Windows Start Menu Locked Up, unable to restart machine.

Okay thanks for the info...

Windows Defender I don't think is the issue we have had issues with and without.

You must be special we had this opened for weeks and cant even get an update.

I can confirm in each instance we log out and back in to a new profile it seems to work. We are trying a beta release but we did not get clear indication if that is a shot in the dark or an actual fix. We have not received any feedback about what exactly or superficially causing the issue, at this point we are assuming its a guess.

I have little faith in SOPHOS support. I just don't have the time to invest helping them, I am by myself with over 200 seats, I'm just trying to get myself out of trouble

I am curious, did you try the Defender thing?

If you go to Defender Security Settings

App & Browser Control, Exploit.  Turn it all off.

Then, in gpedit.msc

Comp Conf -> Admin -> Win Comp -> Windows Def Anti V

Turn off Win Def Anti V

I am really keen to see if this fixes it, 2nd machine that had an issue, that I did this, and it seems OK. 

Maybe I am special, and everything is just a co-incidence lol

I did do this but after the fact. Perhaps this needs to be done on the machine and then the Sophos install?

I did it will the local GP because I only have the test lab no domain for this currently.

What I can say with certainty any other product like ccleaner, malwarebytes, acronis 2018 etc. causes major panic so I started with Defender.

With that said it clearly states on Sophos related sites that it will work in conjunction with Defender and is made to do so.

Ok, fair enough, I'm on machine 3 with success.  Interestingly, on the 3rd, i had to ENABLE it, turn off Exploit and then disable it via GPO.

It definitely feels like a Windows Driver / Filter issue, so it is beyond direct control, you have to tinker with stuff on the surface to get it to change / remove filters at the bottom near the Kernel, though, I could be 100% wrong.  As said, 3rd machine fixed, at least I have something to play with to get it to to work for the client's that complain.

One more thing to add I did discover on two machines the system interrupt was 100% the CPU for whats its worth.

Machine No. 5 fixed this way.

My client's machines are slowly failing, 1 by 1...

So you have Sophos running with IX, Then what does enable "it" mean? Enable Defender then disable? I am just trying to write out some steps to reproduce.

Yeah we have a big problem too. We had already deleted the Windows Intune account which is what we are coming from. We are now rolling out machines without protection in fear they will lock up. Intune is a massive drag to go back to and remove, it takes hours some time because the removal process does not work that well and is not typically done on the machine.

Yes, IX is installed.  When you install IX, it disables Defender, but it looks like it doesn't do it fully.

When you click start, and type Defender, it will tell you to turn Defender On. 

So, I click that, I get taken to another screen, under Apps I think you will find exploit, turn it all off, and then gpedit.msc defender off the machine.

Touch wood, we are at 3 days on some computers without failure. Still holding my breath this is the problem, but looks promising.

It might be months before SOPHOS support fix this, I would not rely on them.

okay thanks for the information.

We will confirm in lab and report back.

Hi Kevin,

Is there anyway you can tell me the case reference number?

I have wholesale given up on support, so good on you for going through that nightmare.

My Sales Manager wants to know