Windows 10 v1903 Logoff issues

I've not seen or heard of this issue.  Do you see the issue if you turn off realtime scanning for example?

Which components do you have installed?  SAV and IntercepX?

Typically with these issues the approach is either elimination of components/through policy changes or stopping/unloading services/drivers.  This can narrow it down to perhaps offer a workaround/acceptable exclusion, etc..

Or

Setup the computer to create a full mem dump on keyboard combination as per:
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard

From the dump it is then possible to analyze what the Sophos components are doing and if they are the cause of the hang.  It's easier for Support/Dev with symbols but it's possible to get a rough idea which components/files/processes are involved.

Regards,
Jak

experiencing exact similar issues. will raise ticket with Sophos

I'm sure they will want a complete or probably better (to reduce file size) an Active memory dump initiated with the keyboard during the hang as per my previous comment.

Regards,

Jak

I'm sure they will want a complete or probably better (to reduce file size) an Active memory dump initiated with the keyboard during the hang as per my previous comment.

Regards,

Jak

Has anyone tried the following:

Global exclusions:
https://cloud.sophos.com/manage/config/settings/scanning-exclusions

Add Exclusion of type "Exploit Mitigation (Windows)"

Click "Application not listed?"

Add in
$system32\fontdrvhost.exe

and choose to not protect this application as per below:

Does this help?

It would be worth checking that the version of HMPA installed has a build number (last 4 figures) is 1045 or later for this to work.  This can be seen in Sophos Endpoint Self Help and in Central under the "Installed component versions" expandable link per device.

Regards,
Jak