This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos System Protection Service not running on multiple machines across multiple customers

I've got a few machines, across several customers, that are reporting the System Protection Service is not running. It seems rather odd that I've got the same problem, all starting today, on different machines and networks.

Is anyone else seeing this?

This thread was automatically locked due to age.

0 jak over 6 years ago

Is this just a reporting anomaly or at the endpoint, the service is genuinely stopped? Can it be started or is there an error?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Ashton Momot over 6 years ago

I am seeing this as well. Actually, today we had a large group of our sales staff all kicked off the network because this service didn't start and Heartbeat dropped their connection.

I see this on my computer every time I boot up, and have an automation policy to start the service. I get an email every time I restart or boot up. Manually starting the service works (it's one of the few services I've had luck with manually starting)
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 6 years ago in reply to Ashton Momot

Are you able to install the new EAP version https://cloud.sophos.com/manage/eap - "Intercept X New Features" on a computer that regularly suffers the issue? The reason I ask is that it appears to be very different in version 2. Maybe once it is installed, if you restart it a couple of times does it start without issue?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Ashton Momot over 6 years ago in reply to jak

Thanks for the reply Jak. At least for us, we literally just moved internal machines off of EAP to address concerns around the latest vulnerabilities. It was my understanding the EAP is done in a few weeks as well so we wanted to slowly move off to allow time to address any issues.
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 6 years ago in reply to Ashton Momot

Hi,

Are you saying that you had issues with the SSP service "reliably" not starting (event log showing a timeout) on computers at startup that were running the EAP version?

There was a "bug"/"change needed to be made" with the EAP version after applying the last round of MS patches as per:

https://community.sophos.com/products/intercept/early-access-preview/f/intercept-x-for-windows/99364/meltdown-and-spectre-the-chip-bugs-and-intercept-x-early-access-program/360994#360994

This is a different issue to timing out a startup though.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Ashton Momot over 6 years ago in reply to jak

I am having issues on the GA version 11.5.11
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 6 years ago in reply to Ashton Momot

OK, It will be interesting to see what happens when the new endpoint version starts rolling out. I believe as early as next week but it will take a while for all accounts to be updated.

It will also be more informative in Central as of this weekend given the information here: https://community.sophos.com/kb/en-us/127758 regarding the state of services. Rather than just not running/missing it will say if they are missing or not running.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel