Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 16 replies
  • Subscribers 12 subscribers
  • Views 2966 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Terminal Servers with User Profile Disks crash

Aktuator

Hi all,

since a few months we are facing heavy problems with our terminal server (rdsh) in combination with Sophos Intercept X Advanced and user profile disks.
The User Profile Disk (UPDs) are stored on a normal file server and are accessed through a share.

For about 2 years everything was running smoothly and stable. However, since a few months we are facing the problem that out of the blue the users lose the connection to their UPDs and therefore are disconnected from the server. Actually the entire server kind of freezes and we need to reboot it.
After disabling most of the features of Sophos Intercept X the systems went back to normal.
However, a few days ago we re-enabled all the security features and today we had another server crash.

We are not sure which feature is causing the trouble. According to some research on the internet it could be the Sophos hitman.alert.pro feature.

Any help to narrow down the problem would be greatly appreciated.
Btw. all the servers are running Win Server 2019 with all the latest Windows updates and patches.

Thanks in advance!

Kind regards,
Aktuator



This thread was automatically locked due to age.
Parents
  • +2

    Hi There!

    If you think it has something to do with interceptx, then please try to run interceptx hotfix on the machine>restart then observe if problem would still persist:

    https://support.sophos.com/support/s/article/KB-000038477?language=en_US

    If that won't work, then try assigning the machine to sophos Early Access Program.

    It's a subcription to future sophos update but hasn't been rolled-out yet to the recommended/default update. If the issue is unusual, we recommend to try assigning the machine first on the list>save>then do sophos update afterwards. Check if problem would still persist.

    Fernan Tutor

    If this post solves your question, please use the "Verify Answer" button.

  • 0 in reply to Fernan Tutor

    Hi Fernan,
    Thank you for your quick reply!

    I will apply the hotfix and then observe if system will get back to stable again.
    However, I think I will also disable some intercept x features because there is always a high impact on the users every time the crash happens…. Every unsaved data is lost and users have to reboot, etc.  That’s a lot of wasted time and we are talking about 30 to 50 users every time the error happens….

    The first time the problem occurred was in beginning of October. So I just had a look at the Intercept X version history to find out if there was a major update during that time. However, I can only find a history of the build numbers but no information about the date when they were released.
    Is there a way to find that out?

    Thanks again in advance!
    Kind regards,
    Aktuator

  • 0 in reply to Aktuator

    Hi Aktuator,

    Please check this link for the dates interceptx has been updated. Go to the components tab:

    https://docs.sophos.com/releasenotes/index.html?productGroupID=esg&productID=sesc_interceptx&versionID=allVersions

    I'm not seeing any update under October 2021 so I'm not really sure what caused this.

    If interceptx hotfix and early access program won't work, then please message me directly so we can investigate further this issue.

  • 0 in reply to Fernan Tutor

    Thank you Fernan –This was very helpful!

    I just double checked. The first time we had that problem was by middle/ end of September. The Intercept X / Hitman.pro version we are using at the moment was released in August. According to the Sophos homepage it can take a few weeks until the roll out of new version is complete. Therefore, the dates might match…. My gut feeling actually tells me that we finally found the problem now….That would be really great! :-)

    I will apply the hotfix in a few hours when the users aren’t logged in anymore and will keep you informed. However, sometimes the systems are running for a few days without any problems. So we need to monitor and be patient.

Reply
  • 0 in reply to Fernan Tutor

    Thank you Fernan –This was very helpful!

    I just double checked. The first time we had that problem was by middle/ end of September. The Intercept X / Hitman.pro version we are using at the moment was released in August. According to the Sophos homepage it can take a few weeks until the roll out of new version is complete. Therefore, the dates might match…. My gut feeling actually tells me that we finally found the problem now….That would be really great! :-)

    I will apply the hotfix in a few hours when the users aren’t logged in anymore and will keep you informed. However, sometimes the systems are running for a few days without any problems. So we need to monitor and be patient.

Children
Unfiltered HTML