Intercept X installs only "half" - how can I fix this ?

Hello RanX,

Thank you for reaching out to the Sophos Community. 

I recommend ensuring that any pending reboots are completed after the initial installation. Once rebooted, check the Sophos Endpoint UI to see if any further updates need to be installed. 

You can also use the "Sophos Endpoint Self Help" tool to verify the health and installation status of Sophos Antivirus. 

You may want to check the directory "C:\Windows\temp" for a file by the name of "avremove.log." If there's another AV product installed/detected on the device, some of Sophos' components may not install fully. 

Let me know what your findings are.

Hi Qoosh,

thanks for the fast reply !
All respective computers were installed four days ago.
Thus all of them have been rebootet at least three times.

I also have run the update function in the informations menu severeal times.
This doesn't change anything.
Self help tells me everything is green.

The previous AV Suite has been completely uninstalled with no errors before Intercept X came into play.
A file "C:\Windows\temp\avremove.log" is not present.

When I download Eicar, it is detected and removed by Defender and not by Intercept X
I got still no idea, what causes this poor behaviour.
To be true, I pretty dissapointed by Sophos, as things like these should not happen.
At least I should receive a big fat warning, that Sophos doesn't run properly.
Instead: everything green ...
This doesn't build up trust for the reliablity of Sophos AV.

As I have to enroll this for the whole company soon, I hope for a quick solution.
Best Regards

ranX

Hi Qoosh,

thanks for the fast reply !
All respective computers were installed four days ago.
Thus all of them have been rebootet at least three times.

I also have run the update function in the informations menu severeal times.
This doesn't change anything.
Self help tells me everything is green.

The previous AV Suite has been completely uninstalled with no errors before Intercept X came into play.
A file "C:\Windows\temp\avremove.log" is not present.

When I download Eicar, it is detected and removed by Defender and not by Intercept X
I got still no idea, what causes this poor behaviour.
To be true, I pretty dissapointed by Sophos, as things like these should not happen.
At least I should receive a big fat warning, that Sophos doesn't run properly.
Instead: everything green ...
This doesn't build up trust for the reliablity of Sophos AV.

As I have to enroll this for the whole company soon, I hope for a quick solution.
Best Regards

ranX

Hi, please take a look at my recent post about installer using a new FQDN to download packages. Maybe you have a similar issue.

You can check  the logs here to identify issues the installer may have:

%ProgramData%\Sophos\CloudInstaller\Logs\

Thanks for the hint but I see no issues in the Logfile.

is it server or client OS?

Client OS.
The server Installations work.
On all four clients I enrolled so far, Intercept X isn't fully operational.

can you show some screenshots of the Sophos components?

You find it here:

Here we are:

that looks good. not like "half" installed.

Im only aware that defender will not get disabled on server OS automatically. Which OS Version are you using? Maybe this is a Windows 11 or brand new Windows 10 where eventually Defender acts like on Server OS?

What if you follow the steps to disable Defender? Does the Scan with Sophos appear in right click then?

OS is Win 10 Professional.
The described behaviour seems to be "global" as it appears on all four computers, where I have enrolled Intercept X til now.

When Defender is disabled, the situation stays the same.
No Sophos Scan on rightclick; Windows Security reports issues in the taskbar.

Additional Info:
This seems to be a license issue.
We had the same behaviour on our first test enrollment.
Then we activated the trial for Intercept X advanced and everything worked as expected.
After the trial period expired, this issue is back now

If you are still testing out Sophos Antivirus, it's possible to request an extension on your trial by getting in touch with our Customer Care team. It’s possible to extend the trial up to 60 days, 

Once you have purchased a full license or once the trial extension is applied, you can use the following navigation to deploy the additional components to the devices in question. 

- Open the "Devices" menu
- Use the tick-boxes to select which devices you'd like to target
- Select "Manage Endpoint Software" 
- Use the drop-down menus to specify what changes you'd like to apply

Let me know if this helps.