Hi All,

I installed Windows 1703 and replicated all previous steps I took with 1709.  

It installed fine, and after the reboot no issues. 

The issue has something to do with 1709.

That's not a legit answer.

Kevin how did you test this?

You had a machine that was acting up with Sophos ADV and IX installed, changed this and restarted and then in was fine?

Yes I have a new system which was always failing on a reboot, so switched off this setting as per Sophos suggestion and it works so far.. I'll try it on other systems later. The Sophos description of the issue almost threw me, but just not totally accurate. Anyhow if this works then I guess it is a Windows problem and adding new switches.

Kevin

Hi

Sorry for the late reply, I actually spent even more time on this issue.

So, it took me over 4 hours to get the VM in JUST the right position. Let me explain:

I have a VM that was shutdown, and a snapshot taken. When I boot the VM, and install SOPHOS, it fails (slowness, un-responsiveness, apps don't work and the start button doesn't work.

I was able to replicate this, 100%. So, I could go back to the snapshot, install SOPHOS, and 100% certainty, it will fail.

Now, this VM is FULLY updates except 1 Windows Defender definition update. It only have VMware Tools installed.

I then proceeded to test (this honestly took 1/2 a day, and today is a public holiday, so here I am doing SOPHOS' job trying to fix this crap instead of spending time with my family):

Install, Restart - FAIL
Install, Restart - FAIL
Update, Install, Restart - OK --> Restart - FAIL
Update, Install, Restart - FAIL
Update, Restart, Install, Restart - OK --> Restart - FAIL
Update, Restart, Off, Install, Restart - FAIL
Signin Option, Install, Restart, OK --> Restart - FAIL
Signin Option, Install, Restart, OK --> Restart - FAIL
Defender Option, Restart (to reflect gpedit.msc), Install, Restart, OK --> Restart - OK

Kevin, I have no idea about this Sign in option of yours, it just doesn't work for me. I am unsure if the actions I am taking with my defender option is triggering something else, I don't know, it is however, working for me.

I have no sunk TOO much time into this, I'm out.  I am very dissapointed with SOPHOS, I am somewhat amazed no one else is experiencing this issue.  It CAN'T just be us.

I download a FRESH copy of Windows 10 from Microsoft. I install a FRESH SOPHOS AV+IntX from SOPHOS's Cloud and BOOM, fail.  How can this JUST be us?!?

I feel like I've taken crazy pills.

Anyway, Good Luck guys :)

Hi Burt and All,

Burt - It sounds like you had a bad day and on your day off. Its not good trying to work issues like this on a day off for sure..

I've now switched off this new 1709 feature on my systems which have the problem so far and they all now work. My Windows defender is enabled and so far fingers crossed I'm not now seeing this problem.

This make me think are there two issues? do we have exactly the same issue? 

Anyhow below is a copy of the email I received from Sophos support yesterday. The problem details are not complete and how it manifests itself is not accurate, but I suppose we have seen and worked this issue for a lot longer than they have..

Regards

Kevin

----------------------------------------- Article ID: 124988 Title: Sophos Intercept X and Exploit Prevention: Known issues URL: https://sophos.com/kb/124988 -----------------------------------------

Windows 10 RS3 - Start UI fails to run during first login session

This issue occurs on computers not joined to a domain. Investigation has shown to be a possible Microsoft issue. A reboot may resolve the issue. The following two options will also prevent the issue from occurring:

• Locally, under User Accounts logon settings, by disabling the setting Use my sign-in info to automatically finish setting up my device after an update or restart.
• Globally as per the following article https://social.technet.microsoft.com/Forums/windows/en-US/efc99b56-8f1f-4364-b081-0b6db46e9dda/global-policy-for-new-use-my-signin-info-to-automatically-finish-setting-up-my-device-after-an?forum=WindowsInsiderPreview

I ran into this exact issue with Sophos Home 1.2.11 beta -- We already know there are shared components between Sophos Endpoint and Sophos Home.

It appears to me like the Sophos software may be creating some sort of timing issue, causing this issue.

When Sophos is installed here are my symptoms:

1. the Windows startup process is definitely slowed with sophos installed
2. The taskbar becomes visible during system startup, but the applications I have pinned to the Windows 10 taskbar do not appear right away-- there is definitely a delay.
3. The start menu is not clickable until after the pinned taskbar icons are visible.

Pretty much 50% of the time I reboot the computer, the Start Menu is not clickable, even after the pinned taskbar icons appear.  So if I reboot 6 times in a row, it's guaranteed that are that the start menu will be clickable on only 2-3 of those boots, max.

Here's where things get interesting... 

I toggled that "use my sign-in info" from the previous post and it did not make a difference for me, but it got me thinking... just because that didn't work, doesn't mean it's not a sign in issue.

On the affected computer, I have a blank password... so the system auto-logs in.

Next steps:

1. I then created a password for my login account
2. Rebooted at least 5 times and could not trigger this issue
3. I changed the password back to being blank and rebooted
4. Issue then starting triggering immediately after reboot

I then uninstalled Sophos, so I'm using the built in Windows Defender, rebooted several times (with the blank password) and the issue does NOT occur.  Windows also boots way faster.

So my question to the group: Is anyone experiencing the issue only when using blank/no login password on their system?

Hi JordanM and All,

I did some more testing today here are my findings:

1. On two test systems I removed the  windows password same as Jordan, the "sign-in info"  switch was disabled, windows defender all enabled I did 12 reboot tests on both systems 0 failures
2. This time I enabled the "sign-in info" switch, No login Password, windows Defender enabled and did 12 reboot tests and 0 failures on both test systems.
3. I then added a login password on both systems, I also enabled the "sign-in info" switch. windows Defender enabled and both systems failed, one failed 3 out of 6, the other 4 out 6 reboot failures.
4. Last test, I disabled the "sign-in info" switch, still with a login password,  windows Defender enabled and both systems were successful with 8 out 8 reboot and no failures.

It seems to me each of us are experiencing different results of what works and what does not. Removing the Windows password does have an effect regardless of the "sign-in info" switch setting. I can't explain why disabling the "sign-in info" switch works for me... I have now tested this on 6 different failing systems and it solves the problem for me on all of them. Burt has found disabling Windows Defender works for him on his systems. The only other explanation is we are looking at two separate issues? In my case when the problem shows. Start, Edge and settings do not work and the overall system performance is noticeably slower. After I have clicked on Edge and then right click start to either reboot or shutdown, edge seems to start in a fashion although not responsive which can be said for other applications which are slow to start.

I can only suggest for those who have not logged a case to Sophos then it is in your best interest to do so as I think the more cases they see adds weight to the problem. I still have my case open ( #7862295) and it is escalated. If I see the issue re-occurring when I have the "sign-in info" switch disabled, I'll for sure be in contact with them, but right now they have given me a solution which seems to work for me.

Regards
Kevin

Hi All,

One other point I forgot to mention was prior to Sophos communication about disabling "sign-in info" switch, they had me run with only Endpoint Advanced and not with Intercept X installed as well. This did work without any problems.

Kevin

On my same problem computer, I installed Norton Internet Security and didn't see the issue happen yesterday.  Today, I rebooted it a few times and was able to trigger the same issue.  Now it's making me wonder if it relates to security vendors that utilize exploit protection, or if it is in fact unrelated to security software altogether. 

In my scenario today, the Windows sign-in option was enabled and I was using a login account with a password.

Logging out of the computer and logging back in restores functionality (no need for reboot).

I'll try disabling that Windows sign in option again and will continue using a login password and see if it reduces my symptoms.

I have the same Problem...

My case #7887075

Hope to hear something from Sophos

Hi Martin and All,

Just to let you know Sophos got back to me and as far as they are concerned this is now a known issue, that is the "Use my sign-in info..." switch and there development team are working on this with MS. They did not make me aware of any other issues causing this problem. Clearly this solution is not working for many in this forum so I guess lets see what they have to say about this.

Regards
kevin

Hi Martin and All,

Just to let you know Sophos got back to me and as far as they are concerned this is now a known issue, that is the "Use my sign-in info..." switch and there development team are working on this with MS. They did not make me aware of any other issues causing this problem. Clearly this solution is not working for many in this forum so I guess lets see what they have to say about this.

Regards
kevin

We were able to confirm on two machines...

Install Windows, update to latest, use username with password, disable sign in option, install IX and it seems to work. With that said we may not have an exact control environment because we noticed on the download this is a different version of IX.

We can also confirm even with the new version the updating of Visual Studio was a shot in the dark, it did not work.

Still have not heard anything back on our ticket and its been well over a month.

I also have the Start Menu locked up issue.  It is on Windows 1703 and 1709 computers.  I started with a fresh 1703 version and went through the following on clients domain.

You have to open the Windows Defender Security Center

and disable Virus & threat protection.

Martin,

Disable everything before installing Sophos?  I tried the reg change to disable Windows Defender Security Center and looked to have worked.  I have WDSC enabled again and see Virus & threat protection, SmartScreen and Exploit Protection.

Do you know if these have to be disabled before installing or can you turn them off after Sophos is installed?

Thank you.

First disable WDSC and then Install Sophos. Thats it

Thanks.  I have many computers to fix.