Latest pre-release of 10.11.4 breaks Sophos AV Home Edition

I am also having the exact same problem. After updating from OS X 10.11.4 Beta 3 to beta 4 on-access protection is off and can not be enabled.

Note that if you turn System Integrity Protection off, you can enable On-Access Protection and it should stay enabled, at least until the next Beta is released.

Unfortunately that is not working for me. Did send Feedback to Apple earlier. Hopefully others here did so as well.

JohnGillett said:

Unfortunately that is not working for me

Assuming you mean getting On-Access Scanning working, did you turn off System Integrity Protection using csrutil in Terminal while in Recovery?

No, I am unaware of that method. Turned it off in Sys Prefs. What is the command line, please?

JohnGillett said:

No, I am unaware of that method. Turned it off in Sys Prefs. What is the command line, please?

Reboot into Recovery (Cmd+R at the chime). In Utilities>Terminal enter "csrutil disable" and reboot. That will disable SIP and On-Access Scanning should work. Note that this is not a "solution" since Apple added SIP to El Capitan for security purposes and really should be enabled. Moreover, it's likely that any future beta will turn it back on by default. Also, csrutil has three arguments: disable, enable, and status. The first two will only work in Recovery. Status will also work in Terminal after booting normally.

SIP is not new in OS X 10.11.4 Beta 4, it has been there, and enabled, since OS X 10.11 (El Capitan) came out and Sophos on-access protection has been working fine with SIP enabled.

I also reported the issue to Apple.

SIP is not new in OS X 10.11.4 Beta 4, it has been there, and enabled, since OS X 10.11 (El Capitan) came out and Sophos on-access protection has been working fine with SIP enabled.

I also reported the issue to Apple.

VincentCina said:

SIP is not new in OS X 10.11.4 Beta 4, it has been there, and enabled, since OS X 10.11 (El Capitan) came out and Sophos on-access protection has been working fine with SIP enabled...

I'm aware of that and was using that trick to keep Sophos running back when El Capitan was first introduced until Sophos was made compatible. As Bob Cook pointed out, Apple has done something different in the most recent beta so turning off SIP is once again a temporary fix if the user needs to be running the latest El Cap version but also needs the protection Sophos provides.

Rather than disable SIP I decided to install 10.11.3 last night. Sophos AV Home, and on-access scanning is working once again. I have lost the use of Photos until it is updated, but I can live with that as I have another production machine. I can live without this beta, as there are not any earth shattering feature enhancements.

That's a good solution in that you have both security systems working as well as whatever improvements 10.11.3 offers, especially when it's applied to a production machine.