Possible Memory Problem after Windows 10 1903 Update



Currently have Sophos Central with Sophos Endpoint running on several machines here, i was the first to update to the latest Windows 10 1903 Update and noticed after the machine sitting idle for a while that the above service is consuming a lot of RAM.


Any solutions to this?

  • In reply to Scott Wichall:


    Have you installed the Patch, I've had the patch running for 2 days now and my SSPService.exe is hovering around the 242Mb mark.


  • In reply to Norm Almond:

    Hey Norm


    I am guessing I had better raise a ticket to get my sticky hands on the patch :-)



  • In reply to Scott Wichall:

    Yes, it took me about 3 days to get a link once I raised the ticket. I would suggest including a link to this thread as support didn't have a clue about it Wink

  • In reply to Norm Almond:

    Ticket raised with a link to this thread, cheers Norm :-)

  • Sophos released a new version but it will be gradually available for the users.

    Please see the release note:

    Note You may find that you cannot yet download and use the latest version. This is because Sophos releases the software over a number of days, but publishes the release notes on the first day.



  • In reply to Unal Erkaslan:

    We've got a monitor in our RMM that when RAM exceeds 85% it will offer to reboot the computer and will reboot by default if user doesn't cancel in 90 seconds. Still running this as we have yet to see the update to core 2.4.0. I wish there was a way to force an update to occur on a Sophos Central tenant.

  • In reply to Lowell Picklyk:

    If you contact support they might be able to request your updating creds get into an earlier deployment group.  



  • Hi all,


    Contacted Sophos support to see how I could get the Core Agent 2.4.0. To quote "the fix will be on core agent 2.4.0 which is going out and completing on July 9, 2019 UK time". So should get to everyone by July 9. In the mean time, I was provided the following hotfix and instructions:

    1. Disable Tamper Protection 
    2. Download https://www.sophos.com/en-us/support/downloads/eula.aspx?downloadKey=c6594270-c690-418f-8b1b-e21e21433e4a 
    3. Extract sspservice_winep-20001.zip 
    4. Open Services.msc and stop the "Sophos System Protecton Service" 
    5. In file explorer navigate to <C:\Program Files\Sophos\Endpoint Defense\> 
    6. From the extracted sspservice_winep-20001.zip copy and replace the existing SSPService.exe
         32bit - sspservice_winep-20001\32-bit\SSPService.exe
         64bit - sspservice_winep-20001\64-bit\SSPService.exe 
    7. Open Services.msc and start the "Sophos System Protecton Service" 

    I found it easier to just kill SSPService.exe from task manager. Stopping the service didn't seem to stop the running instance of SSPService.exe anyway.

  • In reply to Vikas:

    We have 4 - 5 desktops with Win 10 1903 experiencing this issue. Raised ticket with Sophos and provided logs. Awaiting update.

    Meanwhile users rebooting their desktops everyday morning. This does not look good.

  • In reply to Tom Wardrop1:


    I decided to wait for the release 2.4.0 of the Core Agent and tried to update our clients machines today.


    We still don't get the update, as you can see in the screenshot, we stay on Core Agent 2.2.3, so what is going wrong here?

    Regards from Germany,

    Philipp Rusch

  • In reply to jprusch:

    I am on 1903, with core agent 2.4.0 and still having memory issues.