Not started: Sophos EDR Agent

Hello Chris Rodriguez 

Can you see if the following helps to get the EDR Agent to start:

1. Restart the Sophos System Protection Service on the endpoint
2. Force an update from Central. Does the EDR Agent start? If no, move to the next step
3. Restart MCS Agent and MCS Client services. 

If none of the above helps, please Raise a support case with the following information, at the very least:

• SDU Logs: Run SDU from the Endpoint OR Run SDU from Sophos Central 
• Enable Remote Assistance

From previous support tickets, it has been seen that some 3rd party apps that seem to cause the EDR Agent to not start. Further review with support would be needed in that case.

Hello DianneY,

I have restarted the Sophos System Protection Service on the Endpoint, along with the Force update From Central and EDR still does NOT turn on.

I do have case#: 9732222 opened and they are definitely looking into it now but still can't come up with a solution.

Thanks!

Hello Chris Rodriguez 

Thank you for the ticket #, we'll post updates here periodically so as to help other Community members facing the same issue.

Hello Chris Rodriguez 

Do you by any chance have SafeNet Authentication Client installed on that endpoint?

Hello DianneY,

In fact, that workstation DOES indeed have the SafeNet Authentication Client installed on that endpoint? Is that an issue with EDR?

Hello Chris Rodriguez 

It may be what is causing the issue. We had another case and our Devs found that SafeNet Authentication Client 10.2.39.0 (or something to that effect), which has a feature that blocks screen capture, and the Devs think that this is interfering with the EDR agent. Can you see if uninstalling, or maybe downgrading to a previous version of this helps?

I am also reaching out to the support rep also helping you in the support ticket.

Hello Chris Rodriguez 

It may be what is causing the issue. We had another case and our Devs found that SafeNet Authentication Client 10.2.39.0 (or something to that effect), which has a feature that blocks screen capture, and the Devs think that this is interfering with the EDR agent. Can you see if uninstalling, or maybe downgrading to a previous version of this helps?

I am also reaching out to the support rep also helping you in the support ticket.

Hi Chris Rodriguez 

How did removing/downgrading SafeNet affect this issue?

Inquiring minds want to know [:)] Thank you!

Hi DianneY,

So I have this issue on (3) workstations in my environment, so I went ahead and tested by removing the whole SafeNet Authentication application from the workstation and reboot and as usual the EDR service would start but would stop after 5 minutes. This time, it stayed on. Removing the SafeNet Authentication application fixed the issue of Sophos EDR from continuing to run. 

Now that we have identified the issue, what is the solution to having both Sophos EDR running and having the SafeNet Authentication software installed on the same workstation? Is there something I need to whitelist or add to the exclusion list?

You can now tell the inquiring minds that it worked :)

Hello Chris Rodriguez 

The inquiring mind was mainly myself [:)] It's good to know that uninstalling seems to help the issue, at least that isolates what's causing this to happen.

Sorry I do not have anything further yet on this; I will leave a note for the support person you are working with, and they should work on getting any other required information for further investigation on the issue.

I will update this post when I have more information.

Hi DianneY,

Well, at least we got part of the solution resolved.

I know that when installing the SafeNet Authentication software, it has different levels of security and I'm going to watch someone install the software and see if putting the software at the lowest level of security might fix the issue and be able to run BOTH without causing any issues.

Hello Chris Rodriguez 

Sounds like a plan. See if SafeNet's EntryProtect can be disabled. You may also try using a different version of SafeNet (an older one -SafeNet 10.2.19.0, for example).