Office 2010 Activation lost with Sophos Endpoint installed

Hi benny4982,

I would like to know what does "Time after time the office activation get's lost on different endpoints" mean, Are there any Sophos detection that deletes files or Any process that is being blocked by Sophos AV? Can you please brief on this it would help us in understanding the issue and assist you accordingly.  

Hi Mani,

so for example on Monday all 100 Endpoints activated and running fine.
On Wednesday suddenly 2 Endpoints lost their activation and cannot activate again until we uninstall Sophos.
After activation of office we reinstall Sophos on both Endpoints.The day after 1 of 2 runs fine the other lost the activation again.
So we removed Sophos again and activated Windows Defender. Until now everything works fine on that endpoint.
One week later we get calls from 3 different users, that their office activation is lost, so we do the same procedure there.

In central we can not see any issues (blocked files, detected exploits, etc.)

Hope this helps to understand the problem

BR

Benjamin

Hi benny4982,

When you state that they cannot activate...What happens exactly? Do they error out randomly? What steps are being followed to activate Office? And what is the outcome while Sophos is running? 

There may be something in the sav logs (it depends on how is this activating). Can you upload a C:\ProgramData\Sophos\Sophos Anti-Virus\logs\sav.txt log from one of the affected systems?
Also, please check the event viewer for 911 events and post them here as well. 
For the affected users: are there any policies in place that are not base policy? .

Can you confirm that if you re-install Sophos on a system that was previously unable to activate Office, the issue persists? And, can you confirm that the systems without Sophos have not presented any issues with their office activation ?

Regards,

Hi Barb,

i try to get the logs and check if there are any kind of differences in the policys.

What happens:

You get the error message on any office program, that the license could not be validated. (See Screenshot)

And if you uninstall Sophos Endpoint with a reboot after uninstall, you can just open any office application and it activates correctly without any message or warning.
Yesterday we had an endpoint where we reinstalled endpoint protection. A day later same activation issue.
Until now we had not seen any errors on an unprotected endpoint.

BR

Benny

Hi benny4982,

Can you again attach the screenshot of the error message?

OK, today we verified the behavior.
Uninstalled Sophos last Friday, no activation issues until today.
Installed endpoint today, rebooted and Office activation is lost and can not be done again.

Sav.log:

20180801 085742            Die Erkennungsdatenversion 5.53 (Detection Engine 3.72.1) wird verwendet. Diese Version kann 23144653 Objekte erkennen.
20180801 085742            Benutzer (NT-AUTORITÄT\Lokaler Dienst) hat den On-Access-Scan auf diesem Computer gestartet.
20180801 085835            Das automatische Versenden von Datei-Samples für Sophos Live-Schutz ist aktiviert.
20180801 100011            Die Erkennungsdatenversion 5.53 (Detection Engine 3.72.1) wird verwendet. Diese Version kann 23144653 Objekte erkennen.
20180801 100012            Benutzer (NT-AUTORITÄT\Lokaler Dienst) hat den On-Access-Scan auf diesem Computer gestartet.
20180801 100058            Bei der Überprüfung des Verhaltens des Prozesses "\\?\globalroot\Device\HarddiskVolume1\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" wurde ein Fehler erkannt.
20180801 101530            Bei der Überprüfung des Verhaltens des Prozesses "\\?\globalroot\Device\HarddiskVolume1\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" wurde ein Fehler erkannt.

There are no 911 Events in System or Application Log.

---

After that we created a complete new policy for "Endpoint Protection: Threat Protection (device)" and disabled the following:

- Deep Learning off

and

uninstalled endpoint, reboot, do the office activation and install with the new policy in place.

so far office has no activation issues. we give it a try for the next few days. after we enable all features and see whats happening.
The Mainpolicy has "Use recommended settings" on.

Hi benny4982,

Thank you for the update. If you can confirm that the issue returns as soon as you enable Sophos components, please file a case with support so that they can further investigate. 
Be sure to include details regarding office version, the actual issue, as well as the SDU logs 

Please let us know how it goes.

Regards,

Same behaviour here. Office 2010 (Spanish) + Windows 10 1709.

Office randomly is unable to activate when InterceptX is active.

Hello Juan Francisco Arrabe ,

Please provide the ticket number after following my previous instructions, so that we can review it.

Thank you!