A bit of a newbie question I suspect, but here goes anyway. We manage lots of computers across numerous schools from Sophos Central. We have some computers that are reporting a status of "Failed to protect", which I suspect is because they never got around to reporting back fully when Sophos was installed, and then they haven't been switched on again since that last status report / alert. My question is, are we OK to click on "Reset Health status" for the device in Sophos Central to stop the device as showing up with a "High alert". And when the computer is finally switched on again can we be sure that if Sophos still isn't installed properly, the alert will be raised again so we can investigate further?
Any advice greatly appreciated.
Thanks for reaching out to the Sophos Community Forum.
When you install Sophos onto a device, it will need to be rebooted and report back to Sophos Central that the first update has been completed successfully. Once this condition is met, the "Failed to protect" message will not appear.
If you were to clear the health status on the affected device and power it on later, there’s a good chance that the system will update successfully and show a green status icon. If a different error is generated, or if the same one returns, you’ll see the same notification/alert again.
Thanks for your response. So am I correct in thinking that even if the installation of Sophos has completely failed, so long as the device has registered in Sophos Central, then the next time it is powered on it will report its status. And so, a bad installation will be alerted again once that machine is turned back on?
This would mean I can clear lots of old alerts for bad installations and / or where services aren't running on machines that aren't being used, and feel confident that if someone does turn the machine back on again, we will get a new alert and can investigate the problem then.
That's correct. When the device powers on in the future, it will report the status at that time. Should the status be bad, that will generate a new event/alert.