Guest User!

You are not Sophos Staff.

Thread Info
  • Locked Locked
  • Replies 1 reply
  • Subscribers 9 subscribers
  • Views 2099 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Policy non-compliance! Policy non-compliance!! Policy non-compliance!!! Policy non-compliance!!!! Policy non-compliance!!!!! IS IT JUST ME!?

RL

Policy non-compliance!

Policy non-compliance!!

Policy non-compliance!!!

Policy non-compliance!!!!

Policy non-compliance!!!!!

 

Is it just me, or is anyone else fed up of constantly getting these Policy non-compliance errors in the Sophos Central Console after installs and local agent changes, such as temp overrides, only to then have to drag yourselves to the users end-point each and every time and find out that there's no issue whatsoever (as you already knew anyhow). 

So, you contact Sophos support who reply with the usual scripts:

 

1. "Please check the local machine for correctness" (AKA; as we don't even believe what the Central console says!)

2. "Please look at this KB article XYZ" (AKA; we all know it's a Sophos comms issue but we need to get rid of you.)

3. "Please run an SDU" (AKA; so we can pass it up the chain and then someone else can incorrectly blame it on your environment, but we really know it's a Sophos comms issue).

4. Or worse still; "Just acknowledge the alert" (AKA; Just make it go away - We all know these alerts are false positives).

 

Is it me, or is anyone else fed up with the bad advice of acknowledging alerts, and Sophos support asking us to check the end-point each and every-time.

 

P.S. I don't blame Sophos support directly for this! - Those poor guys and girls have to follow what the are told.

 

Isn't it about time that some accountability is taken here from Sophos!? Perhaps we can get a known defect ID, and ask us to wait for 3 years to get it fixed ;)



This thread was automatically locked due to age.
Parents

  • Do you know which policy?

    The MCS Agent service is the component responsible for reporting the status as it loads a DLL from each managed component.

    If you enable Debug level logging on the MCS Agent it will confirm the component or components sending res=diff and maybe details as to why in the case of some of the components.  The SAV component for example has a good break down of policy vs config.

    I would therefore suggest follow: https://community.sophos.com/kb/en-us/119607 on a computer with the issue. 

    Hopefully the log file: "C:\ProgramData\Sophos\Management Communications System\Endpoint\Logs\McsAgent.log" with debug logging enabled will be the starting point.

    Regards,

    Jak

Reply

  • Do you know which policy?

    The MCS Agent service is the component responsible for reporting the status as it loads a DLL from each managed component.

    If you enable Debug level logging on the MCS Agent it will confirm the component or components sending res=diff and maybe details as to why in the case of some of the components.  The SAV component for example has a good break down of policy vs config.

    I would therefore suggest follow: https://community.sophos.com/kb/en-us/119607 on a computer with the issue. 

    Hopefully the log file: "C:\ProgramData\Sophos\Management Communications System\Endpoint\Logs\McsAgent.log" with debug logging enabled will be the starting point.

    Regards,

    Jak

Children
No Data
Unfiltered HTML