Disclaimer: Please contact Sophos Professional Services if you require assistance with your specific environment.
Microsoft's Process Monitor tool (or other similar tools) reports many access denied messages for Sophos-related processes.
Applies to the following Sophos products and versions:
- Sophos Endpoint Security and Control
Use Backup and Restore
Restore the computer to a working state. Follow the steps in the Microsoft article https://support.microsoft.com/en-us/windows/backup-and-restore-in-windows-10-352091d2-bb9d-3ea3-ed18-52ef2b88cbef.
The script below uses the Microsoft utility SubInACL to force the Administrators group and local SYSTEM account on three hives of the registry and the system folder on disk. Both are granted full control permission.
- Make a full backup of the computer before using the script.
- Back up the registry. Corruption of the registry may leave the computer in a non-bootable state, and assistance from Microsoft may be required to correct the issue.
- The script only adds permissions to the keys that are expected. The script does not remove any permissions.
- Download and install SubInACL
- Create a file named
C:\Program Files\Windows Resource Kits\Tools.
- Edit the file
reset.cmdwith the following content:
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=system=f
- Open Run.
- Type the command
"C:\Program Files\Windows Resource Kits\Tools\reset.cmd".
- Click OK.
The permissions will be reset after a few minutes. Errors will pop up about keys that the script can't change, which is normal behavior. It’s recommended to run the script twice, with a restart in between, before continuing to troubleshoot.
Sign up to the Sophos Support SMS Notification Service to get the latest product release information and critical issues.