Endpoint Isolated how to un-isolate or open Anydesk for RDP connection.

Hi Werner Smit ,

Thank you for reaching out to our Sophos Community Forum.

Werner Smit said:

We've had some instances where either Sophos protection service or Network protection service might not start up. 

Does this happen at the system startup? Is it only affecting specific devices, or does it happen randomly? What's the core agent version running on these devices?

Have you also had a chance to check the Event logs? Did you see any error?

Devices will auto-isolate when they receive a red health status if the "Device Isolation" feature within your Threat Protection policy is enabled.

Computers isolated by administrators can be managed under Global Settings > Admin Isolated Computers. But computers that have isolated themselves due to red health status won't be displayed here.

Hi Werner Smit ,

Thank you for reaching out to our Sophos Community Forum.

Werner Smit said:

We've had some instances where either Sophos protection service or Network protection service might not start up. 

Does this happen at the system startup? Is it only affecting specific devices, or does it happen randomly? What's the core agent version running on these devices?

Have you also had a chance to check the Event logs? Did you see any error?

Devices will auto-isolate when they receive a red health status if the "Device Isolation" feature within your Threat Protection policy is enabled.

Computers isolated by administrators can be managed under Global Settings > Admin Isolated Computers. But computers that have isolated themselves due to red health status won't be displayed here.

Hi Gladys ,

This doesn't happen usually at startup but sometimes at random intervals and the service suddenly stop. This causes Sophos to Isolate the device and require restart to resolve the issue since we don't have remote connection to the device to use our admin password to start the service. 


With regards to the Global Settings > Admin Isolated Computers. Doesn't seem to have that option and I have full access also part of the Administrators group.

Secondly, how can I allow Anydesk to connect while the computer is Isolated?

Hi Werner Smit ,

It's possible that there's a recent update that might have triggered a soft reboot on the components causing a red health status on the devices. To investigate this further, I suggest collecting the SDU logs and opening a support case through our Support Portal. If immediate assistance is needed, you may also contact support via phone, you'll find the hotline numbers in this page - Contact Us.

Regarding your inquiry about Anydesk, I found this reference which might help - https://support.anydesk.com/knowledge/on-premises. However, there are still limitations to this.

Hi Werner Smit ,

After looking into this further, I found that you may also create exclusions for device isolation. This would allow your remote access tools to still be accessible while the device is isolated. You can configure this from the Global Exclusions. I'll also link the article below for your reference.

Device isolation exclusions

Hi Gladys 

Thank you this was helpful. 

Another question found this article https://support.sophos.com/support/s/article/KB-000033289?language=en_US to test out detection features. 

Do you have other testes that we can perform to test isolation on the computer to make sure the anydesk is able to connect while being isolated?

You can simulate an isolation event by turning off tamper protection to stop/disable one of Sophos' services. I was able to do this by disabling the "Sophos File Scanner Service"

Thanks got it working tried last time think I was too fast for Sophos to Isolate Qoosh