KB4503273 and problems with Server 2008

Question

Has anyone had any issues with Junes windows update particularly KB4503273 on a server 2008 box? (not R2) 
 As soon we we install it and restart the box is then stuck on applying computer settings. The only way to get around this is following similar instruction for the April's Windows update issue and boot into safe mode, disable Sophos Anti-Virus service & Sophos AutoUpdate service, boot into normal mode and remove update. 
 As soon as those two services are disabled then the box is fine again. I cant see anyone else out there having this issue but i thought i would ask 
 
 EDIT: I have removed Junes, Mays and even Aprils update but still the box hangs on applying computer settings when the SAV service is enabled. So looks like its a bigger issue than just Windows updates being applied to this machine.

StephenMcKay · Accepted Answer

Update: This issue appears to be caused due to Sophos scanning mlang.dll during boot - so far we have only seen this issue on Windows Server 2008 
 For machines that do not have the problem, you can add a temporary real-time global exclusion for mlang; c:\windows\system32\mlang.dll - this will still be scanned with a scheduled scan. 
 For machines that are already exhibiting the issue, you will need to add a temporary process exclusion in the registry, either in Safe Mode or with the Sophos AV services stopped. 
 HEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAVOnAccess 
 Create a string value called: ExcludedProcess0 
 The value needs to be csrss.exe 
 Once this process exclusion is in, you can reboot and enable the Sophos services, this will allow machines to receive the mlang.dll exclusion. We recommend that you remove the process exclusion once you have confirmed that the file exclusion has been received. 
 To check the mlang.dll exclusion view machine.xml in %programdata%\Sophos\Sophos Anti-Virus\Config and search for mlang.dll 
 Please advise if this resolves your issue. 
 We plan to address this in a future update and will update this thread when you can remove the temporary file exclusion from your policies. 
 Regards, 
 Stephen