Most Clients Shown As 'Disconnected' in SEC 5.5.0

Hi folks,

We are running Sophos Enterprise Console (SEC) 5.5.0 on a Windows 2008 R2 Enterprise (64-bit) Server.

I have recently noticed that more than 50% of our client PCs to which Sophos Endpoint Security & Control has been deployed are shown as 'disconnected' in SEC. I have carried out a ping-sweep of the network and can confirm that most, if not all, of these PCs are actually powered on, connected to the network and working fine.

Only after I restart the Sophos Message Router Service on the client PCs do they then change their status to 'connected' in SEC. I have no wish to carry this task out on several hundred client PCs individually as you can imagine, so I'm hoping someone can possibly shed some light on what may be happening here and suggest a solution to this issue?

Many thanks,

John P

  • In reply to WorEen:

    I thought that this issue is related to CORBA as it was mentioned here and not DNS. The fact is that RMS was upgraded and the only workable workaround is to run scheduled powershell script that restarts rms service every morning on all clients because only restarted or shutdown/power on machines are affected.


    Regards, Rok

  • In reply to Rok:



    We are experiencing same problems, so I assume it is on going problem. What is the latest response from Sophos?




  • In reply to Edin:

    We have the same problem. Is there any update Sophos?

  • In reply to IT or not to IT:

    Hi IT or not to IT & everyone, 

    The reported issue is actively being investigated internally by our team. I will periodically keep this thread updated with further developments. If we have any new user's facing the same issue, Please do PM me the reference case numbers so that I can have it tagged to the reported issue.

  • In reply to Gowtham Mani:

    Hello Everyone,


    Is there any luck for this issue, we are also getting a huge list as Disconnected in SEC 5.5.0.

    Looking forward to have best solution for this issue to rectify bundles of issues.


    Best Regards

    Faisal Raza

  • In reply to Faisal Raza1:

    Hi Faisal Raza1,

    The fix is tentatively expected to be out by next quarter. Once I have the confirmed update on the fix roll out timeline I will keep you all posted.

  • In reply to Gowtham Mani:

    Hello Faisal,

    I've split off your any updates? post as it is mainly about something different.
    The answer is rather obvious - no updates or news. Gowtham Mani said less than a week ago: tentatively expected to be out by next quarter - this is definitely not in the next few days. There are no out-of-band fixes for issues like this one so it has to be a version release. If I had to guess: The version release dates foretell Preview 1.8.2 in July and for both Preview and Recommended - it could be this one.


  • In reply to Faisal Raza1:

    Hi Everyone,

    Apologies for any confusion, Sorry that I wasn't specific on the fix that I mentioned earlier. The fix that I mentioned is for the IOR Response giving loopback address which was causing communication issues and we are working on it.

  • In reply to Gowtham Mani:

    We've been dealing with this issue as well.  I just rebooted the AV server which reminded me of this issue and I started to look into it and seen this post.  Is there an update or fix out yet?




  • In reply to ruckus:

    ruckus, I don't think this is the correct answer although it's on the right track.  I've been having this issue and recently changed the the Sophos Update Manager as well as the Sophos Message Router services to delayed start.  I don't recall at this point as to whether one of both of these fixed the issue, but the servers been restarted several times and I no longer have issues with disconnected clients showing up in the console nor do I show the update server not being updated.


    I seen where a Sophos staff person added to this thread where there was a fix coming out later this year, but there's no update since then.



  • In reply to Frapster:

    Hello Frapster,

    no update since then
    indeed it looks like - RMS' version ( hasn't changed for a long time and I assume any change would have resulted in an updated version number.
    SUM doesn't talk to the endpoints and the logs indicate that the problem is with the Message Router so it's the delayed start of the latter that makes the difference.


  • In reply to QC:

    Hi All,


    Just a quick question, Can I install SEC 5.5.1 in my local PC since in Server its 5.5.0 is running. If yes, then can use the same license key of 550 in 551?




  • In reply to Faisal Raza1:

    Hello Faisal,

    first of all, no key is required for installation (license details are just used to configure downloads in SUM).

    Are you talking about a Remote Console? If so, server and remote consoles must have the same version.
    If you're talking about installing a "test server" on the PC - full installations are independent.