Skip to content
Advisory: Failed to Protect computer or server alerts in Sophos Central

Advisory: Failed to Protect computer or server alerts in Sophos Central

Issue

Sophos Support have been alerted to an issue in that customers who have devices that are "re-protected" either by a VDI process or a reinstall are receiving a "Failed to Protect computer or server" alert in Sophos Central.

This is believed to be caused by the ALC Status Message that is processed on the endpoint not appearing in Sophos Central.

If this message does not arrive within 1 hour of an update the alert is displayed against the device.

noname_1674228019286.png

The issue can be confirmed by seeing that you have a "Computer/Server re-protected" message in Sophos Central followed by a "Failed to protect computer" message.



noname_1674228154925.png

Note: If you have an " x component failed to install" message between the two events this would indicate that the machine genuinely has failed to protect.



noname_1674230221854.png

Product and Environment

  • Sophos Central Windows Endpoint
  • Sophos Central Windows Server

Issue timeline

  • 20/01/2023 @ 15:00 - Issue raised with development

Impact

  • Affected customers are not easily able to see which machines have genuine protection issues.
  • Devices that do not show an "x component failed to install" message in between the re-protected status message and the "failed to protect" message are expected to be in good health
  • At this point in time we believe this issue is only affecting customers within the EU-CENTRAL-1 (Germany) region. You can check your region by logging in to Sophos Central and checking here . You should see the region below:

This account is located in the X region.

Current Status

The issue is currently being investigated by the development team

Previous article Sophos Central: Performance issues
Next article Advisory: Sophos Central Windows Endpoints/Servers

More Sophos News Posts