Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Subscribers 13 subscribers
  • Views 4363 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is excluding Microsoft application from real time scanning files (local/network) possible?

Masato

Hi, our macOS users are experiencing the serious slowness to open and load PowerPoint slides saved on Sharepoint / One Drive on their desktop PowerPoint application.

Sometimes the application gets frozen and need to force quit.

We identified that real time scanning of Sophos EP is causing this slowness after turning off functions one by one temporary on the machine.

Now the question is, is it possible to disable real time scanning for specific application with Sophos EP on macOS?

We know we can disable it from the policy, but we would like to minimize the scope of exclusion if possible.



This thread was automatically locked due to age.
Parents
  • 0

    Hi Masato,

    Thanks for reaching out to the Sophos Community Forum. 

    It's not currently possible to exclude processes or daemons on macOS. I found an existing feature request for this and have associated it with your account record. 

    I'd suggest creating file or folder exclusion for the directories where the problematic applications and files reside, as disabling scanning entirely is not suggested. The following article will help with this.
    - macOS scanning exclusions

    Do you find that turning off "Real Time Scanning - Files" results in the most improvement, or are you also disabling the "Internet" option as well? 

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to Qoosh

    hi Kushal,

    I think turning off Files resulted more effective. But turning off Runtime protection (Cryptguard) is also improving the performance, especially when we run the app.

    I tried excluding .pptx and sharepoint & onedrive domain, but didn't help.

    On Console.log I can see the below log constantly outputted while loading a file.

    Failed to create LSApplicationRecord for file:///Library/SystemExtensions/DA38B7F7-064A-42B8-A234-90CB53BAD736/com.sophos.endpoint.scanextension.systemextension/: 'The operation couldn’t be completed. (OSStatus error -10811.)'

  • 0 in reply to Maxim-Sophos

    Hi Maxim, thank you for the information, I think this is the case, at least with the latest minor ver of Ventura, the performance was normal. I'll try with fresh installed Sonoma 14.3 machine and see it.

  • 0 in reply to Masato

    According to the advisory, if we use a wiped and freshly installed with machine Sonoma later than 14.2.1, I wonder this issue is supposed to be not reproduced? I've setup a machine with 14.3.1 and it's still outputting the same error message on console at opening PowerPoint slides.

Reply
  • 0 in reply to Masato

    According to the advisory, if we use a wiped and freshly installed with machine Sonoma later than 14.2.1, I wonder this issue is supposed to be not reproduced? I've setup a machine with 14.3.1 and it's still outputting the same error message on console at opening PowerPoint slides.

Children
Unfiltered HTML