This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Issue with Sophos Endpoint Intercept X Advanced for Server on Windows Server 2022 HyperV Guests

Hypervisor is also Server 2022 host running Sophos Endpoint Intercept X with all the recommended HyperV exclusions in place.

The guests VMs get ridiculously high CPU usage and get unknown/blank users appearing.

We had same setup with Crowdstrike previously on HyperV Host and Guest without issue.

Currently have had to disable Sophos on the HyperV guests so machines can function.

This thread was automatically locked due to age.

Top Replies

Maxim-Sophos 3 months ago +2 suggested

Have you confirmed that Microsoft Defender is disabled or in passive mode? On Windows 10, it gets disabled automatically when Sophos is installed. On servers, it does not.

Parents

0 Russell Admin 3 months ago

Have tried stripping out policies on both hypervisor and guests to just file scanning but still no change.

Only way to resolve issue currently is to apply policy with everything off on Guests and we can continue to survive
Cancel
Vote Up 0 Vote Down

Cancel
0 GlennSen 3 months ago in reply to Russell Admin

Thank you for reaching out to the community forum.

Can you verify and review the current exclusion that you've added vs. the recommended exclusion that Microsoft shared? You may refer to this MS documentation and let us know if this helps. https://learn.microsoft.com/en-GB/troubleshoot/windows-server/virtualization/antivirus-exclusions-for-hyper-v-hosts

Glenn ArchieSeñas (GlennSen)

Global Community Support Engineer

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Russell Admin 3 months ago in reply to GlennSen

Yes that is the document reference.

I've even tried disabling Sophos completely on the Hyper V Host Servers.

Appears to be something about the Hyper V Guests that Sophos product does not like.

I've also never seen blank users appear in Task manager like that before as per the screenshot - presumably its some sort of process being triggered by Sophos client on the Hyper V guest.

We have Sophos working fine on other standalone and Amazon EC2 servers in our same domain/environment/Server SOE so we do not believe the issue is related to co-existence ith another application.
Cancel
Vote Up 0 Vote Down

Cancel
0 Russell Admin 3 months ago in reply to Russell Admin

Also worth noting we have some Windows 10 VMs used for testing on the same Hyper V host that are running Sophos Intercept X (workstation) and they do not have any issues.
Cancel
Vote Up 0 Vote Down

Cancel
0 Sophos User930 3 months ago in reply to Russell Admin

Is it the System process that is consuming the CPU? Hard to tell from the screenshot. What does the details view show sorted by CPU?

I would send Support a 1 min ETL trace while seeing the issue:

wpr.exe -start GeneralProfile

Leave for 1 minute:

Wpr.exe -stop C:\gp.etl

Zip up C:\gp.etl and the directory with the same name as the file.

30 seconds if that's all that it will manage.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Sophos User930 3 months ago in reply to Russell Admin

Is it the System process that is consuming the CPU? Hard to tell from the screenshot. What does the details view show sorted by CPU?

I would send Support a 1 min ETL trace while seeing the issue:

wpr.exe -start GeneralProfile

Leave for 1 minute:

Wpr.exe -stop C:\gp.etl

Zip up C:\gp.etl and the directory with the same name as the file.

30 seconds if that's all that it will manage.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Russell Admin 3 months ago in reply to Sophos User930

Its a "blank" user . Never seen anything like it before.
Cancel
Vote Up 0 Vote Down

Cancel
0 Russell Admin 3 months ago in reply to Sophos User930

You're assuming support actually respond.
Cancel
Vote Up 0 Vote Down

Cancel