Issue: Sophos Central Admin – US-West region - Delays with the enforcement of Central policies on managed endpoints.

Why am I seeing the "One or more Sophos services are missing or not running" error message so often now?  I would really like a reason for this. 

Is this message accurate? and if so, why are these services 'missing or not running'? I've checked on occasion and services 'appear' to be running.

Lance, if you go into services on your Windows machine, you will probably find that the Sophos Antivirus service has disappeared (90% of this issue) - or that all the Sophos services have been set to disabled , but you can't set them to manual or automatic (you get a denied message) even if you are an admin on the box. You can't uninstall as tamper protection is enabled but you can't update the machines policy to disable tamper protection because it won't connect to the cloud to update the policies, which don't work all the well even when all the services are enabled and not missing

Lance, if you go into services on your Windows machine, you will probably find that the Sophos Antivirus service has disappeared (90% of this issue) - or that all the Sophos services have been set to disabled , but you can't set them to manual or automatic (you get a denied message) even if you are an admin on the box. You can't uninstall as tamper protection is enabled but you can't update the machines policy to disable tamper protection because it won't connect to the cloud to update the policies, which don't work all the well even when all the services are enabled and not missing

There is a published article for getting around tamper protection when the machine is offline. Safe mode, couple of registry changes, bam.

But I agree there's definitely pain when the client gets into a bad place and you can neither re-install or uninstall. We gave up working with support and re-imaged.

Also, just took 48 hours for an encryption policy to push to a few machines. We're now reviewing Symantec's end point products. Their end point product may not be great but we've found their support (we use other Symantec products) at least acknowledges when there is a problem. And their Senior Vice President doesn't promise a root cause analysis then never delivers.

Can't login to Central... anyone else?

Up for me.

Just a reminder for anyone still subscribed, it's been 3 months since Michael Anderson posted here stating they 'heard us' and will share the root cause analysis with everyone once they know it's been permanently fixed. After 3 times via email telling me it was mere days away from being posted, he is no longer replying to my emails.

We're evaluating Symantec now.

Sorry for not posting this here. RCA is located here: https://community.sophos.com/products/sophos-central/f/sophos-central/96889/rca-for-sophos-central-incident---late-july-early-august 

Why did this take until October 13th to be released when the issue was in first noted in July?

in the KB it was said: "We have conducted a detailed review of the incident and have created a plan to improve operations and prevent this kind of issue in the future." Can you detail out to us the plan to improve your operations and how you're going to prevent this kind of issue in the future?

Hi Trevor,

It might be more fruitful if you post this question directly to the thread: https://community.sophos.com/products/sophos-central/f/sophos-central/96889/rca-for-sophos-central-incident---late-july-early-august

This is supervised by the Central Product Manager and can lead to a faster response to your inquiry.

Thanks,
Karlos

Thank you Karlos, I'll post there as well. I'm sure the 124,440 (and counting) people who have viewed this posting would like to know the answer to that question as well.

Hi Karlos;

I have another item for you. I just loaded up an new Windows laptop with Sophos Endpoint. But now in the Cloud Console Central, when I choose to look at a Device, (any Device) it will momentarily go into the device page, but before its even finished loading, it drops me back out to ALL Computers.

This happens with ALL Devices now, so I cannot manage a single item.

Seriously?? And this is Prime Time Production ready?? I think NOT!

What n the hell is going on NOW??

I cannot Manage MY STUFF.

Hi Howiedog 

Which location are you from? We'd like to know whether issue affects all regions or just some. You can also DM me location if you'd like to maintain privacy. 

We are now currently doing some testing. I will update thread once I have updates.

Thanks for letting us know.

Best,

Karlos

West Coast, Canada