Sophos System Protection Service not running on multiple machines across multiple customers

I am seeing this as well. Actually, today we had a large group of our sales staff all kicked off the network because this service didn't start and Heartbeat dropped their connection.

I see this on my computer every time I boot up, and have an automation policy to start the service. I get an email every time I restart or boot up. Manually starting the service works (it's one of the few services I've had luck with manually starting)

I am seeing this as well. Actually, today we had a large group of our sales staff all kicked off the network because this service didn't start and Heartbeat dropped their connection.

I see this on my computer every time I boot up, and have an automation policy to start the service. I get an email every time I restart or boot up. Manually starting the service works (it's one of the few services I've had luck with manually starting)

Are you able to install the new EAP version https://cloud.sophos.com/manage/eap -  "Intercept X New Features" on a computer that regularly suffers the issue?  The reason I ask is that it appears to be very different in version 2.  Maybe once it is installed, if you restart it a couple of times does it start without issue?

Regards,

Jak

Thanks for the reply Jak. At least for us, we literally just moved internal machines off of EAP to address concerns around the latest vulnerabilities. It was my understanding the EAP is done in a few weeks as well so we wanted to slowly move off to allow time to address any issues.

Hi,

Are you saying that you had issues with the SSP service "reliably" not starting (event log showing a timeout) on computers at startup that were running the EAP version?

There was a "bug"/"change needed to be made" with the EAP version after applying the last round of MS patches as per:

https://community.sophos.com/products/intercept/early-access-preview/f/intercept-x-for-windows/99364/meltdown-and-spectre-the-chip-bugs-and-intercept-x-early-access-program/360994#360994

This is a different issue to timing out a startup though.

Regards,

Jak

I am having issues on the GA version 11.5.11

OK, It will be interesting to see what happens when the new endpoint version starts rolling out.  I believe as early as next week but it will take a while for all accounts to be updated.

It will also be more informative in Central as of this weekend given the information here: https://community.sophos.com/kb/en-us/127758 regarding the state of services.  Rather than just not running/missing it will say if they are missing or not running.

Regards,

Jak