This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Device Control stops working with USB devices - intermittently

We keep having issues with Sophos Central & Device Control. Sophos Enterprise Console 5.5.1.

We have set up a Sophos Safeguard Policy to encrypt removable media, but every now & then the device control events do not show up in Sophos Central on the Enterprise Console.

We have tried restarting the services (which are all running okay) & even restarting the SQL local DB services, with some varying degrees of success. A full reboot of the server is often necessary.

Has anyone had any experience/expertise with this?

 

Many thanks, 

Niki



This thread was automatically locked due to age.
Parents
  • Hi Niki Sparks,

    I have a few questions for you: 

    Can you kindly clarify if you are using Sophos Central or Sophos Enterprise console ? What is your exact setup for this Server? 
    Are you receiving any errors when the issue occurs, or what happens exactly? Are the devices detected by the OS at all? 

    Is this affecting multiple systems or just the one? If you have any systems that are not affected, could you please compare the policies between them for any discrepancies?
    Also, have you tried different USB devices to test if this is not hardware related? 

    Thanks!

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • Hi Barb

    we are using Sophos Enterprise console 5.5.1.

    Exact setup? runs on a Windows 2008 Server R2 64-bit VM with 2vCPU & 12GB RAM.

    No errors, we just cannot see the devices in the 'Device Control Events' window, whatever search criteria we select they do not show up.

    Devices are detected on Users systems & are blocked as expected, but we can not add any exception as the server does not see/report the devices that Sophos is blocking.

    When this occurs it effects all users USB devices, i.e. no devices are reported by the interface. So does not differ by policies.

    We have previously restarted all the Sophos services & have also tried restarting the SQL Server services, a complete reboot 'sometimes' fixes this, several reboots have been required before as we do not have any alternative approach to fix this.

     

     

     

  • Hello Niki Sparks,

    Sophos Enterprise console has a dedicated forum, please join this group so that this thread can be moved.

    In your policies you are blocking Removable Storage? Whenever a device is blocked an event should be sent to the management server, Device Control errors are reported as Scanning Errors. when this occurs - is when at certain times, or for specific endpoints (computers)? You know that devices are blocked because users tell you so but there is no corresponding event? Do they endpoints otherwise report their status (they show as connected and up to date) and send messages (e.g. turning off scanning or Device Control is instantly reflected in the console)? Does the Device Control log on the endpoints show the interventions?

    Christian

Reply
  • Hello Niki Sparks,

    Sophos Enterprise console has a dedicated forum, please join this group so that this thread can be moved.

    In your policies you are blocking Removable Storage? Whenever a device is blocked an event should be sent to the management server, Device Control errors are reported as Scanning Errors. when this occurs - is when at certain times, or for specific endpoints (computers)? You know that devices are blocked because users tell you so but there is no corresponding event? Do they endpoints otherwise report their status (they show as connected and up to date) and send messages (e.g. turning off scanning or Device Control is instantly reflected in the console)? Does the Device Control log on the endpoints show the interventions?

    Christian

Children
No Data