New to Endpoint please help

Hi Jamie Newman1 

Would you please check under services.msc which Sophos service is not running? Also, please check under the central dashboard, you should be able to view the status of the machine on the dashboard as well. Kindly check this link as well, and see if it helps you to resolve the issue. 

Hey thank for the reply!

So upon looking at Services it would seem that Sophos Web Intelligence update has a blank status?

Thanks

Jamie

Have you tried clicking the Start Link?

Yes tried that just now but this message appears

Hello Jamie,

that's perfectly normal. The service is expected to be in the stopped state (blank). When it's started it checks if there's an update to Web Intelligence, applies it if there is one, and stops afterwards.

Christian

Hello Jamie,

that's perfectly normal. The service is expected to be in the stopped state (blank). When it's started it checks if there's an update to Web Intelligence, applies it if there is one, and stops afterwards.

Christian

That makes sense thank you, so its only active when its running updates

Cheers

But if that is okay then why is it still saying services are not running? Is this due to XP/Winserver 2003 not being supported?

Hello Jamie,

XP/Winserver 2003? You've lost me, where do these come into play?

I'm not a Central user, while I'm familiar with the WI Updater I don't know which services are supposed to run on Central Server. Might be wrong but I assume there should be one called Sophos File Integrity Monitoring. The event from 23/12/2019 says it has been stopped and it's not (perhaps no longer) among the services listed. Guess that counts as not running. Can't say what could have happened to it.

Christian

Hello Jamie Newman1 

If you have a XP/2003 Extended Support license then you should be OK, and Sophos should install/update accordingly. If you are not sure if you have Extended Support, you should be able to check this in Sophos Central under Licensing, or please contact your Sophos Partner to confirm.

If you have Extended Support, run the Diagnostic tool to see what other service(s) are not running. Click on "Run Diagnostic Tool" from the Sophos UI > About screen:

You should also check out this link that Shweta sent, there are steps that could solve the issue you are having.

https://community.sophos.com/kb/en-us/125995

I have checked its a 2008R2

I have carried out the steps from Shweta and still no change?

Hello Jamie Newman1 

That event is old. Please send a screenshot of the screen after clicking on "Run Diagnostic Tool" and go under Services. 

You can also look at the System tab there to see if there are any pending reboots, which could potentially resolve the issue as well.

No seen that tab yet thanks!

23/12/19 is probably about the time the Ransomware came in, everything was encrypted post Christmas break

https://community.sophos.com/kb/en-us/132846#How%20do%20I%20install%20Sophos%20File%20Integrity%20Monitoring?

I followed this step to no result in CMD

Hello Jamie Newman1 

Can you please look into the install logs for Sophos File Integrity Monitoring? It could be failing to install for some reason that is why the service is "missing" and could not start.

The logs are in C:Windows\Temp, and look for the most recent Sophos File Integrity Monitoring setup log<timestamp>.txt and Sophos File Integrity Monitoring install log<timestamp>.txt files.

See if you can find strings such as "Error" (which should eventually show an error code), or "Failed" (should also tell what failed, etc.).