Second Time Computers are hanging on start after Sophos Auto Update Upgrade (Version 10.6.4 VE3.67.0)

Hello André,

I have a few running Preview without issues. How did you restore the network (as you'd need the network to apply the policy and downgrade them). 
after Sophos AutoUpdate
AutoUpdate usually checks several times a day (by default every 10 minutes), actually performs a minor update every few hours, so ... All lost connectivity at the same time? Is there just this symptom or are there additional errors or events?

Christian 

Hello Christian,

We have some other Desktop Clients (Windows 7, Windows 10) and virtual Server (W 2012 R2) without Problems running Preview.

We start the Desktop Clients (Wake On Lan) in the night for patches (Microsoft, ...) and shut down them after upgrade. Sophos AutoUpdate intervall is set to 10 minutes. So the Desktop Clients gets the new Sophos Update in the night too.

Next morning the users starts the Desktop Computer and the Network Interface is down.

To restore the Network, we have to restart the Computer in safety mode. Set Sophos Services from autostart to manual. Then restart the Computer without the Sophos Service starting.

Change the Client in the Enterprise Console in the regular Group (not Preview), new install from Enterprise Console on this Clients. The Client is working without errors.

The Clients are running Windows 7. Hardware are different HP Desktop.

We don't have other symptoms or errors.

André

Hello André,

[restart in safe mode]
I see. As you say it only fails on some endpoints - usual question: Do they have something in common apart from the issue? Preview (10.6.4) doesn't have any terrific new features except enhanced tamper protection - haven't heard that it disables (or is supposed to disable) networking though. SCF isn't installed, I assume, as otherwise you'd have mentioned it. The only other component that has something to do with networking is Device Control ...

We start the Desktop Clients (Wake On Lan) in the night for patches
Just to make sure I understand the sequence of events: The endpoints are already running Preview for some time before the maintenance WOL or they are moved to the Preview group while they are turned off?

Christian

Hello Christian

No, SCF isn't installed.

The Clients are regular Clients like other Clients. We put some of them in the Sophos Preview Group, because in January 2017 this preview Version will be the new Recommended Version. The Clients are allready installed, with the new Sophos Preview (10.6.4) and ditn't have any Problems for days or weeks. The Policies are the same on Preview like on Recommended.

The Wake On LAN we do for all Desktop Clients in the company and we didn't have any troubles with other Clients in the regular Sophos Group. If it would be a Problem because of Microsoft patches, they would be more Errors on the other Clients in the Company, too.

I don't understand what happens with this Preview Clients but it looks like, Sophos Preview and maybe some hardware or driver is the problem.

André

Hello Christian

Device Control is active, but only watching not disable.

André

Hello Christian

Device Control is active, but only watching not disable.

André