Sophos Endpoint

Discussions [Sophos Notification] Sophos Central Endpoint and SEC: Computers fail/hang on boot after the Microsoft Windows April 9, 2019 update

Sophos Endpoint requires membership for participation - click to join

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[Sophos Notification] Sophos Central Endpoint and SEC: Computers fail/hang on boot after the Microsoft Windows April 9, 2019 update

Gowtham Mani over 6 years ago

Hi Everyone,

After installing the following Microsoft Windows updates Sophos has received reports of computers failing to boot:

https://support.microsoft.com/en-gb/help/4493467/windows-8-1-update-kb4493467 (Security-only update)
https://support.microsoft.com/en-gb/help/4493446 (Monthly Rollup)
https://support.microsoft.com/en-gb/help/4493448 (Security-only update)
https://support.microsoft.com/en-gb/help/4493472/windows-7-update-kb4493472 (Monthly Rollup)
https://support.microsoft.com/en-us/help/4493458 (Security-only update)
https://support.microsoft.com/en-us/help/4493471/windows-server-2008-update-kb4493471 (Monthly Rollup)
https://support.microsoft.com/en-gb/help/4493450 (Security-only update)
https://support.microsoft.com/en-gb/help/4493451/windows-server-2012-update-kb4493451 (Monthly Rollup)

The issue is currently being investigated. For more updates and workaround, please follow the below KBA.

Following the Microsoft Windows 09th April update computers fail/hang on boot

This thread was automatically locked due to age.

Parents

Yashraj S over 6 years ago

Hi Everyone,

[UPDATE]: Microsoft has blocked the affected updates from being applied to machines where the Sophos Endpoint is installed.
Further information available in https://community.sophos.com/kb/en-us/133945
Cancel
Vote Up 0 Vote Down

Cancel
Richie Knight over 6 years ago in reply to Yashraj S
It appears that some of the Windows components updated as part of these new patches require a Sophos token update...

I'm guessing these issues will be resolved when Sophos provides an update?

KB4493472 -- Monthly Rollup

Provides protections against Spectre Variant 2 (CVE-2017-5715) and Meltdown (CVE-2017-5754) for VIA-based computers.

Fixed an issue that caused the error "0x3B_c0000005_win32k!vSetPointer".

Fixed the netdom.exe error "The command failed to complete successfully" appears.

Fixed the Custom URI Schemes issue.

Fixed the WININET.DLL issue.

Security updates

KB4493448 -- Security only update

Same as monthly rollup except for error "0x3B_c0000005_win32k!vSetPointer" and Custom URI Schemes.
Cancel
Vote Up 0 Vote Down

Cancel
Boz over 6 years ago in reply to Richie Knight

So this was happening to us with a windows 2012r2 box.

so I booted in to safe mode disabled SAV and auto updates. Booted in to windows to remove the KB and I don't have those KB installed.

The last update is KB4489881 so is the March security update also having a problem or am I just the lucky one.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

Boz over 6 years ago in reply to Richie Knight

So this was happening to us with a windows 2012r2 box.

so I booted in to safe mode disabled SAV and auto updates. Booted in to windows to remove the KB and I don't have those KB installed.

The last update is KB4489881 so is the March security update also having a problem or am I just the lucky one.
Cancel
Vote Up 0 Vote Down

Cancel

Children

pez over 6 years ago in reply to Boz

that update installed on one of our machines today, and it was behaving itself, so maybe you were just lucky. check your event log to see if you have some sophos errors 8x just after booting
Cancel
Vote Up 0 Vote Down

Cancel