Issue: Sophos Central Admin – US-West region - Delays with the enforcement of Central policies on managed endpoints.

Why am I seeing the "One or more Sophos services are missing or not running" error message so often now?  I would really like a reason for this. 

Is this message accurate? and if so, why are these services 'missing or not running'? I've checked on occasion and services 'appear' to be running.

Lance, if you go into services on your Windows machine, you will probably find that the Sophos Antivirus service has disappeared (90% of this issue) - or that all the Sophos services have been set to disabled , but you can't set them to manual or automatic (you get a denied message) even if you are an admin on the box. You can't uninstall as tamper protection is enabled but you can't update the machines policy to disable tamper protection because it won't connect to the cloud to update the policies, which don't work all the well even when all the services are enabled and not missing

There is a published article for getting around tamper protection when the machine is offline. Safe mode, couple of registry changes, bam.

But I agree there's definitely pain when the client gets into a bad place and you can neither re-install or uninstall. We gave up working with support and re-imaged.

Also, just took 48 hours for an encryption policy to push to a few machines. We're now reviewing Symantec's end point products. Their end point product may not be great but we've found their support (we use other Symantec products) at least acknowledges when there is a problem. And their Senior Vice President doesn't promise a root cause analysis then never delivers.

Can't login to Central... anyone else?

Up for me.

Just a reminder for anyone still subscribed, it's been 3 months since Michael Anderson posted here stating they 'heard us' and will share the root cause analysis with everyone once they know it's been permanently fixed. After 3 times via email telling me it was mere days away from being posted, he is no longer replying to my emails.

We're evaluating Symantec now.

Sorry for not posting this here. RCA is located here: https://community.sophos.com/products/sophos-central/f/sophos-central/96889/rca-for-sophos-central-incident---late-july-early-august 

Why did this take until October 13th to be released when the issue was in first noted in July?

in the KB it was said: "We have conducted a detailed review of the incident and have created a plan to improve operations and prevent this kind of issue in the future." Can you detail out to us the plan to improve your operations and how you're going to prevent this kind of issue in the future?

Hi Trevor,

It might be more fruitful if you post this question directly to the thread: https://community.sophos.com/products/sophos-central/f/sophos-central/96889/rca-for-sophos-central-incident---late-july-early-august

This is supervised by the Central Product Manager and can lead to a faster response to your inquiry.

Thanks,
Karlos

Hi Trevor,

It might be more fruitful if you post this question directly to the thread: https://community.sophos.com/products/sophos-central/f/sophos-central/96889/rca-for-sophos-central-incident---late-july-early-august

This is supervised by the Central Product Manager and can lead to a faster response to your inquiry.

Thanks,
Karlos

Thank you Karlos, I'll post there as well. I'm sure the 124,440 (and counting) people who have viewed this posting would like to know the answer to that question as well.

Hi Karlos;

I have another item for you. I just loaded up an new Windows laptop with Sophos Endpoint. But now in the Cloud Console Central, when I choose to look at a Device, (any Device) it will momentarily go into the device page, but before its even finished loading, it drops me back out to ALL Computers.

This happens with ALL Devices now, so I cannot manage a single item.

Seriously?? And this is Prime Time Production ready?? I think NOT!

What n the hell is going on NOW??

I cannot Manage MY STUFF.

Hi Howiedog 

Which location are you from? We'd like to know whether issue affects all regions or just some. You can also DM me location if you'd like to maintain privacy. 

We are now currently doing some testing. I will update thread once I have updates.

Thanks for letting us know.

Best,

Karlos

West Coast, Canada

Howiedog - we had this same issue happen to us earlier this week.  Support did not even know it was happening and had no explanation.  After a day and a half it fixed itself, but like the RCA, we will probably never be given any real details on why these things keep happening.  Hopefully it clears up for you soon.

Ok..this AM I can again manage my endpoints, so whatever the issue was seems to be good today.

I have another question for us all: Laptops. For us,  these are often "off line" for periods of time. (eg:2 weeks >>)

Granted its an Event, but is there a way to remove the BIG YELLOW exclamation mark because of inactivity??

Its just annoying to log into console and see all these road signs glaring at you day in day out.

Same question.....can I stop these Yield Signs for appearing for devices that are purposely OFF-LINE for periods of time?? These are NOT ERRORs, it's only a state.

One more thing. If I get one more email about services not running or missing I am going to scream.

Can I turn this email alert OFF. I want these gone out of my INBOX NOW!! 

I agree with Howiedog  This is insane Sophos - why is it so hard to get your alerting working correctly?

Karlos,

Please review the questions in this thread. We need things to stop happening.....NOW!

Hey Howiedog 

Unfortunately there is no way to remove yield signs from appearing besides devices that are intentionally off. You can simply mark those devices as acknowledged so they no longer appear on your Alerts list.

Also, at this time, email alerts on Central can not be disabled. But you can submit a vote for this feature request here.

Regarding the notification about services not running or missing, are they actually missing/not running? If the services are recovered, the issue is a cosmetic one and there is a plan to release a fix in mid-November to suppress these alerts & emails being sent out. 

If they are actually missing/not running, please have a read at our KB article: Sophos Endpoint Self Help - Services

Thanks,
Karlos