One or more clients report their status to the Sophos Enterprise Console as differs from policy under the Updating Details > Updating policy.
This article discusses the cause and solution of this issue.
Applies to the following Sophos products and versions Enterprise Console
Initially it is important to confirm the client has sent a message to the Sophos management server recently. If the client has not reported to the console recently then the warning message may not be accurate.
If the server has received a recent message from the client then you should attempt to force a comply to the client. This will undo any local changes an administrator may have made to the client's configuration.
Warning: Forcing a comply for disconnected clients will generate message build-up in the management server's envelopes folder as these messages cannot be sent to offline endpoints. It is recommended you only force a comply for a small number of online endpoints first and see if the alert disappears and does not come back (see below).
Important: You may initially see the warning disappear from computers that you force to comply only to see it return after a short while (having initially complied). This happens while the policy is being sent to the endpoint and the endpoint is attempting to implement the policy. However if there is an underlying problem forcing a comply will not resolve the issue - you should work through the rest of this article to identify the issue. Forcing a policy compliance at this stage is an important step as you must rule out if the policy simply needs re-sending to the endpoint and/or a local administrator has/is altering the policy from that configured centrally.
There is a known issue whereby introducing an extra space (white character) into the username field of the updating policy can cause the policy to differ.
Occasionally the client may have trouble complying the current configuration until it has been rebooted. If you have not already done so, reboot a client and wait for the client to report (see Confirm the client has recently reported to the console above).
If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article. This is invaluable to us to ensure that we continually strive to give our customers the best information possible.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.