This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos disabled but still blocking files

I've whitelisted PSEXEC and I've disabled all the modules for Sophos Endpoint but PSEXEC is still being removed as its recognised as a PUA. I've created a policy to whitelist this app on Central but nothing is applying.

Anyone know how to get around this?



This thread was automatically locked due to age.
Parents Reply Children
  • It says that a scheduled scan completed, that might explain the detections in the list view you are showing.

    The value of TaskInfo under:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense Service\ScheduledTasks\SophosScheduledScan

    will detail the config of the scan if it exists.  You can also check

    C:\ProgramData\Sophos\Endpoint Defense\Logs\SophosScanCoordinator.log