[22h2] Random Blue screens

[jackp]

Heyo,

 

We're getting some random Blue Screens at the moment with the SYSTEM_SERVICE_EXCEPTION code (specifically NETIO.sys)

 

When I'm looking at BlueScreenView (by NirSoft) it shows NETIO.sys and ntoskml.exe in red, but also mentions some of our standard tools such as Senso's WFP driver and various Sophos Endpoint drivers.

 

This blue screen apocalypse isn't Windows or Model specific, we have various different models from different manufacturers (Stone, HP, Dell, etc) and are running a mixture of 10 Education Pro 22H2 and 21H2.

 

Has anyone seen anything similar before?

 

Thanks for all the help in advance.

[IonutZ]

Hi Jack,

We had the same issue and we discovered if we disable Sophos "Real Time Scanning" for Internet, the issue dissapeared. You have to contact Sophos to give access to a Maintenance release, you cand find more information here:

https://support.sophos.com/support/s/article/KB-000045942?language=en_US

We are still on that FTS package at the moment, waiting for them to fix it permanently. We think it's related to Sophos and Senso not being able to work together properly...

I hope this will help you.

[jackp]

Thanks very much! I had absolutely no idea about that advisory. I've messaged Sophos support for a maintenance build.

Much appreciated! I was so close to punching a brick wall

[Primus]

Heyo,

 

We're getting some random Blue Screens at the moment with the SYSTEM_SERVICE_EXCEPTION code (specifically NETIO.sys)

 

When I'm looking at BlueScreenView (by NirSoft) it shows NETIO.sys and ntoskml.exe in red, but also mentions some of our standard tools such as Senso's WFP driver and various Sophos Endpoint drivers.

 

This blue screen apocalypse isn't Windows or Model specific, we have various different models from different manufacturers (Stone, HP, Dell, etc) and are running a mixture of 10 Education Pro 22H2 and 21H2.

 

Has anyone seen anything similar before?

 

Thanks for all the help in advance.

 

Just on the version of Windows - confusingly Education Pro is actually a lower version than Education.

 

Education = Enterprise

Education Pro = Pro.

[jackp]

Interesting, that's a weird product strategy.

We're moving to Windows 11 Education (non pro) over summer so maybe we'll get some extra bits n bobs

[adamsund]

We've had the same issue for a little while now and we use ESET so it's not specific to Sophos. ESET and Senso have been in dialogue and I believe that Senso released a new client recently to fix the issue, then quickly pulled it again. Senso's 'fix' is to disable WFP which isn't great as that disables half the features! Senso Support | Cloud Classroom and Network Management Solution

[TerryLambert]

That SYSTEM_SERVICE_EXCEPTION with NETIO.sys usually points to network drivers or related software acting up. Since BlueScreenView is flagging stuff like Senso’s WFP driver and Sophos, they might be the culprits.

 

I've seen similar issues where a driver update or a conflict with security software was the problem. Try updating or rolling back those drivers. Maybe even check for updates from the manufacturers (Stone, HP, Dell) for any fixes related to network drivers.

 

Hang in there! Hope you get it sorted soon.