Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 13 replies
  • Answers 1 answer
  • Subscribers 13 subscribers
  • Views 5400 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Windows Server Taskmanager performance issues with Sophos Endpoint Exploit Mitigation

LHerzog

I notice a frustrating Performance issues on Windows Servers with the Taskmanager for some time now. Not sure if known or already fixed.

Taskmanager opens normally but when you switch to an other register tab like the Details register, it hangs like this

or shows only white space like this for up to 20-30 seconds, depending on CPU speed:

Once loaded, you can switch between the different registers and all is fine. If you close the Taskmanager and open it again, the issue is happening again.

After disabling Sophos Components one by one, it turned out to be  Exploit Mitigation causing the issue. Can be recreated at any time.

OS: Server 2019, Server 2022, and surely others.

Affected Endpoints, that's the latest Version we have:

All policy settings are default & recommended



This thread was automatically locked due to age.
Parents
  • 0

    Just to confirm, if you re-enable everything again in policy. Re-launch taskmgr to repro the issue and confirm it is still present. Then:

    Close taskmgr.

    Disable tamper for the computer

    Rename  c:\windows\system32\hmpalert.dll to something else, e.g. hmpalert.dll.test

    relaunch Taskmgr

    does this also fix the issue? This would confirm your theory that exploit mitigation feature is responsible. You can exclude the process but it would be interesting to understand. 

  • 0 in reply to Sophos User930

    good idea to disable the hmpalert module

    indeed, this fixes the issue. Tabs in Taskmanager open immediately.

    renaming it to the original filename, brings the issue back.

  • 0 in reply to LHerzog

    Would be good if someone could confirm this behaviour before opening an other case.

Reply Children
No Data
Unfiltered HTML
Help Us Improve The Community
Unfiltered HTML