Outlook OST corrupt error

We've been troubleshooting .ost corruption issues on desktops and laptops, Win 8.1 and 10, and Outlook via Office 365 going back almost 2 years to present. We've dug into countless areas, opened tickets with Microsoft, logged everything imaginable and we cannot determine the root cause. One of the only consistencies for us is that all laptops and desktops are running Sophos Endpoint, recently upgrading and enabling Intercept X.

Today, I just happened to stumble upon this post (and a few others) and decided to add a global exclusion in our Sophos configuration for *.ost to see if this makes any difference. It could be that Sophos is entirely unrelated, but this issue has impacted probably a dozen users anywhere from once every few weeks to a couple of times per year.

Yes, it's largely an annoyance as we just delete the .ost and let Outlook recache, but for some folks with very large mailboxes (and who like to have as much offline as possible), it can take a day+ to re-cache their mailboxes.

Yeah you can add the wild card on your exclusion and observe if there’s n improvement. 

Update: We made this wildcard change last week and over the weekend we had another instance of a user .ost corruption, so it doesn't seem like Sophos is related.

Thank you for your confirmation, have you tried reducing the size of the OST file by archiving them as PST? let say, you'll try advising users to always archive their mails every after 3-5 GB OST size. You may also perform a cleanup of their OST there might be lots of deleted emails residing on a deleted folder which adds the size of the OST file. 

I did raise the support ticket with Sophos and Installed latest hotfix Current Hotfix Version: 3.8.2.292 yesterday. We are monitoring the clients machine for past 24 hours no issues reported. 

I appreciate the suggestion! While I have a suspicion that the overall size of the files is contributing to the issue, we have a lot of folks who "need" to have offline access to their mail. In addition, I had experienced ZERO .ost corruption issues with huge mailboxes and 100% of the email cached (we're talking ost files in the 50-75GB range) until ~January 2019 after an Office 365 patch for Outlook 2016.

The specific example that triggered this support forum post had a user with a 45GB .ost file, we re-cached Outlook and all was good, but his Windows Search Index .edb file had grown to 78GB, which is yet another known issue with Outlook and the Windows Search Index. I re-indexed his .edb file and THAT caused ANOTHER Outlook .ost corruption event, so it's very possible there is something going on between Windows Search and Outlook that is either the root cause or a large contributor to the issues we've been facing.

I suppose another thing I can try on the users who experience the most frequent corruption is to uninstall Sophos, but I am now less confident Sophos is related in any way. (It was installed throughout our organization before the .ost corruption was occurring more regularly.)

I appreciate the suggestion! While I have a suspicion that the overall size of the files is contributing to the issue, we have a lot of folks who "need" to have offline access to their mail. In addition, I had experienced ZERO .ost corruption issues with huge mailboxes and 100% of the email cached (we're talking ost files in the 50-75GB range) until ~January 2019 after an Office 365 patch for Outlook 2016.

The specific example that triggered this support forum post had a user with a 45GB .ost file, we re-cached Outlook and all was good, but his Windows Search Index .edb file had grown to 78GB, which is yet another known issue with Outlook and the Windows Search Index. I re-indexed his .edb file and THAT caused ANOTHER Outlook .ost corruption event, so it's very possible there is something going on between Windows Search and Outlook that is either the root cause or a large contributor to the issues we've been facing.

I suppose another thing I can try on the users who experience the most frequent corruption is to uninstall Sophos, but I am now less confident Sophos is related in any way. (It was installed throughout our organization before the .ost corruption was occurring more regularly.)