Sophos Central Endpoint and SEC: Computers fail/hang on boot after the Microsoft Windows April 9, 2019 update. Please follow knowledge base article 133945

Learn about the Benefits of Multi-Factor Authentication (MFA). Turn your MFA on now!

Sophos Web Intelligence Service - missing (service disabled)

We have a problem with Central client: Sophos Web Intelligence Service is reported as missing.

If I check in services I can see that service is disabled and cannot be started.

I already did unistall, reboot, fresh install (its all OK for few minutes)

We have several other computers that are working OK

 

Thank you!

  • Hello KingRolo ,

    Please try these steps (Ensure Tamper protection is disabled, and that you are using an Admin account):

    A Service is reported as Stopped and Startup Type is Disabled

    If that doesn't help, follow the section for A Service is reported as Missing

    Please let us know the outcome.


    Regards,

  • In reply to Barb@Sophos:

    Hello!

    First I had to change  registry value for swi_service:

    Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swi_service

    Start value from 4 to 2

     

    Then I had to re-register service with CMD command: 

    "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe" /registerService
    "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe" /update

     

    Service then started and Sophos Health reported all services green, while in Central its still reporting:

     Missing: Sophos Web Intelligence Service

     

    Regards,

    Miha Kralj

  • In reply to KingRolo:

    Hello KingRolo,


    If all is green, but there are discrepancies between what's going on and what is central seeing, I suggest to try these steps:

        Disable the Tamper Protection (if enabled).
        Go to services.msc and stop the Sophos Health Service.
        Browse to the following folder:

        C:\ProgramData\Sophos\Health\Event Store\Database

        Rename events.db to events.orig.
        Restart the Sophos Health Service.
        Open the Task Manager and end the Sophos UI.exe process.
        Launch a new Sophos UI.exe process from:

        C:\Program Files\Sophos\Sophos UI.exe

    Re-enable Tamper Protection.

    Please let me know the outcome.

    Regards,

  • In reply to Barb@Sophos:

    Hello!

    We are facing issues with Sophos Web Intelligence service - somehowe service is disabled on some users. 

    We can get it working on computer (all green) with described procedure, but still Sophos Central is showing that service is missing.

     

      

    We tried your procedure and restarted few times, but no success. 

    Endpoint is updated and is using latest version:

      

    Regards