0

When I install Sophos Endpoint Defence on an Amazon provided AMI; and then create a custom AMI from it; why do EC2 instances display an error dialog on boot 'Windows could not finish configuring the system'?

In my case I used EC2 Image Builder to run SophosSetup.exe /quiet I then had it run a series of commands provided in Sophos Sysprep.txt from https://support.sophos.com/support/s/article/KB-000035040?language=en_US

However after creating the AMI I was unable to boot any EC2 instances from it. The Troubleshooting > Take Screenshot function allowed me to view the error dialog on the screen.

1 Answer 1

1

I learned that when a windows instance boots for the first time it records logs in C:\Windows\Panther\setup.etl. By stopping a troubled instance and attaching its root volume to another instance; I was then able to use 'tracerpt.exe' setup.etl -of csv -o logs.csv to gain access to the logs. In my case I discovered the following error messages in those logs.

"(c0000022): Failed to set value [SAVOnAccessSid]"
"(c0000022): Failed to process value [SAVOnAccessSid]"
"(c0000022): Failed to process reg key or one of its descendants: [\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SAVOnAccess]".

After reviewing the documentation at https://support.sophos.com/support/s/article/KB-000035040?language=en_US I discovered that the Sophos Sysprep.txt script provided performs one additional step that the "Manually prepare a gold image" section does not.

This additional step was to re-enable Tamper Protection prior to shutting down to create the image.

I did an experiment and discovered that if I left Tamper Protection disabled; the descendant EC2 instances worked.

I also confirmed that Tamper Protection re-enabled itself in the descendant EC2 instances which has accomplished my objective.

1
  • Worth noting that if you choose to use the Sophos Central Endpoint API to obtain the Tamper Protection password; be mindful that the ID found in EndpointIdentity.txt is not the same thing as the EndpointId required by the API. Lookup the correct EndpointId using the /endpoints resource with the following filter 'cloud=aws-<instanceId>'. Oct 5, 2021 at 4:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .