Exploit Prevention policy cannot open & setting

Hi Haridoss S, 

Thanks reply , 

On SEC, Exploit prevention policy "cannot" edit , when i double click it nothing happened.

so.. i didn't know where can restart exp  or other way can fix it .

Hello YuzenChen,

you're clicking on the Default policy? If you right click it - do you get the context menu pop-up? And if you right click on Exploit prevention - can you create a new policy?
You say you were able to open the policy (did you ever edit it) but since installing on an endpoint (just one? Did you install using Protect from the console?) you no longer are?

Christian

Hi QC, 

Thanks reply , 

Yes, when i click on default policy , it didn't get menu to setting .(only exp policy , other policy like sav,update can using) 

After i install exp on endpoint(more than 600) , this issue just happened. i cannot create new policy & edit it now .

I install exp using registry key insert to these endpoint , then AutoUpdate will update sophos clean & hmpa.

Hello YuzenChen,

if you go to the Update managers view and open a subscription what does it say for License family?

You have checked on the endpoints that it is installed, haven't you? If you click through the Protect Computers wizard is Exploit Prevention among the features? Just asking whether everything else looks correct.

Christian

Hi QC, 

My customer using trial license now , because new license(include exp ) start day is July 1.

If customer's user more than 700u , it effect exp funciton?

I've check on the endpoints , it is installed normal. 

Hello YuzenChen,

SEC doesn't know the number of licensed users, just the licensed features. I'm not aware of any functional limitations of trial licenses, and likely it isn't a bug in SEC as otherwise we'd have already heard.
It might be an issue with the license, I'd suggest you contact customercare@sophos.com

Christian

Hi YuzenChen 

The license should not be the issue here. Have you installed SEC on a server or a client machine?

Haridoss S

Hi Haridoss S 

SEC is installed on a Windows 2008 Server. 

We experienced the same issue. Editing of EP policies stopped working suddenly without any change on server side.

Sophos Support said it is a known issue and suggested to alter the database. This change solved the problem.

USE [SOPHOS550]

GO

ALTER TABLE [dbo].[HMPA_AppList] DROP CONSTRAINT [UQ_HMPA_AppList_NormalizedPaths]

GO

We experienced the same issue. Editing of EP policies stopped working suddenly without any change on server side.

Sophos Support said it is a known issue and suggested to alter the database. This change solved the problem.

USE [SOPHOS550]

GO

ALTER TABLE [dbo].[HMPA_AppList] DROP CONSTRAINT [UQ_HMPA_AppList_NormalizedPaths]

GO

Hi Holger , 

Is the solution that can fix this issue. 

Thanks reply .

Dear Holger,

 I had the same problem i did run the query to alter table 

Now

The Pop up message comes up but in settings both Protection Settings and Exclusions are identical.

Please help.

Also once clicked on Exclusion it freezes.

Hi - Did you resolve this issue?

Edit: I contacted support and they confirmed to run the query. Issue resolved after doing so (exclusion tab works as well).

Silly question but how do you enter these commands listed to resolve this as we're having exactly this issue.

Thanks

You need to run them from SQL Server Management Studio as a query. You can download from Microsoft if you don't have it installed.

docs.microsoft.com/.../download-sql-server-management-studio-ssms

Hello Brian Chivers,

command line is sufficient. On the (SQL) server from a command prompt sqlcmd -E -S .\SOPHOS -d SOPHOS550 -q "ALTER TABLE [dbo].[HMPA_AppList] DROP CONSTRAINT [UQ_HMPA_AppList_NormalizedPaths]"

Christian