The security health cannot be reported at the moment error

The Sophos Health Service is responsible for creating the registry keys under:
HKLM\Software\Wow6432node\sophos\Health\Status

The MCS Agent service reads these to report on the health of the services, so I would suggest:

1. Check that the Sophos Health service exists and is started.

2. Check the above registry key.  Does the above key exist but with no values underneath? A working computer could be useful for reference.

3. Does the adapter registry key exist under:
HKLM\software\wow6432node\sophos\remote magement system\ManagementAgent\Adapters\SHS 
and does the DllPath value point to the shsadapter.dll and the file exist in the referenced location.  Again checking a working computer for referecence.  You may also want to check that the shsadapter.dll is loaded in the MCSAgent.exe process.  You can do this with Process Explorer (Sysinternals).

Maybe use Process Monitor (Sysinternals) to monitor what happens when you start the Sophos Health service in terms of the above key.  Problems writing the values?

Hope it helps.

Regards,

Jak

Hi Jak,

I have one computer in our network where the Healthservice will not start. I followed your suggestion for looking at a computer with no problems as reference, but i cannot find the registry keys you refer to. I do see the same keys under HKLM\software\sophos....

When i try to start the service on the problem conputer i get an 575 error. All other services are working fine ?

Besides that it is a little bit strange that the option to stop and start this service is available. On computer with no problems stopping and starting teh service is greyed out.

Regards,

Hans.

By any chance was an eSata drive connected to that PC?

i have the same issue after cloning sata hdd to SSD
The Health service won t start with 575 error !

I have the same problem as well. Sophos Central for one of my devices says The security health cannot be reported at the moment. On the client computer, the Sophos Health Service won't start Error 575. I cannot uninstall or re-install because tamper protection won't allow me to. I disabled Tamper Protection from Central but the command is not reaching the client because it remains enabled. Suggestions?

Hi,

Here is what i did to solve the issue

First disable the tamper protection

1. Boot the system into Safe Mode.
2. Click Start > Run > services.msc > right-click Sophos Anti-Virus service > properties > set to disabled > OK
3. Click Start > Run and type regedit and then click OK.
4. Go to the following location in the registry editor:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agentand set the REG_DWORD Start to 0x00000004
5. Go to the following location in the registry editor:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Configand set the following REG_DWORD values SAVEnabled and SEDEnabled to 0
6. Go to the following location in the registry editor:
   HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtectionand set the REG_DWORD Enabled to 0

Reboot the system in normal mode.

After that you can reinstalling the sophos endpoint software

Best regards

Hi,

Here is what i did to solve the issue

First disable the tamper protection

1. Boot the system into Safe Mode.
2. Click Start > Run > services.msc > right-click Sophos Anti-Virus service > properties > set to disabled > OK
3. Click Start > Run and type regedit and then click OK.
4. Go to the following location in the registry editor:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agentand set the REG_DWORD Start to 0x00000004
5. Go to the following location in the registry editor:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Configand set the following REG_DWORD values SAVEnabled and SEDEnabled to 0
6. Go to the following location in the registry editor:
   HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtectionand set the REG_DWORD Enabled to 0

Reboot the system in normal mode.

After that you can reinstalling the sophos endpoint software

Best regards