Sophos will cause performance issue (slow response) on Windows Server 2019

Hello Jameel,

easy part first - Sophos System Protection has been removed with 10.8.4.3.

all Sophos components are removed
and rebooted afterwards? I'm not aware that there could be leftovers. Can you identify the process or processes consuming the CPU?

Christian

Hello Christian,

Thanks for being always there for help.

Yes, I rebooted the server many times after removing Sophos.

Actually, it is not easy to limit the processes which consuming the CPU, but here are some which I could notice after monitoring the Task Manager:

- System Interrupt

- Internet Explorer (or Windows Explorer) itself when I open it until it is opened (which might be normal)

- Services and Controller app

- Windows host process (Rundll32)

- Service Host: Local System (including 18 items)

- Task Manager itself (which might be normal)

To be honest, all the above-mentioned processes might be normal to have slightly high CPU consuming, but this performance issue occurred only after I installed Sophos the first time, so when the server was newly created and had no Sophos before, there was no performance issue at all !!

Hello Christian,

Thanks for being always there for help.

Yes, I rebooted the server many times after removing Sophos.

Actually, it is not easy to limit the processes which consuming the CPU, but here are some which I could notice after monitoring the Task Manager:

- System Interrupt

- Internet Explorer (or Windows Explorer) itself when I open it until it is opened (which might be normal)

- Services and Controller app

- Windows host process (Rundll32)

- Service Host: Local System (including 18 items)

- Task Manager itself (which might be normal)

To be honest, all the above-mentioned processes might be normal to have slightly high CPU consuming, but this performance issue occurred only after I installed Sophos the first time, so when the server was newly created and had no Sophos before, there was no performance issue at all !!

Hello Jameel,

System Interrupts should normally not stand out. And they shouldn't spike if you start an application like IE. A possible cause are driver issues (as this is a VM the real hardware is not the prime suspect but who knows). 2019 is already supported by Endpoint for some time and I haven't heard of performance issues - especially ones that persist after uninstalling. We're not yet using 2019 though so this is not first-hand experience.
Is this your first 2019 VM? Could you perhaps try to reproduce the problem (i.e. performance ok for a day or so, install Sophos - issues, uninstall - issues persist) with another VM?

Christian

Hello Christian,

Actually this is the second VM on which we are testing Sophos with Windows Server 2019, and both machines behaved the same !!

But here I have to mention, that both VMs were created from the same VM Template in VMware, so they are identical in drivers, settings, .. etc.

Hello Jameel,

if the issue is reproducible and presumably connected with Sophos you should open a case with Support. Especially as it seems the machines are not returned to their previous state after uninstall.

Christian

Hello Christian,

I will do, thank you anyway for your help.

Hi Jameel,

You can also try to create the batch file for uninstall using the article https://community.sophos.com/kb/en-us/122126

Hi Saj,

The article is only for Sophos Central Endpoint and Central Server, I have a Sophos Endpoint Protection which is managed by SEC.

for example, I cannot find the command uninstallcli.exe (even though I can uninstall from Control Panel/Programs and Features), but I am not sure if I can go further with this article !!

Hello Jameel,

you're right, doesn't really fit. RMS is missing and the product codes might or might not be "complete". 

I am not sure if I can go further with this article
You've missed the following line under What to do:
• To gather the uninstall strings, run the appropriate commands that can be found in the KBA 109668 (my note: AKA Sophos Endpoint Security and Control: How to uninstall using a command line or batch file)

Christian

Hi Christian,

I gathered the uninstall strings after I uninstalled Sophos and the result was: End of search: 0 match(es) found.

which means - as you mentioned in one reply already - that there are no leftovers from Sophos after it is been uninstalled.

Hi Jameel,

 Can you please share the exact version of Windows 2019. Is that standard/Datacenter/core?

Hi Saj,

It is Windows Server 2019 Standard version 1809 OS build 17763.805