10.0.3 Update - SophosScanD stopped

Same behaviour was seen on most of the devices running BigSur and Sophos EAP.

These are showing in their status that SophosScanD is not started.

"Not started: SophosScanD"

Devices are enrolled and managed by M365  Intune.

Hi Nicholas,

The problem appears to the in the authorization for the scan extension, as shown in the command line output. If it's not authorized it won't run, and that in turns prevents SophosScanD from running correctly.

If the General tab of macOS' Security & Privacy panel doesn't show anything then perhaps that's something that could be done via MDM - our IT department uses JAMF and is working on allowing/authorizing via that.

Hi Nicholas,

I understand your frustration, hearing about these incompatibilities is disappointing to us too. The EAP program is so valuable to us for exactly these reasons, we get to hear about issues we wouldn't normally encounter and hopefully engage with customers to help understand them.

As disappointing as they are, these challenges aren't entirely surprising. There are new technologies introduced with Big Sur and these products could be using them in ways that clash, it's even possible that bugs in the OS currently prevent them from working together - as seen with the recently remedied NEFilterDataProvider and NETransparentProxyProvider.

I realize this doesn't help your situation but I assure you that we have team members collating information regarding these incompatible products to aid in our investigation.

hi

well the ext scanD in MAC machines I have looked at there is not message that there is an app waiting for approval.

there is also inconsistence as for example some of the macs all sophos services are green and some the scanD  is showing red.

although all approvals for ext have been given  

On an affected device, can you let us know the output to:

systemextensionsctl list

Are you using and MDM solutions such as JAMF?

here is an example of a machines that all services are up , I still dont see scanD

anyway I will send a machine later that has scanD service down

F
4 extension(s)
--- com.apple.system_extension.network_extension
enabled active teamID bundleID (version) name [state]
2H5GFH3774 com.sophos.endpoint.networkextension (1.0/2) networkextension [terminated waiting to uninstall on reboot]
* * 2H5GFH3774 com.sophos.endpoint.networkextension (10.0.3/221820) networkextension [activated enabled]
--- com.apple.system_extension.endpoint_security
enabled active teamID bundleID (version) name [state]
2H5GFH3774 com.sophos.endpoint.scanextension (1.0/1.0) com.sophos.endpoint.scanextension [terminated waiting to uninstall on reboot]
* * 2H5GFH3774 com.sophos.endpoint.scanextension (10.0.3/221821) com.sophos.endpoint.scanextension [activated enabled]
tom.chenzion@IL-TLV-MAC0028 ~ %

Thanks Robert, that's what we'd expect to see - a scan extension running and one waiting to be removed.

ScanD is not expected to be in that list as it's only a list of system extension and ScanD is a background process. It does rely on the scan extension however, and if that isn't running then ScanD will show as red.

here is mac that has scanD service down 

2 extension(s)

--- com.apple.system_extension.network_extension

enabled active teamID bundleID (version) name [state]

* 2H5GFH3774 com.sophos.endpoint.networkextension (10.0.3/221820) networkextension [activated waiting for user]

--- com.apple.system_extension.endpoint_security

enabled active teamID bundleID (version) name [state]

* 2H5GFH3774 com.sophos.endpoint.scanextension (10.0.3/221821) com.sophos.endpoint.scanextension [activated waiting for user]

Thanks Robert, given what you've described that's what I was expecting to see, The OS is requiring that the extension are approved. This should be shown in the Privacy Panel and I'm not sure why it wouldn't be.

Is your organization using any MDM software?

no we dont use MDM

as I said some it works just fine and some not although they have given all the permissions needed  , the question is when will that be fixed and also what is the risk by this service not ruining 

User approval can only be granted via the General tab of the Security & Privacy panel or by MDM. This is not something that the software is able to do for itself and we are unsure why the macOS would only show an "allow" button on some of your machines.

If SophosScaD is not running then unfortunately on-access protection is not enabled.

User approval can only be granted via the General tab of the Security & Privacy panel or by MDM. This is not something that the software is able to do for itself and we are unsure why the macOS would only show an "allow" button on some of your machines.

If SophosScaD is not running then unfortunately on-access protection is not enabled.