Sophos compatibility with big sur \ Real-time protection has been disabled for MAC laptops

Hi,

If you are running 10.0.1 or below then unfortunately those laptops are unprotected as this version utilizes kernel extensions and so is not supported on Big Sur. The alerts you are seeing are directly related to this.

The EAP version of 10.0.2 uses system extensions and offers a preview of Big Sur Support so protection will be in place.

Version 10.0.2 does have some known issues that we are working on. Please see:

https://community.sophos.com/intercept-x-endpoint/big-sur-eap/f/recommended-reads/124249/big-sur-eap-known-issues-list

GA for Big Sur support is planned for early March.

Hi,

I have a few users who have upgraded to Big Sur, I have subscribed them to the EAP and installed version 10.0.2. This has worked apart from one user. Despite installing the lates version of Big Sur, uninstalling and reinstalling Endpoint protection Realtime protection is still disabled. I am not sure what to try now - does anyone have any ideas please?

Hi,

Sorry to hear that you're having trouble. Can you confirm that the problematic endpoint has v10.0.2 installed?

In order to help us with the investigation, please provide an SDU from the affected machine by following these steps:

• Go into Central, find the device, and click on the generate SDU button
• Once the sdu is uploaded, post the file name here so we can extract it and take a look

Thanks for your feedback

Thanks for your reply,  Here are the file details for the SDU as requested

189917dd-8537-1477-59cf-0049147c245e_2021-02-04-15-52-09.zip

Thanks for that. The logs show that that endpoint is still running v10.0.1 and is currently not assigned to the EAP. Please double check the EAP assignments in Central

David, I have installed the latest version 10.0.3 and reassigned the device to the EAP and tentatively I would say it has solved the problem, I am not getting alerts about it every 24 hours which is good. Realtime protection is not disabled - in fact is doesn't now seem to appear on the list as a service, is that correct? Now I get that SophosScanD is not runnjng .

Real time protection has never been a service itself, rather a feature offered by the ScanD service.

If SophosScanD is not running please check the General section of the Security and Privacy panel, we have seen upgrades occur where macOS requires the extensions to be re-approved. This is an unfortunate affect of Big Sur's enhanced security controls

If you could post the output of the following command, that would be helpful to know:

systemextensionsctl list

Real time protection has never been a service itself, rather a feature offered by the ScanD service.

If SophosScanD is not running please check the General section of the Security and Privacy panel, we have seen upgrades occur where macOS requires the extensions to be re-approved. This is an unfortunate affect of Big Sur's enhanced security controls

If you could post the output of the following command, that would be helpful to know:

systemextensionsctl list

David, I have re-approved the extensions in Security and Privacy and it is now working perfectly. Thanks a lot for your help

I'm happy to hear that, thanks for the update.

David, I am sorry to keep pestering you but we have just got a new Macbook and it has the M1 chip. It does not seem that following the procedure you describe above works. Is that correct? If so is there anything we can do?

Can you provide more details about what you're seeing and what you've tried?

What is the output of the extensions command?

Is there anything shown in the endpoint self-help tool?