Programmes start very slowly

Hi,

thanks for your quick support.

It mainly concerns programmes that are executed via the network.
z. e.g. ERP, Office etc.

I assume you're not running Office executables from the share, you're referring to opening documents that are stored on a file server.  The client accesses them via \\server\share\file.docx for example or maybe X:\file.docx if they are using a mapped drive?

As a test, in the threat protection policy, does it help to un-check "Remote files" as a test:

At the client, when it gets policy (should be under 1 minute) it will set:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\Scanning\Config

OnAccessExcludeRemoteFiles = 1

---

If it is EXE files run from a remote location this would also help but "Enable Threat Case creation" in the same policy may also be worth disabling as a test.

At the client, disabling it, will set:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\EventJournal\Features\RCA

Enable = 0

Also is 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\EventJournal\Features\EDR
Enable set to 1, this denotes EDR is enabled?

Hi,
I have deactivated the switch for remote files and have already noticed a noticeable improvement.
If the OnAccessExcludeRemoteFiles value is set to 1, what does this mean?
Does this make the policy apply faster on the client?

I would like to add one more thing,
Excel or Word with add-ins also start very slowly.

Checking the registry value at the client for OnAccessExcludeRemoteFiles  being set to 1 just means the policy from Central to disable "remote files" has arrived at the client.  if you were to re-enable it in policy it would go back to 0.

Checking the registry value at the client for OnAccessExcludeRemoteFiles  being set to 1 just means the policy from Central to disable "remote files" has arrived at the client.  if you were to re-enable it in policy it would go back to 0.