Not started: Sophos EDR Agent

Question

Hello All, 
 I have Sophos new EDR service in our environment but recently I've seen a handful of workstations with the Sophos EDR agent not started. Usually I know that I can start any service by doing a MMC and using the Snap-in of "Services" to remotely turn any service on. However I am not able to locate this specific service for "Sophos EDR agent". So I'm here reaching out to anyone having this same issue and if you can assist on how to turn Sophos EDR agent back on, I would appreciate the help!

Chris Rodriguez · Accepted Answer

Hi DianneY, 
 So I have this issue on (3) workstations in my environment, so I went ahead and tested by removing the whole SafeNet Authentication application from the workstation and reboot and as usual the EDR service would start but would stop after 5 minutes. This time, it stayed on. Removing the SafeNet Authentication application fixed the issue of Sophos EDR from continuing to run. 
 
 Now that we have identified the issue, what is the solution to having both Sophos EDR running and having the SafeNet Authentication software installed on the same workstation? Is there something I need to whitelist or add to the exclusion list? 
 
 You can now tell the inquiring minds that it worked :)

Nenad Vukotic · Answer

C:\Program Files\Sophos\Endpoint Defense\SspEdr.exe

DianneY · Answer

Hello Chris Rodriguez 
 Can you see if the following helps to get the EDR Agent to start: 
 
 Restart the Sophos System Protection Service on the endpoint 
 Force an update from Central. Does the EDR Agent start? If no, move to the next step 
 Restart MCS Agent and MCS Client services. 
 
 If none of the above helps, please Raise a support case with the following information, at the very least: 
 
 SDU Logs: Run SDU from the Endpoint OR Run SDU from Sophos Central 
 Enable Remote Assistance 
 
 From previous support tickets, it has been seen that some 3rd party apps that seem to cause the EDR Agent to not start. Further review with support would be needed in that case.

DianneY · Answer

Hello Chris Rodriguez 
 It may be what is causing the issue. We had another case and our Devs found that SafeNet Authentication Client 10.2.39.0 (or something to that effect), which has a feature that blocks screen capture, and the Devs think that this is interfering with the EDR agent. Can you see if uninstalling, or maybe downgrading to a previous version of this helps? 
 
 I am also reaching out to the support rep also helping you in the support ticket.

David Warho1 · Answer

We were able to fix this by installing a version of SAC that doesn't have EntryProtect on it. The vendor that we need SafeNet for (FedLine) provided a different version of the installer in the "Extras" folder on the CD that was a hidden file. Once we installed that version instead we no longer had the issue with Sophos.