Windows Fileserver suddenly not reachable after Intercept X installation

Hey Everyone,

i have many customers with intercept x advanced on their fileserver. But two of them have big problems. One fileserver is with Windows Server 2008 R2 OS and the other Server 2016.

Both have the same error: When the fileserver is running for a while, the network shares are suddenly not reachable anymore. Nothing helps but only a restart of the windows system. The restart isnt successful, they stuck on "Shutting Down..."-Animation. Only a cold shutdown will help to boot the system and fix the problem for some hours or days.

Even when disabling all Features of the endpoint the problem occurs. Only uninstalling intercept x is an workaround for us, so the "normal" server protection-modules are currently running on the server without hitman pro.

has anyone have the same issue?

i found an old topic on the forum but they dont provide a solution:

https://community.sophos.com/intercept-x-endpoint/f/discussions/94727/issues-with-server-protection-on-file-server

Thanks!

Parents Reply Children
  • I would suggest you open a support ticket. We will need an SDU and process monitor that covers the action and debug level logging enabled for the SFS. 

    • Enable debug logging for the SophosFileScanner.log:
      • Access the following registry key:

        HKLM\SOFTWARE\Sophos\Sophos File Scanner\Application
         
      • Create the following value:

        "LogLevel"=dword:00000004
         
      • Restart the Sophos File Scanner Service
    • Reproduce the issue
    • Check the SophosFS.log and SophosFileScanner.log for any errors and if there are lots of scanning events for the target file share

    RichardP

    Snr. New Product Introduction Engineer | CISSP | Sophos Technical Support
    Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.