Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 1 subscriber
  • Views 3968 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Clients OS showing not found

TechnicaSols

Many of our clients (businesss) are ringing us saying their computers are reporting no antivirus (The windows security center.)

We have seen this before and the issue just vanishs after a day, we have put it down to a Sophos update which doesn't seem to be detected by the OS

Anyone else experiencing this issue

:24315


This thread was automatically locked due to age.
  • 0

    Hi TechnicaSols

    I suggest speaking with a member of support about this issue, this can be due to the product however it can also be a failure by the WSC and speaking with a member of support at the time it occurs will provide you with information as to whether there are any known problems with the Sophos software being the cause of the issue.

    Regards

    A_K

    :24319
  • 0

    Hi,

    When it happens, is there anything in the event log?  I suspect that WMI has encountered a problem and probably needs a reboot to recover itself.

    Regards,

    Jak

    :24323
  • 0

    Unfortunately suport havent been any help as yet.

    I have procided logs etc and the responoce is "Sophos is upto date windows is just not reporting correcting". I know this.........

    Sophos also has a KB saying this can happen and is usually fixed by Sopos rolliong out a monthly (magor update)

    clients are less than impressed. we receive many many calls thinking there is a problem. Sophos at renewall time will be a hard sell to these clients.

    ps reboots do nothing

    :24377
  • 0

    On these machines. do you have anything in the event log from "Source": "WMI" or "SecurityCenter" that suggests a inconsistent state or that Security Center is unable to monitor security problems?

    SAV just calls into the Windows Security Center interface to set the state of SAV for Windows to display, if that fails becasue WMI isn't operational then that would be the place to start digging.

    The following command will test if the data has been passed to Security Center:

    WMIC /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct GET /value

    In this case it should return something like:

    displayName=Sophos Anti-Virus

    instanceGuid={65FBD860-96D8-75EF-C7ED-7BE27E6C498A}

    pathToSignedProductExe=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\WSCClient.exe

    pathToSignedReportingExe=C:\PROGRA~2\Sophos\SOPHOS~1\WSCClient.exe

    productState=327680

    Regards,

    Jak

    :24379
  • 0

    WMIC /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct GET /value
    ERROR:
    Code = 0x8004100e
    Description = Invalid namespace
    Facility = WMI

    WMIC /namespace:\\root\SecurityCenter PATH AntiVirusProduct GET /value
    Displayname=Sophos Anti-Virus
    onAccessScanningEnabled=FALSE
    ProductUpToDate=TRUE
    VersionNumber=

    Displayname=Sophos AntiVirus
    onAccessScanningEnabled=TRUE
    ProductUpToDate=FALSE
    VersionNumber=9.5 virus data 4.76G





    :24529