Issue: Sophos Central Admin – US-West region - Delays with the enforcement of Central policies on managed endpoints.

I am getting the spinning wheel of death again on Central - are they overloaded again?

I'd wager so.

Like clock work, It's about 1:30pm US EST right now, and I can't register a device with CWG again...

Edit: there it goes.

Just had a 24 hour delay for a policy pushing to an end point. Applied it yesterday, it kicked in just now.

Christopher Curwood It should not take that long. If this happens again or is repeatable, please raise a case with the Sophos Support team right away. They will want to dig into this

Hi Win,

I received an email from Michael Anderson yesterday wherein he indicated they're still not certain the database and performance issues are resolved. Since another subsequent encryption policy push took 30 minutes (and earlier this year used to be within minutes) I don't see the point in opening a ticket.

Is anyone else getting new alerts over the past 7 days about "One or More Services are missing"? A tech that I've been working with said it appears to be a communication failure with the console but that Sophos isn't reporting anything. This is an active issue and I'm still having this happening daily.

I have services (web intelligence, hitman pro, antivirus, etc) that will just be gone. The tech said that the client will call out to the console to check for any updates. That is successful and the console is replying back with the command to delete the old version of the services but then the download of the new version fails. Leaving me with multiple computers with missing services.

This fix I was given is found at http://sophos.com/kb/121905. Other steps I've been doing that have worked if all else fails:

1. Rename c:\windows\system32\drivers\hmpalert.sys to hmpalert.sys_OLD (If not there, continue on through the steps and it will be created. Or copy over file from this root folder.)
2. Open a command prompt (ran as administrator)
3. Enter cd " C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\hmpa64\"
4. Enter hmpalert.exe /install /mode=sophos
5. Force a manual update and check if Hitman.pro alert gets installed (You can do this by double-clicking the Sophos System Tray icon, Click About, Click 'Update Now').

Yes, I've also seen this but haven't had the time to investigate.

Mine are all remote users and I've lost confidence in the portal providing accurate status of endpoints with all of the delays.

Yes we see this a lot too. It's happening frequently and we do not have time to investigate either. I am with Mike on this, I am not confident that this isn't related to their over-provisioning and performance issues.

Hi Sure Win,

I made a new policy on Friday with an exception due to false positive and applied to 1 machine. Today the machine is still blocking the false positive. Ticket 7548229 if you want to take a look and ensure your support team doesn't give me a slow, run-around experience.

Thanks Christopher Curwood I'll take a look at case number 7548229 

Hi Christopher.  We also had a policy update problem last week.  We created a new policy on 8-25, but it did not begin working until 9-1.  Support was able to offer no explanation.  My theory is that their system is still very unstable and horribly overloaded.

So in this case the policy was pushing but Sophos' intercept X product has a bug where you cannot make an exception. Sophos Intercept X incorrectly identifies Microsoft PowerQuery in Excel 2013 as an exploit. I created a new policy and added an exception for this exploit, but with the way they designed Intercept  it keeps getting blocked even with an exception (something about every 'event' of the exploit being blocked generating a unique identifier thereby making exclusions impossible).

The issue with encryption policies not applying in a reasonable timeframe is still present however, as we are currently at the 30 minute mark from me adding a computer to an encryption policy and it not taking effect despite the client reporting a recent update timestamp in Central. I'm capturing everything with screenshots and will open a ticket.

So in this case the policy was pushing but Sophos' intercept X product has a bug where you cannot make an exception. Sophos Intercept X incorrectly identifies Microsoft PowerQuery in Excel 2013 as an exploit. I created a new policy and added an exception for this exploit, but with the way they designed Intercept  it keeps getting blocked even with an exception (something about every 'event' of the exploit being blocked generating a unique identifier thereby making exclusions impossible).

The issue with encryption policies not applying in a reasonable timeframe is still present however, as we are currently at the 30 minute mark from me adding a computer to an encryption policy and it not taking effect despite the client reporting a recent update timestamp in Central. I'm capturing everything with screenshots and will open a ticket.