This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Windows Message Sophos On-Access Scans deactivated | Scans still work e03d000f


for a few weeks now we encountered a problem some people are getting a windows message sophos scans deactivated see screenshot.

On Access scans still work on those devices so i'm a bit confused why windows is showing this message.

This error occurs on affected devices 10-20 times on a workday. 

These Devices got one error message: e03d02f0 identity token not found.

Greetings Neo243

This thread was automatically locked due to age.
  • Hi ,

    Aside from this message are you getting any failure error on the endpoint itself? how many machines are currently getting this kind of notification? On your console what was the status of the said machines? 

    Glenn ArchieSeñas (GlennSen)
    Global Community Support Engineer | Global Community and Digital Customer Support
    Connect, Engage, Earn Rewards - Join the Sophos Community
  • Is there anything in the Windows Application event log to suggest a process is crashing and restarting?

    Is there anything useful in either:

    C:\ProgramData\Sophos\Sophos Anti-Virus\logs\sav-trace.txt

    C:\ProgramData\Sophos\Sophos Anti-Virus\logs\sav.txt

    This makes the assumption that the real-time protection that is failing is part of SAVService.exe. There is a chance it's part of the Core agent.

  • ok 30 minutes later i got another scan deactivated windows 10 message and i have nothing in the event log or in the sav files @sophos user 930 @glennsan

    So i just encountered this error on my device 

    sav-trace sav.txt are empty

    event log showed this message when the scan error occured. 

    We are using remote desktop published apps for some software in our company.

    event id 1000
    Name der fehlerhaften Anwendung: mstsc.exe, Version: 10.0.19041.746, Zeitstempel: 0x8fbf6fed
    Name des fehlerhaften Moduls: mstscax.dll_unloaded, Version: 10.0.19041.985, Zeitstempel: 0x43092a70
    Ausnahmecode: 0xc0000005
    Fehleroffset: 0x00000000003bffea
    ID des fehlerhaften Prozesses: 0x5114
    Startzeit der fehlerhaften Anwendung: 0x01d75cfda58e82fa
    Pfad der fehlerhaften Anwendung: C:\Windows\System32\mstsc.exe
    Pfad des fehlerhaften Moduls: mstscax.dll
    Berichtskennung: 13051f44-c196-498f-9269-4cbcd5b875ce
    Vollständiger Name des fehlerhaften Pakets:
    Anwendungs-ID, die relativ zum fehlerhaften Paket ist: