I ended up looking at a particular machine today during an unrelated incident because I noticed it was missing some Sophos services. Turns out the File Scanner service was no longer running. Before attempting to fix that I looked through the events to see when it happened and I noticed that services have previously been missing and I guess restored?
I attempted to restart the service through WMIC and wasn't able to. Digging a bit deeper I found that the File Scanner Service had been removed, which is why I couldn't restart it.
I'm curious as to what's going on behind the scenes: users don't have the necessary permissions to disable or remove this service (or, quite frankly, the technical knowledge), but beyond that I'm curious as to how the service was reinstalled before it was removed again.
As for fixing it, I've found that it's simply faster to uninstall and reinstall Sophos EP than trouble shoot. Especially since (from my experience) that's the end result of 90% of trouble shooting sessions.
Thoughts?
This thread was automatically locked due to age.