Web protection is no longer functional. The filtering driver has been bypassed or unloaded [0xa058000c]

I would suggest:

1. Download psexec (https://live.sysinternals.com/psexec.exe)

2. in an administrative command prompt run:
psexec -s -i cmd.exe

3. In the new command prompt type:
CD "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\"

4. Run:
swi_lspdiag_64.exe

5. Run:
swi_lspdiag.exe

Do either or both report an error?  If so what is it?

Regards,

Jak

I would suggest:

1. Download psexec (https://live.sysinternals.com/psexec.exe)

2. in an administrative command prompt run:
psexec -s -i cmd.exe

3. In the new command prompt type:
CD "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\"

4. Run:
swi_lspdiag_64.exe

5. Run:
swi_lspdiag.exe

Do either or both report an error?  If so what is it?

Regards,

Jak

Hi Jak,

Absolutely nothing appeared in the command prompt.  Is that what is the expected result if no errors?

Thanks,

Jim

Update.

I have a separate group that does not have web filtering enabled.  I moved the pc's to that group, applied the updates and rebooted.  Worked as it should.

I then moved them back to their normal group where web filtering is enabled, updated and rebooted.  Voila succuess.

I tried this last week but it did not work.  Today it did.  The Enterprise Console still reports them as having an issue.  I will let that soak overnight to see if if clears.  However, if it does not, would it be ok to Clear and/or Acknowledge the errors?  Assume yes, however just wanted to be sure if I do, should this issue arise again, will I still be notified?

Thanks again,

Jim

Yes you will be alerted again if the issue returns.

Next time you have a computer in the state, it would be worth running through those steps just to see if you get an error printed as that will be the reason for the error.

Those commands run when the swi_service.exe process starts - It's the "Sophos Web Intelligence Service" service and every hour after.  It only needs it to fail once to get the message.  It might be worth keeping an eye on what time it happens to see if there is a pattern and what might else be going on at that time.

Regards,
Jak

Hi Jak,

Sorry for the late reply.  I will keep this in mind for sure if it happens again.

Does it matter if I select Clear All or Acknowledge?  Just want to be sure that I will see this error again in the console should it happen to these two endpoints down the road.

Thanks and regards,

Jim

It doesn't matter, the error code isn't white-listed so it would come up again.

Regards,

Jak

Hi Jak,

Thanks very much.  Will do!

Regards,

Jim