Cloud Status - 'Some Sophos services not running' or 'missing'

Question

We have a large number of devices that are reporting a bad status in the Cloud console. The error given is 'Some Sophos services not running' or 'Some Sophos services missing'. When I open services.msc on the clients, I can see in some cases all the services are running and in others the 'Sophos System Protection Service' is in a [Stopping] state. Sophos support has been almost completely useless as they continue to point me to the same article again and again: www.sophos.com/.../122899.aspx . This article references a specific case where the 'Sophos Anti-Virus' service won't start. That said, I did try their solution of manually running vcredist_x86.exe' and it had no impact on the problem. 
 Has anyone else had this problem and have any advise or ideas to try?

jak · Answer

There are so many issues in this thread with multiple components. With the missing Sophos Web Intelligence Service. Do you have the SAV MSI log? What I suspect might be happening is the missing service (swi_service) is removed during the update. This is expected. It should be put back later in the install. However if another process has a handle open to the service, Windows will not remove it until restart or the handle is closed. Until this happens the service is marked for deletion. When the installer tries to put it back it says the service is already present which it is - to some extent. The install will not fail for this. It's only when you restart the computer the service is lost but the 'damage" was prior to the restart or when the handle to the service was freed after the installer completed. I would suggest there is some third party software on the computer with a handle open to the swi_service causing the issue. Do you have any software which enumerates services? Some sort of auditing software? 
 I'd need to see a SAV MSI log to be sure this is roughly what is going on. 
 Working out what process is calling openservice on swi_service is a little tricky. One route would be to use API Monitor - http://www.rohitab.com/apimonitor . You can filter this down to OpenService https://msdn.microsoft.com/en-us/library/windows/desktop/ms684330%28v=vs.85%29.aspx which is in the Advapi32.dll module. 
 Regards, 
 Jak