Issue: Sophos Central Admin – US-West region - Delays with the enforcement of Central policies on managed endpoints.

Why am I seeing the "One or more Sophos services are missing or not running" error message so often now?  I would really like a reason for this. 

Is this message accurate? and if so, why are these services 'missing or not running'? I've checked on occasion and services 'appear' to be running.

Lance, if you go into services on your Windows machine, you will probably find that the Sophos Antivirus service has disappeared (90% of this issue) - or that all the Sophos services have been set to disabled , but you can't set them to manual or automatic (you get a denied message) even if you are an admin on the box. You can't uninstall as tamper protection is enabled but you can't update the machines policy to disable tamper protection because it won't connect to the cloud to update the policies, which don't work all the well even when all the services are enabled and not missing

There is a published article for getting around tamper protection when the machine is offline. Safe mode, couple of registry changes, bam.

But I agree there's definitely pain when the client gets into a bad place and you can neither re-install or uninstall. We gave up working with support and re-imaged.

Also, just took 48 hours for an encryption policy to push to a few machines. We're now reviewing Symantec's end point products. Their end point product may not be great but we've found their support (we use other Symantec products) at least acknowledges when there is a problem. And their Senior Vice President doesn't promise a root cause analysis then never delivers.

Can't login to Central... anyone else?

Up for me.

Just a reminder for anyone still subscribed, it's been 3 months since Michael Anderson posted here stating they 'heard us' and will share the root cause analysis with everyone once they know it's been permanently fixed. After 3 times via email telling me it was mere days away from being posted, he is no longer replying to my emails.

We're evaluating Symantec now.

Sorry for not posting this here. RCA is located here: https://community.sophos.com/products/sophos-central/f/sophos-central/96889/rca-for-sophos-central-incident---late-july-early-august 

Why did this take until October 13th to be released when the issue was in first noted in July?

in the KB it was said: "We have conducted a detailed review of the incident and have created a plan to improve operations and prevent this kind of issue in the future." Can you detail out to us the plan to improve your operations and how you're going to prevent this kind of issue in the future?

Hi Trevor,

It might be more fruitful if you post this question directly to the thread: https://community.sophos.com/products/sophos-central/f/sophos-central/96889/rca-for-sophos-central-incident---late-july-early-august

This is supervised by the Central Product Manager and can lead to a faster response to your inquiry.

Thanks,
Karlos

Thank you Karlos, I'll post there as well. I'm sure the 124,440 (and counting) people who have viewed this posting would like to know the answer to that question as well.

Hi Karlos;

I have another item for you. I just loaded up an new Windows laptop with Sophos Endpoint. But now in the Cloud Console Central, when I choose to look at a Device, (any Device) it will momentarily go into the device page, but before its even finished loading, it drops me back out to ALL Computers.

This happens with ALL Devices now, so I cannot manage a single item.

Seriously?? And this is Prime Time Production ready?? I think NOT!

What n the hell is going on NOW??

I cannot Manage MY STUFF.

Hi Howiedog 

Which location are you from? We'd like to know whether issue affects all regions or just some. You can also DM me location if you'd like to maintain privacy. 

We are now currently doing some testing. I will update thread once I have updates.

Thanks for letting us know.

Best,

Karlos

West Coast, Canada

West Coast, Canada

Howiedog - we had this same issue happen to us earlier this week.  Support did not even know it was happening and had no explanation.  After a day and a half it fixed itself, but like the RCA, we will probably never be given any real details on why these things keep happening.  Hopefully it clears up for you soon.

Ok..this AM I can again manage my endpoints, so whatever the issue was seems to be good today.

I have another question for us all: Laptops. For us,  these are often "off line" for periods of time. (eg:2 weeks >>)

Granted its an Event, but is there a way to remove the BIG YELLOW exclamation mark because of inactivity??

Its just annoying to log into console and see all these road signs glaring at you day in day out.

Same question.....can I stop these Yield Signs for appearing for devices that are purposely OFF-LINE for periods of time?? These are NOT ERRORs, it's only a state.

One more thing. If I get one more email about services not running or missing I am going to scream.

Can I turn this email alert OFF. I want these gone out of my INBOX NOW!! 

I agree with Howiedog  This is insane Sophos - why is it so hard to get your alerting working correctly?

Hey Howiedog 

Unfortunately there is no way to remove yield signs from appearing besides devices that are intentionally off. You can simply mark those devices as acknowledged so they no longer appear on your Alerts list.

Also, at this time, email alerts on Central can not be disabled. But you can submit a vote for this feature request here.

Regarding the notification about services not running or missing, are they actually missing/not running? If the services are recovered, the issue is a cosmetic one and there is a plan to release a fix in mid-November to suppress these alerts & emails being sent out. 

If they are actually missing/not running, please have a read at our KB article: Sophos Endpoint Self Help - Services

Thanks,
Karlos

Re: Services running / not running - honestly I get so many now, I would just checking all day long to see if services are running or not. 

Yesterday I found a Intercept X (HMPro) service not running on a couple computers - Why? Who knows. This leaves me unprotected and its not good enough. 

No...they are NOT MISSING.

That IS the problem right there. Sophos Central has no idea......which would seem to indicate a major communication problem.

And to add insult to injury....I got emailed about a released product update yesterday and to push out to my Test Machine. Did that yesterday.

32 hours later......still not there.

You SERIOUSLY CANNOT expect us to stand by while you guys work the problem?? I paid thousands of dollars for this.......:(

I need a product that works, thats the bottom line here. If I push an Update, it better get installed a few min later, not hours or days later.

How do you sleep at night because I can't.  I just wasted a whole bunch of my companies money on a product that can't perform.

Today I have my job, tomorrow I may not be so lucky. 

This simple truth is this:  We are locked into multi-year contracts with their garbage beta software and there is nothing we can do.  So while we fret and worry about security, their execs are laughing and partying on our dime.  I have already steered several potential customers away and I will continue to do so as long as this product fails to do what it claims.

Just performed a fresh install of Sophos Endpoint and when I go into the About section I see my client is in a Warning (Yellow Exclamation Point) state.

The Management Communication is reporting: Failed with error 'WinHttpSendRequest failed:12007' at 11:40:39 Nov 16, 2017 [UTC-5:00]

All the other areas are Green Check marks except my Policy section is a Blue i so I'm not confident this client has received a Policy.

Anyone else having Management Communication problems? I can confirm I am not blocking traffic to the Management Server.

Haven't had any Management errors today.....yet.

MID November...a patch is coming?? Soon? or Wishful thinking..stringing us along!! We'll see.

Uninstalling Sophos...seems to be another thorn in my side. 

1) Disable Tamper Proof (Cloud Console)

2) remove Sophos software from client

3) Tamper Proof must be turned off.......wait....wait....wait...for 20 min.

4) Try uninstall again: Attempting to stop AutoUpdate. Failed Reboot required

5) reboot

6) Try uninstalling again. Attempting to stop AutoUpdate (again) Failed. reboot required (what..I just did that?)

7) reboot

8) try again......AutoUpdate is Updating...please wait.

9) wait for 5 min......uninstall fails again...reboot required

10) Uninstall for the 4th attempt....finally it uninstalls...but guess what...ANOTHER REBOOT.

So....4 reboots to get this abomination removed.

In between all this...Console shows...:Failed to install Unknown   

The amount of concise reporting is mind boggling. So what the hell failed that is UNKNOWN??

IMPORTANT & URGENT:

WISH LIST: The Console MUST have the ability to remove client software, pure and simple. Access to a users PC and 4 reboots is unacceptable. (meaning this can ONLY be done after hours)

Worst purchase I have ever made.