Sophos Endpoint

Discussions Issue with Sophos Endpoint Intercept X Advanced for Server on Windows Server 2022 HyperV Guests

Sophos Endpoint requires membership for participation - click to join

Thread Info

State Suggested Answer
Locked Locked
Replies 10 replies
Answers 1 answer
Subscribers 16 subscribers
Views 4643 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Issue with Sophos Endpoint Intercept X Advanced for Server on Windows Server 2022 HyperV Guests

Russell Admin 9 months ago

Issue with Sophos Endpoint Intercept X Advanced for Server on Windows Server 2022 HyperV Guests

Hypervisor is also Server 2022 host running Sophos Endpoint Intercept X with all the recommended HyperV exclusions in place.

The guests VMs get ridiculously high CPU usage and get unknown/blank users appearing.

We had same setup with Crowdstrike previously on HyperV Host and Guest without issue.

Currently have had to disable Sophos on the HyperV guests so machines can function.

This thread was automatically locked due to age.

Top Replies

Maxim-Sophos 9 months ago +2 suggested

Have you confirmed that Microsoft Defender is disabled or in passive mode? On Windows 10, it gets disabled automatically when Sophos is installed. On servers, it does not.

Parents

0 Maxim-Sophos 9 months ago

Have you confirmed that Microsoft Defender is disabled or in passive mode? On Windows 10, it gets disabled automatically when Sophos is installed. On servers, it does not.
Cancel
Vote Up +2 Vote Down

Cancel
0 Russell Admin 9 months ago in reply to Maxim-Sophos

Have GPO configured to disable Windows Defender and also registry entry to enforce passive mode

SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection

ForceDefenderPassiveMode
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Russell Admin 9 months ago in reply to Maxim-Sophos

Have GPO configured to disable Windows Defender and also registry entry to enforce passive mode

SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection

ForceDefenderPassiveMode
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 LHerzog 9 months ago in reply to Russell Admin

so no process "MsMpEng" running?

also please post the installed versions of your Sophos Server Endpoint - they may vary from customer to customer.

have you already followed Sophos User930 's suggestion . That user is very skilled and often the hints bring you very close to the root cause.

Procmon dumps may also help you.

Also I'd suggest to disable one Sophos component by another and see if that changes the high CPU.

support.sophos.com/.../KB-000036572
Cancel
Vote Up 0 Vote Down

Cancel