Some Sophos services are not running/missing

I have at least 20% of the computers on my network now reporting "Some Sophos services are not running/missing"

This was not the case 2 weeks ago, and invariably it is "Sophos System Protection Service is not started".

This involves a visit to that computer, pushing the user out of the way, running "Services" as administrator, which then involves typing the admin password under a user's nose.

I am sure this is not how Sophos Central is meant to work. It is highly inconvenient, and at worst liable for a security breach.

How do I start these services remotely ?

I could log in through Remote Desktop, but this would Log Out the User

  • In reply to Howiedog:

    Their next product line should be called: Sophos - Titanic.

  • In reply to Trojan Horse:

    Hindenburg edition?

  • We are seeing this across our estate also, with a variety of services not running or missing. Does anyone have any fix beyond using Computer Management remotely to restart the services? I find it hard to believe that Sophos has not addressed this fully and not provided some kind of patch / hot fix. Thanks in advance!

  • For the bashing Sophos has received, mine included, I need to give kudos too.  In the past few months, I have seen a lot of these issues fixed, as they have made improvements and changes to the product. 

    This morning, I received an email alert that one of my client's servers has services missing or stopped.  I logged into Central and verified that there were 2 services not running. By the time I had started a ticket in my PSA, I saw that the status of all services went green. Then the alert went away and the device was in good status again. I never had a chance to finish my ticket, much less connect to the server to work on the issue.

    I suspect that the Sophos agent updated and as it restarted the services the alert was flagged.   Sophos needs to increase the time-out settings by maybe another minute, but overall I was impressed that the software did was it was supposed to do.  It updated, restarted the services, and went on its way. 

  • In reply to JamesGolden:

    Its definitely been better... however, there Encryption service not running problem is going on 2 months now. Should have been fixed by now. 

  • In reply to LRB:

    can you elaborate? I've only ever had a problem with 2 machines--one was a bitlocker problem and the other because I forgot to enable the encryption policy.

  • In reply to JamesGolden:

    We are seeing a number of services go missing (a couple of which may or may not re-appear a few days later), yet the client appears to be up to date. The main offenders appear to be: 

    Missing: Sophos Device Encryption Service

    Missing: Sophos Device Control Service

    Missing: Sophos Web Control Service

    Missing: Sophos Web Intelligence Service

    Missing: Sophos Anti-Virus Status Reporter

  • In reply to JamesGolden:

    Hi James,

    This specific issue:

    They note its being fixed - the problem I have is the general lack of communication and how long it takes to fix. 

  • In reply to Mike Jones1:

    This was very helpful.  Ran the C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sau\Sophos AutoUpdate 

    The problem was resolved!!! 




    Royce Robinson | Texas A&M Univ. Wildlife Fisheries

  • In reply to Royce Robinson:

    Hello Royce,


    Was the issue occurring on multiple endpoints? Like 100s?

  • In reply to G33k:

    It was only on ONE computer.   Even after uninstall / reinstall, the problem remained until I used your suggestion.  Working well now. 


  • In reply to Royce Robinson:

    Ok! We have 1000s of endpoints on which we are facing the issue. I'll try and check if that works at my end too!!

  • In reply to G33k:

    I have just had an issue, my own system, where I got an email stating that a HIGH ALERT, that services were missing or not running, but there is nothing in Central about this error... wow.

    email sent @ 11:52, checked Central @ 12:45, still no Alerts (on anything).


  • In reply to Argo:

    I've been reporting this for a few months.  What Sophos support told me to do was to set the services to START DELAYED

  • In reply to Royce Robinson:

    which service(s)? all or just some?