10.0.3 Update - SophosScanD stopped

Hi Sam,

Can you let us know the output to:

systemextensionsctl list

Are you using and MDM solutions such as JAMF?

An SDU would be helpful for our investigation:

• Go into Central, find the device, and click on the generate SDU button
• Once the sdu is uploaded, post the file name here so we can extract it and take a look

2 extension(s)
--- com.apple.system_extension.network_extension
enabled active teamID bundleID (version) name [state]
* 2H5GFH3774 com.sophos.endpoint.networkextension (10.0.3/221820) networkextension [activated waiting for user]
--- com.apple.system_extension.endpoint_security
enabled active teamID bundleID (version) name [state]
* 2H5GFH3774 com.sophos.endpoint.scanextension (10.0.3/221821) com.sophos.endpoint.scanextension [activated waiting for user]

Yes, we use WorkspaceOne for our MDM

2 extension(s)
--- com.apple.system_extension.network_extension
enabled active teamID bundleID (version) name [state]
* 2H5GFH3774 com.sophos.endpoint.networkextension (10.0.3/221820) networkextension [activated waiting for user]
--- com.apple.system_extension.endpoint_security
enabled active teamID bundleID (version) name [state]
* 2H5GFH3774 com.sophos.endpoint.scanextension (10.0.3/221821) com.sophos.endpoint.scanextension [activated waiting for user]

Yes, we use WorkspaceOne for our MDM

Hi Sam,

Thanks for the info, it looks like the upgrade was performed successfully but macOS is requiring an acknowledgement from the user in order to run the updated Scan Extension.

Is there a notification on the General tab of macOS' Security & Privacy panel? Is so, could you follow it through and let me know if that helps?

Hi David - our Mac users are not receiving any notification messages, but are now experiencing web browsing issues. The Sophos Network Extension is at CPU 95% and systems are becoming unusable. We've disabled Web Control with no change. What else should we look at?