Immediately after an autoupdate installed 10.0.3, SophosScanD is now no longer able to run. When I run the diagnostic tool, it says the System Extensions "Sophos Can Extension" and "Sophos Network Extension" aren't met, but under privacy settings all Sophos services and extensions are checked.
Same behaviour was seen on most of the devices running BigSur and Sophos EAP.
These are showing in their status that SophosScanD is not started.
"Not started: SophosScanD"
Devices are enrolled and managed by M365 Intune.
Hi Nicholas,
The problem appears to the in the authorization for the scan extension, as shown in the command line output. If it's not authorized it won't run, and that in turns prevents SophosScanD from running correctly.
If the General tab of macOS' Security & Privacy panel doesn't show anything then perhaps that's something that could be done via MDM - our IT department uses JAMF and is working on allowing/authorizing via that.
Hi David,
We're noticing that all of our M1 Macs that have updated to 10.0.3 have this issue. When running systemextensions ctl, they're all showing 0 extensions
Hey Roger, this is peculiar - are you able to take a look in the General tab of the Security and Privacy panel and let me know if there's anything requiring authorization?
We'd really love to see an SDU from an affected machine, it would help a lot.
hi, we see the same issue , I have to say I dont see a solution that makes sense up to now. I am extremally disappointed with sophos support on the EAP program . also we dont have a choice when we install new MAC and update as it updates to 11.2.1 and we are stuck
Hi David, I can confirm that the extensions were present in the General Tab, both SophosScanD and the WebNetworkExtension. Unfortunately for me, as soon as the Web Network Extension was enabled that clashed with Zscaler client and now I have more users complaining about Sophos ... I do have a separate ticket for the other extension but the whole things is very disappointing.
Hi Robert, I'm sorry Support hasn't been helpful hopefully I can offer provide more information here.
The extensions approval is managed by the OS and unfortunately we don't have any control over how that works. SophosScanD showing as not running is correct due to the fact it is unable to scan files, as the scan extension has not been approved to run yet.
Hi Nicholas,
I understand your frustration, hearing about these incompatibilities is disappointing to us too. The EAP program is so valuable to us for exactly these reasons, we get to hear about issues we wouldn't normally encounter and hopefully engage with customers to help understand them.
As disappointing as they are, these challenges aren't entirely surprising. There are new technologies introduced with Big Sur and these products could be using them in ways that clash, it's even possible that bugs in the OS currently prevent them from working together - as seen with the recently remedied NEFilterDataProvider and NETransparentProxyProvider.
I realize this doesn't help your situation but I assure you that we have team members collating information regarding these incompatible products to aid in our investigation.
hi
well the ext scanD in MAC machines I have looked at there is not message that there is an app waiting for approval.
there is also inconsistence as for example some of the macs all sophos services are green and some the scanD is showing red.
although all approvals for ext have been given
On an affected device, can you let us know the output to:
systemextensionsctl list
Are you using and MDM solutions such as JAMF?
here is an example of a machines that all services are up , I still dont see scanD
anyway I will send a machine later that has scanD service down
F
4 extension(s)
--- com.apple.system_extension.network_extension
enabled active teamID bundleID (version) name [state]
2H5GFH3774 com.sophos.endpoint.networkextension (1.0/2) networkextension [terminated waiting to uninstall on reboot]
* * 2H5GFH3774 com.sophos.endpoint.networkextension (10.0.3/221820) networkextension [activated enabled]
--- com.apple.system_extension.endpoint_security
enabled active teamID bundleID (version) name [state]
2H5GFH3774 com.sophos.endpoint.scanextension (1.0/1.0) com.sophos.endpoint.scanextension [terminated waiting to uninstall on reboot]
* * 2H5GFH3774 com.sophos.endpoint.scanextension (10.0.3/221821) com.sophos.endpoint.scanextension [activated enabled]
tom.chenzion@IL-TLV-MAC0028 ~ %
here is an example of a machines that all services are up , I still dont see scanD
anyway I will send a machine later that has scanD service down
F
4 extension(s)
--- com.apple.system_extension.network_extension
enabled active teamID bundleID (version) name [state]
2H5GFH3774 com.sophos.endpoint.networkextension (1.0/2) networkextension [terminated waiting to uninstall on reboot]
* * 2H5GFH3774 com.sophos.endpoint.networkextension (10.0.3/221820) networkextension [activated enabled]
--- com.apple.system_extension.endpoint_security
enabled active teamID bundleID (version) name [state]
2H5GFH3774 com.sophos.endpoint.scanextension (1.0/1.0) com.sophos.endpoint.scanextension [terminated waiting to uninstall on reboot]
* * 2H5GFH3774 com.sophos.endpoint.scanextension (10.0.3/221821) com.sophos.endpoint.scanextension [activated enabled]
tom.chenzion@IL-TLV-MAC0028 ~ %
Thanks Robert, that's what we'd expect to see - a scan extension running and one waiting to be removed.
ScanD is not expected to be in that list as it's only a list of system extension and ScanD is a background process. It does rely on the scan extension however, and if that isn't running then ScanD will show as red.
here is mac that has scanD service down
2 extension(s)
--- com.apple.system_extension.network_extension
enabled active teamID bundleID (version) name [state]
* 2H5GFH3774 com.sophos.endpoint.networkextension (10.0.3/221820) networkextension [activated waiting for user]
--- com.apple.system_extension.endpoint_security
enabled active teamID bundleID (version) name [state]
* 2H5GFH3774 com.sophos.endpoint.scanextension (10.0.3/221821) com.sophos.endpoint.scanextension [activated waiting for user]
Thanks Robert, given what you've described that's what I was expecting to see, The OS is requiring that the extension are approved. This should be shown in the Privacy Panel and I'm not sure why it wouldn't be.
Is your organization using any MDM software?
no we dont use MDM
as I said some it works just fine and some not although they have given all the permissions needed , the question is when will that be fixed and also what is the risk by this service not ruining
User approval can only be granted via the General tab of the Security & Privacy panel or by MDM. This is not something that the software is able to do for itself and we are unsure why the macOS would only show an "allow" button on some of your machines.
If SophosScaD is not running then unfortunately on-access protection is not enabled.
