The security health cannot be reported at the moment

Hi, 

Same problem for a Central customer: more than 700 endpoints in the console and around 20 report this issue. All is OK on the GUI diag.

Hi rksop 

Unfortunately, You need to follow the steps mentioned by Gowtham, please check the client status from Sophos Endpoint > About(Right bottom Corner) > Run Diagnostic Tool.

You should be able to check the different Tabs (Health State, System, Services, etc.) from there; see which one is showing red (needs attention). Depending on the error, you can go for the different KB articles to resolve the issue.

I'd request you to open a new thread if you are not able to find out the solution.

Can I not click on the DIAGNOSE button in the Sophos Central Admin Console instead of going on the PC ?   Remote access is very difficult to get on my clients PCs.  Surely the idea of the central console is to fully diagnose and manage Sophos software remotely ?

I now have 20 PCs with the 'The security health cannot be reported at the moment' error showing in console, but when I check services remotely the Sophos Health Service is running.

These are all Windows 10 PCs - other PCs on Windows 7 are not showing this error. 

Surely I don't have to connect to all these machines remotely to diagnose and possibly re-install Sophos ?

Hi Steve Baldry 

Yes, you can run the Sophos Diagnose utility from Sophos Central, please refer to this article. Once we have the logs, we can check under health.log to see if there are any errors or the event logs to identify if there are any other issues. 

Hi Shweta,

Thanks for that - i've run the diagnostics on a few of the Computers that are showing the 'The Security Health Cannot be reported at the moment'

Here is the file for one of them:  770a4483-6a56-44ff-dacb-9f617b3016fb_2020-01-24-16-14-57.zip

If you could point me in the right direction to fixing this, then hopefully it will be the same / similar fix with all the other computers.

Thanks

Steve

Hi Shweta,

Thanks for that - i've run the diagnostics on a few of the Computers that are showing the 'The Security Health Cannot be reported at the moment'

Here is the file for one of them:  770a4483-6a56-44ff-dacb-9f617b3016fb_2020-01-24-16-14-57.zip

If you could point me in the right direction to fixing this, then hopefully it will be the same / similar fix with all the other computers.

Thanks

Steve

Hi Steve Baldry 

Sure, Let me have a look and see if I am able to access the logs and shall share you the output. 

Hello Steve Baldry 

Since you said that this appears to only happen to your Windows 10 boxes: Is Fast Boot enabled in the BIOS? If so, please try disabling this and re-testing. Depending on the hardware manufacturer, this may also be referred to as Quick Boot, Rapid Boot, Fast Startup, Rapid Startup, or similar.

There are no specific errors in the logs that you have sent. I did a search for what was a rather persistent message in the Sophos Health log file and this workaround has come up:

1. Disable tamper protection

2.  Stop the MCS Agent Service on the Endpoint

3. Run commands below in an Admin CMD Prompt:
   Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Persist\Credentials" /q
   Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Persist\EndpointIdentity.txt" /q
   Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Persist\*.xml" /q
   Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Cache\*.status" /q
   Del "%ProgramData%\Sophos\AutoUpdate\data\machine_ID.txt" /q

4. Reboot the computer

   After the Endpoint comes back up, the removed files should be recreated on the Endpoint. Give it about 2 minutes to send updates to Sophos Central, and check if the status still shows the Health Status issue.

Can you try that on one of the machines to see if that gets the health to appear correctly in Sophos Central?

If that does not resolve, I would advise to raise a support case for further review, with the following information, at the very least:

• SDU Logs: Run SDU from the Endpoint OR Run SDU from Sophos Central (you can include the file name you have sent earlier to your request)
• Enable Remote Assistance

You can either DM or post the Support Ticket number you receive so we can monitor the case and post updates in this community post.

Thanks!

Hi Steve Baldry 

I am unable to find any specific errors under the logs sent by you. I would recommend you to follow the steps as suggested by DianneY and see how it goes.