Issue
Sophos Support have been alerted to an issue in that customers who have devices that are "re-protected" either by a VDI process or a reinstall are receiving a "Failed to Protect computer or server" alert in Sophos Central.
This is believed to be caused by the ALC Status Message that is processed on the endpoint not appearing in Sophos Central.
If this message does not arrive within 1 hour of an update the alert is displayed against the device.
The issue can be confirmed by seeing that you have a "Computer/Server re-protected" message in Sophos Central followed by a "Failed to protect computer" message.
Note: If you have an " x component failed to install" message between the two events this would indicate that the machine genuinely has failed to protect.
Product and Environment
- Sophos Central Windows Endpoint
- Sophos Central Windows Server
Issue timeline
- 20/01/2023 @ 15:00 - Issue raised with development
Impact
- Affected customers are not easily able to see which machines have genuine protection issues.
- Devices that do not show an "x component failed to install" message in between the re-protected status message and the "failed to protect" message are expected to be in good health
- At this point in time we believe this issue is only affecting customers within the EU-CENTRAL-1 (Germany) region. You can check your region by logging in to Sophos Central and checking here . You should see the region below:
This account is located in the X region.
Current Status
The issue is currently being investigated by the development team
