Windows 10 CD/DVD-ROM issue

Question

Hello all,

I believe I may have discovered an issue relating to Windows 10 and the Sophos endpoint agent. I upgraded to Windows 10 yesterday and checked device manager to find that my DVD-RW was not functioning properly. If I uninstall the device, rescan for hardware changes and let it automatically reinstall, it functions properly again. Upon rebooting, the DVD-RW stops functioning again until I repeat the aforementioned steps. I have noticed that after rebooting, a second driver is added for the DVD-RW from Sophos: sdcfilter.sys. Presumably this is needed for the endpoint agent to perform device control functions such as blocking writable drivers which we do utilize in our environment. I'm not positive this is causing the issue, but that evidence suggests that. I am going to report this to Sophos support in hopes that it might be a bug that could be corrected in the upcoming 10.6 release for all those early adopters but I thought I'd post it on the forums as well in case anyone had a similar experience. I've attached two screenshots to support my post.

J

This thread was automatically locked due to age.

jak · Answer

Hi,

If you get it back into the working state as you have done previously by essentially removing the sdcfilter (lower filter). Then find the inf file for the sdcfilter driver in the AutoUpdate cache, e.g.:

C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\ClassFilterDrivers\wnet_amd64\

right click on the sdcfilter.inf file and choose install. Does the lower filter appear as listed and the device functional?

I wonder if a fresh install vs an in-place upgrade causes this?

Regards,
Jak

Barry Smith · Answer

Hi, 
 I am running Sophos Cloud at a corporate size business. 
 We recently released the WSUS 1703 Feature Update out to our Windows 10 1607 PCs and they all failed the migration of the DVD drive and any locally attached printers. 
 After much moaning at Microsoft for yet another failure in their Updates process, I was advised the Sophos had caused this issue before and I was directed here. After reading this post, I uninstalled Sophos Cloud Endpoint Agent from one of the failed PCs and restarted. The DVD drive appeared immediately. 
 So, Sophos Endpoint Agent is stopping the migration of specific drivers during the update process from 1607 -> 1703. In a business our size, uninstalling Sophos from every PC before enabling a WSUS update is not a very practical solution. Can anyone advise of a more sensible or practical solution that I should be looking at? I see this happened with the 1511 -> 1607 feature update as well, (although I didn't experience that upgrade path,) so what was the most practical solution after that? 
 If anyone could offer a practical solution to fixing 300+ PCs, I would be grateful. 
 Cheers, 
 Barry.

jak · Answer

On the next ide update (or any update requiring an actual update not just a check) post OS upgrade the SAV installer will recognise it is not a complete install and switch to a major install which will add the sdcfilter service back. Microsoft does not migrate the driver as it's not PnP but it should be re-instated in a couple of hours depending on when the next ide update is released.

jak · Answer

This appears to be fixed in the latest version of SAV - 10.7.6 - downloads.sophos.com/.../sesc_onprempreview_rneng.html 
 As a test, from a working state, to uninstall the driver to essentially re-create Windows not migrating the service on Windows 10 upgrade: 
 sc delete scdfilter Now, wait for the next ide update - the install log notices that SAV is not complete and switches to a major update and the service is restored. 
 If you're missing this service in the on-premise world, then having the client install the Preview version should add it back shortly after. 
 Regards, 
 Jak

Sean Sauve · Answer

I get it! This took WAY too long for Sophos to fix. Ridiculous. 
 
 Here is what Sophos told me a few days ago, but I do not have any machines that need a build upgrade so I can't test it 
 
 Hi Sean, My Global escalations team has gotten back to me and we released version 10.7.6 for the anti-virus component which has the fix for the dvd drive issue. Just wondering if you are still seeing this issue and if you are we would need a new set of logs. To confirm what version you are running you could open Sophos on the endpoint, click on "about" in the bottom right hand corner, click on "Run diagnostic tool", then click on "installed components" and you should see for the anti-virus as 10.7.6.117