name="AuthMethod" Value="1024"/></Capabilities>', Signature='https://DGIT-DP-SCCM-P1.ad/CCMTOKENAUTH_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:10:07 PM 81108 (0x13CD4)
    Called back with 6 locations for location request {F5E603C7-AECF-48E9-95D7-51794CEB9134} LocationServices 8/8/2022 11:10:08 PM 81108 (0x13CD4)
    Executing Task LSRefreshLocationsTask LocationServices 8/8/2022 11:26:06 PM 4704 (0x1260)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 12:26:06 AM 8368 (0x20B0)

    Any other logs to be reviewed for this failure?

    ====================================================================================================================================

    For the machine uninstalling but failing as shown in Software Center:

    VSTLOADGEN05

    AppDiscovery.log

    Entering ExecQueryAsync for query "select * from CCM_AppDeliveryType where (AppDeliveryTypeId = "ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1" AND Revision = 3)" AppDiscovery 8/8/2022 11:46:07 PM 23848 (0x5D28)
    Performing detection of app deployment type ISS - Servers - Uninstallation SOPHOS(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, revision 3) for system. AppDiscovery 8/8/2022 11:46:07 PM 23848 (0x5D28)
    +++ Discovered application [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, Revision: 3] AppDiscovery 8/8/2022 11:46:07 PM 23848 (0x5D28)
    +++ Detected app deployment type ISS - Servers - Uninstallation SOPHOS(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, revision 3) for system. AppDiscovery 8/8/2022 11:46:07 PM 23848 (0x5D28)
    ActionType - Uninstall will use Content Id: Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d + Content Version: 1 for AppDT "ISS - Servers - Uninstallation SOPHOS" [ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1], Revision - 3 AppDiscovery 8/8/2022 11:46:09 PM 19632 (0x4CB0)
    Entering ExecQueryAsync for query "select * from CCM_AppDeliveryType where (AppDeliveryTypeId = "ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1" AND Revision = 3)" AppDiscovery 8/8/2022 11:59:02 PM 44868 (0xAF44)
    Performing detection of app deployment type ISS - Servers - Uninstallation SOPHOS(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, revision 3) for system. AppDiscovery 8/8/2022 11:59:02 PM 44868 (0xAF44)
    +++ Discovered application [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, Revision: 3] AppDiscovery 8/8/2022 11:59:02 PM 44868 (0xAF44)
    +++ Detected app deployment type ISS - Servers - Uninstallation SOPHOS(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, revision 3) for system. AppDiscovery 8/8/2022 11:59:02 PM 44868 (0xAF44)

    AppEnforce.log

    +++ Starting Uninstall enforcement for App DT "ISS - Servers - Uninstallation SOPHOS" ApplicationDeliveryType - ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, Revision - 3, ContentPath - C:\Windows\ccmcache\8, Execution Context - System AppEnforce 8/8/2022 11:46:36 PM 97980 (0x17EBC)
    Performing detection of app deployment type ISS - Servers - Uninstallation SOPHOS(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, revision 3) for system. AppEnforce 8/8/2022 11:46:36 PM 97980 (0x17EBC)
    +++ Discovered application [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, Revision: 3] AppEnforce 8/8/2022 11:46:37 PM 97980 (0x17EBC)
    App enforcement environment:
    Context: Machine
    Command line: "SOPHOS Uninstallation.bat"
    Allow user interaction: No
    UI mode: 1
    User token: null
    Session Id: 4294967295
    Content path: C:\Windows\ccmcache\8
    Working directory: AppEnforce 8/8/2022 11:46:37 PM 97980 (0x17EBC)
    Prepared working directory: C:\Windows\ccmcache\8 AppEnforce 8/8/2022 11:46:37 PM 97980 (0x17EBC)
    Prepared command line: "C:\Windows\ccmcache\8\SOPHOS Uninstallation.bat" AppEnforce 8/8/2022 11:46:37 PM 97980 (0x17EBC)
    Executing Command line: "C:\Windows\ccmcache\8\SOPHOS Uninstallation.bat" with system context AppEnforce 8/8/2022 11:46:37 PM 97980 (0x17EBC)
    Working directory C:\Windows\ccmcache\8 AppEnforce 8/8/2022 11:46:37 PM 97980 (0x17EBC)
    Post install behavior is BasedOnExitCode AppEnforce 8/8/2022 11:46:37 PM 97980 (0x17EBC)
    Waiting for process 21228 to finish. Timeout = 120 minutes. AppEnforce 8/8/2022 11:46:37 PM 97980 (0x17EBC)
    Process 21228 terminated with exitcode: 0 AppEnforce 8/9/2022 1:30:48 AM 97980 (0x17EBC)
    Looking for exit code 0 in exit codes table... AppEnforce 8/9/2022 1:30:48 AM 97980 (0x17EBC)
    Matched exit code 0 to a Success entry in exit codes table. AppEnforce 8/9/2022 1:30:48 AM 97980 (0x17EBC)
    Performing detection of app deployment type ISS - Servers - Uninstallation SOPHOS(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, revision 3) for system. AppEnforce 8/9/2022 1:30:48 AM 97980 (0x17EBC)
    +++ Discovered application [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1, Revision: 3] AppEnforce 8/9/2022 1:30:48 AM 97980 (0x17EBC)
    ++++++ App enforcement completed (6251 seconds) for App DT "ISS - Servers - Uninstallation SOPHOS" [ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1], Revision: 3, User SID: ] ++++++ AppEnforce 8/9/2022 1:30:48 AM 97980 (0x17EBC)

    AppIntentEval.log

    • Evaluating Application policies for Machine AppIntentEval 8/8/2022 11:46:07 PM 24128 (0x5E40)
      ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1/3 :- Current State = Installed, Applicability = Applicable, ResolvedState = NotInstalled, ConfigureState = NotNeeded, Title = ISS - Servers - Uninstallation SOPHOS AppIntentEval 8/8/2022 11:46:07 PM 24128 (0x5E40)
      ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/Application_fc688e8b-6158-4cc0-a62b-e961bbb9b5f3/4 :- Current State = Installed, Applicability = Applicable, ResolvedState = NotInstalled, ConfigureState = NotNeeded, Title = ISS - Servers - Uninstallation SOPHOS AppIntentEval 8/8/2022 11:46:07 PM 24128 (0x5E40)
      ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/ProhibitedApplication_fc688e8b-6158-4cc0-a62b-e961bbb9b5f3/4 :- Current State = NonCompliant, Applicability = Applicable, ResolvedState = Compliant, ConfigureState = NotNeeded, Title = ApplicationIntentPolicy AppIntentEval 8/8/2022 11:46:07 PM 24128 (0x5E40)
      No dependencies for DeploymentType ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1/3. AppIntentEval 8/8/2022 11:59:02 PM 5548 (0x15AC)
    • Evaluating Application policies for Machine AppIntentEval 8/8/2022 11:59:02 PM 5548 (0x15AC)
      ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_fe4a93e8-b0ef-4f76-a36e-4f9bfe229ba1/3 :- Current State = Installed, Applicability = Applicable, ResolvedState = NotInstalled, ConfigureState = NotNeeded, Title = ISS - Servers - Uninstallation SOPHOS AppIntentEval 8/8/2022 11:59:02 PM 5548 (0x15AC)
      ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/Application_fc688e8b-6158-4cc0-a62b-e961bbb9b5f3/4 :- Current State = Installed, Applicability = Applicable, ResolvedState = NotInstalled, ConfigureState = NotNeeded, Title = ISS - Servers - Uninstallation SOPHOS AppIntentEval 8/8/2022 11:59:02 PM 5548 (0x15AC)
      ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/ProhibitedApplication_fc688e8b-6158-4cc0-a62b-e961bbb9b5f3/4 :- Current State = NonCompliant, Applicability = Applicable, ResolvedState = Compliant, ConfigureState = NotNeeded, Title = ApplicationIntentPolicy AppIntentEval 8/8/2022 11:59:02 PM 5548 (0x15AC)
    • Evaluating Application policies for S-1-5-21-73586283-1284227242-1801674531-296580 AppIntentEval 8/9/2022 12:57:32 AM 2968 (0x0B98)

    ExecMgr.log

    CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : END Event execmgr 8/8/2022 5:00:00 AM 8312 (0x2078)
    CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : START Event execmgr 8/8/2022 10:00:00 PM 2968 (0x0B98)
    User policy is disabled on multi-user terminal server execmgr 8/8/2022 10:00:00 PM 2968 (0x0B98)
    CExecutionRequestManager::OnServiceWindowEvent for START execmgr 8/8/2022 10:00:00 PM 2968 (0x0B98)
    Auto Install is set to false. Do Nothing. execmgr 8/8/2022 10:00:00 PM 2968 (0x0B98)
    CServiceWindowEventHandler::Execute - Received SERVICEWINDOWEVENT : END Event execmgr 8/9/2022 5:00:00 AM 98460 (0x1809C)

    =================================================

    LocationServices.log

    Executing Task LSRefreshLocationsTask LocationServices 8/8/2022 10:21:01 PM 20120 (0x4E98)
    Executing Task LSRefreshLocationsTask LocationServices 8/8/2022 11:21:01 PM 2968 (0x0B98)
    Current AD site of machine is SDC LocationServices 8/8/2022 11:46:10 PM 24128 (0x5E40)
    CcmGetLocationOverride LocationServices 8/8/2022 11:46:10 PM 24128 (0x5E40)
    LocationOverride flags detected on Client LocationServices 8/8/2022 11:46:10 PM 24128 (0x5E40)
    ContentLocationRequest : <ContentLocationRequest SchemaVersion="1.00" BGRVersion="1" ClientInOperation="PT0M" ExcludeFileList=""><Package ID="UID:Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d" Version="1" DeploymentFlags="9223372036855632594"/><AssignedSite SiteCode="UCP"/><ClientLocationInfo LocationType="SMSUpdate" DistributeOnDemand="0" UseAzure="1" AllowWUMU="0" UseInternetDP="0" AllowHTTP="1" AllowSMB="0" AllowMulticast="0" AllowSuperPeer="1" DPTokenAuth="1"><ADSite Name="SDC"/><Forest Name="ad"/><Domain Name="ad"/><IPAddresses><IPAddress SubnetAddress="10.12.173.0" Address="10.12.173.240"/></IPAddresses><Adapters><Adapter Name="Ethernet" IfType="6" PhysicalAddressExists="1" DnsSuffix="" Description="vmxnet3 Ethernet Adapter"/></Adapters><BoundaryGroups BoundaryGroupListRetrieveTime="2022-08-09T02:01:58.790" IsOnVPN="0"><BoundaryGroup GroupID="16777219" GroupGUID="CBE303DF-7E0D-4393-AF2F-0FCA1721F057" GroupFlag="0"/></BoundaryGroups></ClientLocationInfo></ContentLocationRequest>
    LocationServices 8/8/2022 11:46:10 PM 24128 (0x5E40)
    Created and Sent Location Request '{52AD34A4-A6C7-4C56-91EF-1DC65B8D49FA}' for package Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d LocationServices 8/8/2022 11:46:10 PM 24128 (0x5E40)
    Current AD site of machine is SDC LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    sRelatedContentIDs is <RelatedContentIDs><RelatedContentID ID="Content_65b200c4-f614-4bc9-9e83-80a73219a738.1"/></RelatedContentIDs>. Length = 110 LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    This machine is not a workstation, returning false for MDMIsExternallyManaged. LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    Calling back with the following distribution points LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    Distribution Point='http://DGIT-DP-SCCM-P1.ad/SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://DGIT-DP-SCCM-P1.ad/SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    Distribution Point='http://VSPSCCMDP01.ad/SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://VSPSCCMDP01.ad/SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    Distribution Point='http://DGIT-DP-SCCM-P1.ad/NOCERT_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://DGIT-DP-SCCM-P1.ad/NOCERT_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    Distribution Point='http://VSPSCCMDP01.ad/NOCERT_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/></Capabilities>', Signature='http://VSPSCCMDP01.ad/NOCERT_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    Distribution Point='https://DGIT-DP-SCCM-P1.ad/CCMTOKENAUTH_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/><Property Name="AuthMethod" Value="1024"/></Capabilities>', Signature='https://DGIT-DP-SCCM-P1.ad/CCMTOKENAUTH_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    Distribution Point='https://VSPSCCMDP01.ad/CCMTOKENAUTH_SMS_DP_SMSPKG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1', Locality='BOUNDARYGROUP', Version='9078', Capabilities='<Capabilities SchemaVersion="1.0"><Property Name="SSL" Version="1"/><Property Name="SSLState" Value="63"/><Property Name="AuthMethod" Value="1024"/></Capabilities>', Signature='https://VSPSCCMDP01.ad/CCMTOKENAUTH_SMS_DP_SMSSIG$/Content_6ac3c5a8-fb19-4f6e-a353-93cf90282c6d.1.tar', ForestTrust='TRUE', BlockInfo='0' LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    Called back with 6 locations for location request {52AD34A4-A6C7-4C56-91EF-1DC65B8D49FA} LocationServices 8/8/2022 11:46:11 PM 56284 (0xDBDC)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 12:21:01 AM 40580 (0x9E84)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 1:21:02 AM 62528 (0xF440)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 2:21:02 AM 43844 (0xAB44)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 3:21:02 AM 80296 (0x139A8)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 4:21:02 AM 55312 (0xD810)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 5:21:02 AM 31900 (0x7C9C)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 6:21:02 AM 92408 (0x168F8)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 7:21:02 AM 98292 (0x17FF4)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 8:21:02 AM 97432 (0x17C98)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 9:21:03 AM 2968 (0x0B98)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 10:21:03 AM 47820 (0xBACC)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 11:21:03 AM 58140 (0xE31C)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 12:21:03 PM 39140 (0x98E4)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 1:21:03 PM 80568 (0x13AB8)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 2:21:03 PM 29900 (0x74CC)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 3:21:04 PM 74456 (0x122D8)
    Executing Task LSRefreshLocationsTask LocationServices 8/9/2022 4:21:04 PM 92900 (0x16AE4)
    1 assigned MP errors in the last 10 minutes, threshold is 5. LocationServices 8/9/2022 5:00:33 PM 7828 (0x1E94)
    2 assigned MP errors in the last 10 minutes, threshold is 5. LocationServices 8/9/2022 5:02:19 PM 7828 (0x1E94)
    Rese

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.