Clear Text Authentication via MgntSvc.exe

Question

Hi, 
 I could see clear text authentication (logon type 8) with event code 4624 (Logon successful) via Splunk on our server where Sophos central is installed and process name is MgntSvc.exe, might be communicating with management server on timely basis. 
 Is there anyway Sophos Central can encrypt the password while communicating with management server? 
 
 Regards, Tejas

Adithyan Thangaraj · Answer

Hi Tejas, 
 This looks pretty relevant to this part of the KBA on reasons why Management Service wouldn't start. So, the password itself is obfuscated internally by SEC using its obfuscation utility as explained under Technical Information Section of this KBA on the User Accounts used by SEC. Should you find any anomalies like Password visible as clear text (un obfuscated) then this should do the trick for you, although the password is usually obfuscated and stored in registry already. In case you face any further concerns on the same, please feel free to involve support to further dig into this in detail to understand this behavior! Kindly please open a support case with us using this link .