sophos endpoint 11.5.4 client after ctrl+alt+del takes 60 minutes to recover

Hello GP,

these are Central managed endpoints and the issue might be related to Central. And SESC customers likely say - 11.5.4?? Hey, I've just upgraded to 10.7.2 (well, SAV is 10.7.1 on 11.5.3 but it wouldn't ring a bell). It's perhaps a good idea to move this thread or ask the question in the Central group.

Christian

Hi Christian,

     i was trying to find something in all .log files into sophos folder but it is full of lines....

Do you know which .log file should suite me better to figure out the problem?

Thanks!

Hello Gerardo Pauza,

as said, this might be related specifically to the Central client and not a general issue with the endpoint software and the Central forum might be the better place to ask.

which .log file
there's definitely no log which would contain a line like User logon took more than 60 minutes because of ..... So you have to have at least a vague idea what you could look for.
Is it 60 minutes after username and password have been entered until the Desktop is shown? If the user logs off and logs in - does it again take 60 minutes? Is it definitely tied to certain computes (i.e. any user logging in on these devices sees the delay), could it be the users, or perhaps a combination?
Disabling all services - apart from the fact that it isn't an option - doesn't give much insight. Am I correct that you've tried to disable all and the problem wasn't there? If so, try them one by one. Anything in the Windows Event log?

Christian

Hi Christian, thanks for you answer.

First of all, i couldn´t find how to move this topic to the General Forum. That's why remain here.

I´m pretty sure that there is no where to find something like "user logon took more than 60 minutes.....", i'm thinking about a log containing something like "..can not contact central..." , "the connection to central has been lost" or "endpoint services stopped several times". Im just looking for errors to find the tip of the iceberg.

Disabling all services fixed the logon time issue.

No matter the user after restarting, the problem is before user and password prompt. Changing the user without restart works without problems.

starting any of the services in red the issue come up.

thanks

I think that i've found some problems with hitmanpro feature.

Look at these log errors in the client log files:

--Under "health.log" file, a lot of this warnings -->

--Under "mcsagent.log" file, a lot of these errors-->

Any ideas?

Thanks!

Hello Gerardo Pauza,

I think the Central/Central forum would be better than Community Feedback/General. Move is only available/possible if you have already joined the target group (e.g. Central) - even moderators can't move otherwise.

I see you have some details - am I correct when saying that it takes 60 minutes the first time (and only the first time( after a (re-)start until the login is available? Have to think about the screenshot showing the services that were disabled and those that were not.

Christian

Hello ,

starting any of the services in red
hm, this shouldn't be the case - the Sophos Web Intelligence Update is usually stopped, if started it checks if it has "something to do" and if not (which is usually the case) stops immediately.
Do the errors in the logs you've mentioned subside once the login is available?

Christian

Hi Christian,

       I can see those errors after login is available...

Hi Christian,

       I can see those errors after login is available...

Hello Gerardo Pauza,

hm, if there is a hint in the Sophos logs it might be necessary to correlate them (perhaps also with Windows logs) so a direct contact with Support would be advisable. In addition, they might have heard of similar issues.

Christian