Hi. I am running a clean install of windows 10 Pro 1709 and a fresh corporate installation of Sophos Endpoint Security and Control.
I have stumbled upon a possible bug with the tray icon application. It appears that if I turn on the "HKLM\SOFTWARE\Policies\Microsoft\Windows\System\AllowBlockingAppsAtShutdown" registry key, then ALMon.exe prevents windows from shutting down.
When the user initiates a shutdown or restart, they are presented with a standard timeout window indicating that an application is failing to close with a title of "DDE Server Window". After 10 seconds or so the user is presented with the option to "End now" and close the window. From this point the computer shuts down or reboots as normal.
If I disable try icon via "Task Manager -> Startup -> Sophos Endpoint Security and Control" then the computer shuts down normally. This is my current workaround as even with the tray application disabled, all of the supporting AV services appear to remain functional.
The "HKLM\SOFTWARE\Policies\Microsoft\Windows\System\AllowBlockingAppsAtShutdown" key is required by an application we use to perform tasks on shutdown.
Please note: This occurs on a clean installation of windows 10.
Problem appears to be relating to the ALMon.exe
The version of the ALMon.exe file that we are running is: 5.7.220.220
This thread was automatically locked due to age.
