We rolled out Sophos Advanced Endpoint with Intercept X recently (replacing Kaspersky) and we've encountered an issue where a few users suddenly lose access to any website (external and internal) in an web browser. All other network activity is fine, Outlook and Teams stay connected and there's no issue with network shares.
It is exactly the same issue as described in a previous thread: https://community.sophos.com/intercept-x-endpoint/f/discussions/131226/users-losing-internet-connectivity-and-often-warned-sophos-ips-stopped
The only way to fix it is by disabling tamper protection and then disabling the Real Time Scanning - Internet. Websites then load and continue to work even after turning the setting back on.
The reply in the thread above mentioned installing a hotix (https://support.sophos.com/support/s/article/KB-000038477?language=en_US),but the thread poster never came back to say whether it had worked or not.
I have a case open (05333081) and am being asked for logs (already send SDU logs from when the issue has occured) and Wireshark captures which I can only do when a uer encounters the issue and if I can take over their laptop for sufficient time to do so.
Is this a known issue affecting others and does the hotfix make any difference?
This thread was automatically locked due to age.
