SAV service hangs after installing KB4493472

Hi Everyone, 

The reported issue is currently being investigated.

If you have not yet performed the update we recommend not doing so. If you have performed the update but not yet rebooted we recommend removing the update prior to rebooting.

If you have performed the update and have rebooted, triggering the issue:

1. Boot into safe mode
2. Disable the Sophos Anti-Virus service
3. Boot into normal mode
4. Uninstall the Windows KB
5. Enable the Sophos Anti-Virus service
   • If enabled, Tamper Protection will need to be disabled to re-enable the service 

Please follow the below KBA for more updates and workaround.

Sophos Central Endpoint and SEC: Computers fail/hang on boot after the Microsoft Windows April 9, 2019 update

Hi Everyone, 

The reported issue is currently being investigated.

If you have not yet performed the update we recommend not doing so. If you have performed the update but not yet rebooted we recommend removing the update prior to rebooting.

If you have performed the update and have rebooted, triggering the issue:

1. Boot into safe mode
2. Disable the Sophos Anti-Virus service
3. Boot into normal mode
4. Uninstall the Windows KB
5. Enable the Sophos Anti-Virus service
   • If enabled, Tamper Protection will need to be disabled to re-enable the service 

Please follow the below KBA for more updates and workaround.

Sophos Central Endpoint and SEC: Computers fail/hang on boot after the Microsoft Windows April 9, 2019 update

Which services is problematic? When we disable all sophos services it's work but when we reactivated it's stop working.

The first error log I saw after the patch installation is "The Sophos Anti-Virus service hung on starting." 10 minutes later "The Network Store Interface Service service"

10 minutes after that;

"The DHCP Client service depends on the Network Store Interface Service service which failed to start because of the following error:
After starting, the service hung in a start-pending state."

"The DNS Client service depends on the Network Store Interface Service service which failed to start because of the following error:
After starting, the service hung in a start-pending state."

"The Task Scheduler service hung on starting."

1 hour after the first error;

"The Windows Font Cache Service service hung on starting."

After these, lots of other network related services log errors like "time out", "failed to start".

Hi Everyone, 

[UPDATE]: Microsoft has blocked the affected updates from being applied to machines where the Sophos Endpoint is installed.
Further information available in https://community.sophos.com/kb/en-us/133945

Sophos Support seem to be replying with a default answer of "check the KB article".

The KB Article has not been updated since 08:45. Can we have some sort of update please?

the only update at this stage is the one above yours. Microsoft will now block the affected update from installing on your machine if you have Sophos installed. There is no new news uunfortunately that I know of. However I don't know how Microsoft is blocking it, if you are using a WSUS server, maybe you need an update. In any case, I'd just avoid applying the affected update for now until they start communicating again

Thanks Pez but that update doesn't help much when we have hundreds of machines on remote sites that picked up the update before that change was applied by Microsoft, and before we blocked the update in WSUS.

The silence from Sophos is deafening at the moment.

Hello Papadug,

silence from Sophos is deafening
well, what should they say - or what else should they do? Apparently they have worked on the issue and provided sufficient evidence so that Microsoft not only acknowledges the problem in their articles but also to block the patch. It's rumored that other vendors are affected as well.
Please also note that it does not affect all machines (even with Sophos installed) and the impact varies - from boot problems to just "erratic" behaviour of SAV/SESC: On a machine that is otherwise working normally as far as I can tell the (re-)start if the SAVService.exe during an update takes about 20 minutes resulting not only in the failed to connect to the on-access driver but also install errors. Appears to be rather complex ...

Christian

Hi QC,

They could give us updates on what they are doing, how far along they are with a fix (if there is one imminent), just basically keep us up to date on whats going on. Its not helping when even Support are telling us to check the KB article which hasn't been updated since 08:45.

I don't doubt that they're working on the issue alongside Microsoft but keep us as customers in the loop. Its just frustrating when we have management looking for an update from Sophos and we have literally nothing new to give them since first thing this morning.

As for other problems, I've noticed that its not affecting all machines...and at the same have seen an increase in the number of errors in Enterprise Console, including the failed to connect to the on-access driver error that you mentioned. Thank you for confirming that this might be related.

Hello Papadug,

first of all, the failed to connect errors persist until you acknowledge them, please check the timestamps. I see machines that are up-to-date, on-access (and other features depending on savservice) active, and the last error from hours ago - thus apparently healthy.

give us updates
did you ever work on an emergency fix? Last thing you need is a manager who requests a status update every half an hour or someone from PR asking you for an ETA [;)]
Seriously, can't imagine what could be said at this point - we're right now investigating this dependency or that ... we're analyzing the 6.3 GB of trace data produced in the past hour ... or ? Takes probably some time to analyze the problem and then one can give an ETA and a progress report.

Christian 

Hello Papadug,

meanwhile the article has been updated. Not what you'd expect though and a little bit cryptic.

Christian