many Kernel-EventTracing 0xC0000022 errors caused by SophosNtpService.exe on Windows Servers

Hi LHerzog

Error : Session "" failed to start with the following error: 0xC0000022 | Source: Kernel-EventTracing | Event ID: 2 |Level: Error |

From reviewing the logs and seeing the error, It seems that it is not a Sophos issue, but one that is outlined in the following KB by Microsoft. Let me know if it helps. 

https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/kernel-event-id-2-msft-netLbfoteamnic-class

Hi,

this issue is exclusively caused by the PID of the Sophos process: SophosNtpService.exe

I don't think this is a Microsoft issue. Maybe SophosNtpService triggering some Windows component or itself acting like a teaming device?

This is a standard VM with no teaming, just a virtual vmxnet3 adapter.

I am getting this on my server 2012 R2 systems as well.  Any progress on this problem?   I first noticed it on some servers which used MS Network Load Balancing, but I see it on others that don't have this.  All instances seem to have started on 3/7 in the early afternoon. 

Hi Moltron5k about the Start Date of the issue - in our case it is limited by the default size of the eventlog that contains them. it's only 1MB. It may have been there much longer.

LHerzog, I had that suspicion.  I restored an event file from a few weeks ago and yup its full of those events.  So, nothing new.  Thought it was because this is a newer thread, and it was just coincidence on our side we had an application issue start around the same time as the oldest entry of these logs.  Also, I don't see this happening on any 2019 servers.

Shweta my I know why instaling Sophos Endpoint is causing this? MS is suggesting the following:

Takeown /f c:\windows\inf  
icacls c:\windows\inf /grant "NT AUTHORITY\NETWORK SERVICE":"(OI)(CI)(F)"  
icacls c:\windows\inf\netcfgx.0.etl /grant "NT AUTHORITY\NETWORK SERVICE":F  
icacls c:\windows\inf\netcfgx.1.etl /grant "NT AUTHORITY\NETWORK SERVICE":F

These commands grant the necessary file permissions to prevent the error logging in this scenario.

btw: changing the permissions of the files as suggested by MS does not fix the errors. Even after a reboot.

The administrative events view in Windows eventlogs is really useless now because it is flooded by this junk.

Please Sophos suggest something to get rid of this. As stated, it is caused by SophosNtpService.exe 

I also am having this issue on a Windows 2012 R2 server that does not use NIC teaming. Any word on this?

same here. procedure on MS KB not fixed the issue on Server 2012R2