MacOS 10.14/ 10.15 Kernel extensions suddenly stopped?

Question

Hi, 
 
 We have had about 100 Macs on either 10.14 or 10.15 running 10.0.4 of Sophos Endpoint suddenly flag at the same time at 10:37am local time, investigation has shown that the kernel extensions on themare all showing as Not Loaded

We have a config file loaded in JAMF following the KB article regarding this that has worked fine up until this point to switch everything on ( https://community.sophos.com/intercept-x-endpoint/f/recommended-reads/116397/sophos-mac-endpoint-how-to-configure-jamf-privacy-preferences-for-10-15-compatibility ) 
 
 I wondered if anyone else had encountered this issue as well? I'm not sure if there has been a change regarding Sophos, nothing on our Macs has changed today that I'm aware of.

Daniel Handford · Accepted Answer

Just to update I tried rebooting but that didn't help on affected machines. 
 I have resolved it however by cloning my config in JAMF and then sending it straight back out again, after that a reboot showed Kernel extensions enabled again so I sent a reboot to the Macs out of hours and they are all ok now. I've submitted the logs to Sophos to see if they can determine the root cause of the issue but if anyone experiences this in the future I would recommend forcing the config to go out again and rebooting. 
 Thanks for trying to help guys

FormerMember · Answer

I think this is due to this: 
 https://support.sophos.com/support/s/article/KB-000041765?language=en_US 
 
 Try rebooting the machine - does the system return to a good state?

MacOS 10.14/ 10.15 Kernel extensions suddenly stopped?

Top Replies