Sophos install error 118 and 122: endpoint setup fails to complete

Fix it now

Sophos setup stopped part way through fetching or applying its components and rolled itself back. Sophos publishes no meaning for 118, 122, 134 or 145, so the number tells you nothing you can act on. What it does not point at is your account or your licence, which are not checked at the stage where setup fails.

sc query msiserver
net start msiserver

1. Remove any other antivirus or internet security suite, then restart. Two products that both load kernel-level filter drivers will not install alongside each other.
2. Clear the leftovers with the previous vendor’s own removal tool rather than trusting Settings, Apps alone, which routinely leaves drivers and services in place.
3. If Sophos has been installed here before, switch Tamper Protection off first from the console that manages the device, then run Sophos’s own removal utility obtained from Sophos.
4. Download the installer again from your Sophos account rather than reusing an older copy, and run it as a local administrator.
5. If setup fails at the same point on this network and completes on a phone hotspot, the download is being filtered. Allow the destinations Sophos documents, then retry.

0x80070641 is the one code here with a published meaning: it is Windows Installer error 1601, ERROR_INSTALL_SERVICE_FAILURE, the Windows Installer service could not be accessed. Start there and ignore the Sophos-specific number.

If setup completes and Sophos reports itself as protected, you are done. If not, the next section covers what the bootstrapper is doing at each stage and which of the four causes you are looking at.

Why it happens

The file you download is a bootstrapper, not the product. It authenticates to Sophos, works out which components your platform and entitlement cover, pulls them down, and installs them in sequence. The short numeric failure that comes out of that sequence is an internal identifier, and Sophos publishes no table that maps it to a cause. Treat 118, 122, 134 and 145 as markers that setup stopped, not as diagnoses.

Almost every stage depends on something outside the installer. The download needs the machine to reach Sophos over HTTPS without a proxy rewriting the traffic mid-stream. The install stage needs Windows Installer running, and needs no other security product holding the file system filter position Sophos is trying to take. The rollback stage is what turns a partial install into a clean failure, which is why you usually end up with nothing installed rather than something half-broken.

One thing worth settling before you start, because it changes what you expect to see. Microsoft’s compatibility guidance says Defender enters disabled mode on Windows client when a non-Microsoft antivirus is installed as the primary product, and its passive-mode guidance lists onboarding to Microsoft Defender for Endpoint as a prerequisite for passive mode. On an ordinary PC, expect disabled rather than a quiet second engine, which is why the window between removing one product and finishing the Sophos install matters. Get-MpComputerStatus | select AMRunningMode tells you which you have.

Because the numbers carry no published meaning, the productive method is elimination in a fixed order: another product, then the download path, then Windows Installer, then a previous Sophos installation. Each of those has a symptom that distinguishes it, and each is cheap to test.

Full reference

Where the fault usually sits

The one code with a published meaning

0x80070641 is a HRESULT wrapper around Windows Installer error 1601, ERROR_INSTALL_SERVICE_FAILURE, published as the Windows Installer service not being accessible. It is a Windows fault rather than a Sophos one, and it will stop any MSI-based installation on the machine, which is the quickest way to confirm it: try installing something unrelated and see whether that fails too.

118, 122, 134 and 145 appear widely in community discussion with confident explanations attached. None of those explanations comes from Sophos, and they contradict each other. This article does not repeat them, because a wrong stage name sends you to the wrong place with more confidence than no name at all.

The gap while nothing is installed

Between removing the old product and finishing the Sophos install, the machine has no third-party protection. Microsoft documents Defender being re-enabled automatically once the other product is uninstalled, but confirm it on the Security providers page rather than assuming, and do not use that window to catch up on email.

Things not worth trying

• Deleting Sophos folders and registry keys by hand. Kernel drivers and service registrations are what block a reinstall, and hand-deleting files leaves those behind while removing what the official removal tool needs.
• Running the installer repeatedly without changing anything. The rollback is clean, so a second identical attempt produces an identical result.
• Disabling the other product’s real-time protection instead of removing it. It keeps its filter driver and its registration either way.
• Third-party ‘installer repair’ utilities. They change what the machine believes about installed products, which is a poor trade for a service that will not start.

Where a licence is and is not the answer

Your Sophos entitlement is not evaluated at the stage where setup fails, so a subscription problem does not produce an installer failure and buying a licence does not produce a successful install. What a licence does decide is the durable version of this problem: a machine that keeps two half-removed suites on it because nobody decided which product is the one being paid for. That decision is worth making once, for every device you own, rather than repeatedly at install time.

Every code this article covers

Confirm the fix worked

1. Windows Security, Virus & threat protection, Manage providers shows Sophos as the registered provider and no second suite.
2. The Sophos interface reports itself as protected and up to date rather than still installing.
3. Other MSI-based installations succeed, which rules 0x80070641 back out.
4. Restart once and confirm protection comes back on its own without a prompt.
5. No Sophos services are listed as stopped or failing in the Services console after that restart.

Questions people ask about this