Issue with Sophos Endpoint Intercept X Advanced for Server on Windows Server 2022 HyperV Guests

Have tried stripping out policies on both hypervisor and guests to just file scanning but still no change.

Only way to resolve issue currently is to apply policy with everything off on Guests and we can continue to survive

Thank you for reaching out to the community forum.

Can you verify and review the current exclusion that you've added vs. the recommended exclusion that Microsoft shared? You may refer to this MS documentation and let us know if this helps. https://learn.microsoft.com/en-GB/troubleshoot/windows-server/virtualization/antivirus-exclusions-for-hyper-v-hosts 

Yes that is the document reference.

I've even tried disabling Sophos completely on the Hyper V Host Servers.

Appears to be something about the Hyper V Guests that Sophos product does not like.

I've also never seen blank users appear in Task manager like that before as per the screenshot - presumably its some sort of process being triggered by Sophos client on the Hyper V guest.

We have Sophos working fine on other standalone and Amazon EC2 servers in our same domain/environment/Server SOE so we do not believe the issue is related to co-existence ith another application. 

Also worth noting we have some Windows 10 VMs used for testing on the same Hyper V host that are running Sophos Intercept X (workstation) and they do not have any issues.

Is it the System process that is consuming the CPU?  Hard to tell from the screenshot. What does the details view show sorted by CPU?

I would send Support a 1 min ETL trace while seeing the issue:

wpr.exe -start GeneralProfile

Leave for 1 minute:

Wpr.exe -stop C:\gp.etl

Zip up C:\gp.etl and the directory with the same name as the file.

30 seconds if that's all that it will manage.

Thanks

Have you confirmed that Microsoft Defender is disabled or in passive mode? On Windows 10, it gets disabled automatically when Sophos is installed. On servers, it does not.

Have GPO configured to disable Windows Defender and also registry entry to enforce passive mode

Its a "blank" user . Never seen anything like it before.

You're assuming support actually respond.

so no process "MsMpEng" running?

also please post the installed versions of your Sophos Server Endpoint - they may vary from customer to customer.

have you already followed Sophos User930 's suggestion . That user is very skilled and often the hints bring you very close to the root cause.

Procmon dumps may also help you.

Also I'd suggest to disable one Sophos component by another and see if that changes the high CPU.

support.sophos.com/.../KB-000036572