Sophos Endpoint 10.0.2: Auto-downgrade / auto-upgrade

Hi Dan, sorry to hear that that's happening - it's definitely not expected behaviour. 

I've a couple of questions regarding your the environment.

• What VPN are you using?
• Do you have an Update Cache setup through Sophos Central
• Are there any other environment/network factors might be changing?

If you follow the instructions on the linked page the SDU archive will automatically be uploaded to Sophos, you'll just need to message me the filenames and I'll get them to an engineer for analysis.

https://support.sophos.com/support/s/article/KB-000038603?language=en_US

Thanks so much

I just updated you directly, David Lancaster. Thanks.

Thanks for the details, I know we caught up directly but I thought it was worth a public post other users to read.

What you're encountering is a limitation with our EAP and Update Caches.

What's happening is that when the endpoint connects to the VPN, it tries to use an Update Cache and is only able to get the GA software (10.0.1). Once the VPN disconnects, the Update Cache (which is in your network) is unavailable so the endpoint updates directly from Sophos so can get the 10.0.2 software.

It's unfortunate but there is a workaround as Central policy allows endpoints to be assigned to, and removed from, Update Caches. Defining a dedicated updating policy for Big Sur endpoints “Without Update Cache” will allow the affected endpoints to always update directly from Sophos.

We have a defect to track this fix and will update the known issues list.

Thanks for the details, I know we caught up directly but I thought it was worth a public post other users to read.

What you're encountering is a limitation with our EAP and Update Caches.

What's happening is that when the endpoint connects to the VPN, it tries to use an Update Cache and is only able to get the GA software (10.0.1). Once the VPN disconnects, the Update Cache (which is in your network) is unavailable so the endpoint updates directly from Sophos so can get the 10.0.2 software.

It's unfortunate but there is a workaround as Central policy allows endpoints to be assigned to, and removed from, Update Caches. Defining a dedicated updating policy for Big Sur endpoints “Without Update Cache” will allow the affected endpoints to always update directly from Sophos.

We have a defect to track this fix and will update the known issues list.

Thanks, David Lancaster.