This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Windows Fileserver suddenly not reachable after Intercept X installation

Hey Everyone,

i have many customers with intercept x advanced on their fileserver. But two of them have big problems. One fileserver is with Windows Server 2008 R2 OS and the other Server 2016.

Both have the same error: When the fileserver is running for a while, the network shares are suddenly not reachable anymore. Nothing helps but only a restart of the windows system. The restart isnt successful, they stuck on "Shutting Down..."-Animation. Only a cold shutdown will help to boot the system and fix the problem for some hours or days.

Even when disabling all Features of the endpoint the problem occurs. Only uninstalling intercept x is an workaround for us, so the "normal" server protection-modules are currently running on the server without hitman pro.

has anyone have the same issue?

i found an old topic on the forum but they dont provide a solution:

https://community.sophos.com/intercept-x-endpoint/f/discussions/94727/issues-with-server-protection-on-file-server

Thanks!

This thread was automatically locked due to age.

Parents

0 GlennSen over 3 years ago

Hello InterceptXXX,

By Any chance have you already applied the hotfix for Intercept X to those machines in question? If not? I would recommend you to apply this Hotfix stated on this Article

And see if issue still persist.

Glenn ArchieSeñas (GlennSen)

Global Community Support Engineer

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 InterceptXXX over 3 years ago in reply to GlennSen

Hi GlennSen,

yes, i already tried this (this is one of the first things i try in such situations), but i doesnt change anything.
Cancel
Vote Up 0 Vote Down

Cancel
0 RichardP over 3 years ago in reply to InterceptXXX

Do you have a archiving software on these machines or others that are accessing those shares?

RichardP

Program Manager, Support Readiness | CISSP | Sophos Technical Support
Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 InterceptXXX over 3 years ago in reply to RichardP

Hi RichardP,
no, software like this. only windows users with network drives, their profiles.

For some users are folderredirection enabled.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 InterceptXXX over 3 years ago in reply to RichardP

Hi RichardP,
no, software like this. only windows users with network drives, their profiles.

For some users are folderredirection enabled.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 RichardP over 3 years ago in reply to InterceptXXX
I would suggest you open a support ticket. We will need an SDU and process monitor that covers the action and debug level logging enabled for the SFS.

Enable debug logging for the SophosFileScanner.log:

Access the following registry key:

HKLM\SOFTWARE\Sophos\Sophos File Scanner\Application

Create the following value:

"LogLevel"=dword:00000004

Restart the Sophos File Scanner Service

Reproduce the issue

Check the SophosFS.log and SophosFileScanner.log for any errors and if there are lots of scanning events for the target file share
RichardP

Program Manager, Support Readiness | CISSP | Sophos Technical Support
Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel