"We're checking that this computer is now safe"

Hi Kirk Lewis,

Are you seeing any Events on the endpoint/Central  related to isolation?
Can you provide a screenshot of the "We're checking..." message, as well as the Events ?

If yes to the above, I recommend that you  file a case with Support including a copy of the  SDU logs, as well as the screenshots so that they can further investigate.

Regards,

Currently looking into the SDU logs option for sophos. I have been curious to know if anyone else out there has encountered this and what it might mean. 

It seems to me as a bit of a catch all.

C:\Program Files\Sophos\Sophos UI\en-us.json

Has it down as the internal names:

"status.health.title.generic-red": "We're checking that this computer is now safe",
"status.health.title.generic-yellow": "We're checking that this computer is now safe",

I see you have it as yellow.  I had it once as Red due to a failed cleanup event.  Hitting the resolve link in the Events list solved it for me.

I can only suggest looking down the list of Events for warnings and see if you find any which aren't resolved.

Thanks,

Jak

nice Thnxee

Hi Kirk Lewis,

Just a quick follow up on this thread, do you still see the alert in the client?

It could mean that the Json file in clean has been cleared but the alert in the centre might have not been acknowledged. Can you check if there are any pending alerts in central for this specific client?

After reviewing the "yellow triangle" medium events, I show two from 2/10/18. The thing is, this system has since received numerous updates and been restarted for those to be applied. I've attached the pictures to show this. This system is showing "all green" in Central console and in Sophos Endpoint Self Help. There isn't an option to click on the event for any further options. Maybe have to reinstall protection to reset this?

That's interesting, those 2 components no longer exist as their own component. 

TBH I would suggest just disabling tamper protection.  Stopping the Health service, rename C:\ProgramData\Sophos\Health\Event Store\Database\events.db and starting the Health service.

Regards,
Jak

Thank you! This helped to clear the message, as it appears it somehow never updated correctly all those months.