Dears,
Some users have an issue with a server not running, it shows "Not started: Sophos IPS" in Sophos central.
Thanks,
This thread was automatically locked due to age.
Dears,
Some users have an issue with a server not running, it shows "Not started: Sophos IPS" in Sophos central.
Thanks,
Thank you for reaching out to the community forum.
Is the affected device part of EAP? If so? Can you remove the device on EAP, perform a Manual update and restart, and then check the status?, If it isn’t part of EAP. You can try following the below steps which needs some changes on registry and let us know
1.) HKLM\SOFTWARE\Sophos\Sophos Network Threat Protection\Monitoring
ipsCrashState = 1
>> REG QUERY "HKLM\Software\Sophos\Sophos Network Threat Protection\Monitoring" /v ipsCrashState
1 = Monitoring state
2 = Retry state
3 = Permanently disabled state
2.) If value is 3
2.1.) Create a DWORD key "failure-detection.enabled" with a value of "0" in "HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Sophos Network Threat Protection\Application\"
>> REG ADD "HKLM\SOFTWARE\Sophos\Sophos Network Threat Protection\Application" /v failure-detection.enabled /t REG_DWORD /d 0
2.2.) Change to a value of “1”
>> REG ADD "HKLM\SOFTWARE\Sophos\Sophos Network Threat Protection\Application" /v failure-detection.enabled /t REG_DWORD /d 1
This will reset IPS and attempt to run, the retries key will be reset
Thank you for reaching out to the community forum.
Is the affected device part of EAP? If so? Can you remove the device on EAP, perform a Manual update and restart, and then check the status?, If it isn’t part of EAP. You can try following the below steps which needs some changes on registry and let us know
1.) HKLM\SOFTWARE\Sophos\Sophos Network Threat Protection\Monitoring
ipsCrashState = 1
>> REG QUERY "HKLM\Software\Sophos\Sophos Network Threat Protection\Monitoring" /v ipsCrashState
1 = Monitoring state
2 = Retry state
3 = Permanently disabled state
2.) If value is 3
2.1.) Create a DWORD key "failure-detection.enabled" with a value of "0" in "HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Sophos Network Threat Protection\Application\"
>> REG ADD "HKLM\SOFTWARE\Sophos\Sophos Network Threat Protection\Application" /v failure-detection.enabled /t REG_DWORD /d 0
2.2.) Change to a value of “1”
>> REG ADD "HKLM\SOFTWARE\Sophos\Sophos Network Threat Protection\Application" /v failure-detection.enabled /t REG_DWORD /d 1
This will reset IPS and attempt to run, the retries key will be reset
