Sophos and Windows 11

[malware]

Hi all,

 

We are rolling out Windows 11 to our devices, imaging with a SCCM task sequence, we're having a strange issue that we're stumped on and wondered if anyone else has had the issue.

 

Once the imaging is finished, everything works fine, as soon as you run a windows update and then restart everything becomes unusable and applications take a long time load (although sometimes File Explorer/Edge/Windows Apps run fine).

 

When you check Sophos it says there is an issue with the ML Engine, and trying to update just keeps failing, I ran a gpupdate and then everything improved, sophos could update and apps began to open normally (I'm not sure if this was causation or correlation).

 

Windows 10 works fine no problem, it's only a combination of Windows 11 and Sophos, it's almost like Sophos is making things run slowly because it can't scan them? Just a guess.

[DarkMaster]

try adding Sophos as an install in the task sequence

[MatthewL]

You cannot insall Sophos on your image as such, if you do you need to prep it for deployment. You are better adding it as a task once imaged to install.

[malware]

try adding Sophos as an install in the task sequence

You cannot insall Sophos on your image as such, if you do you need to prep it for deployment. You are better adding it as a task once imaged to install.

 

I have a software stack step that is just another task sequence with install application steps, thats how I installed ESET before, are you saying I can't do it this way?

[kierans]

We’re having similar issues although hadn’t noticed anything in the Sophos UI.

 

File explorer etc just doesn’t feel as responsive as it should, although randomly will work as usual.

 

Ours is installed as part of a task sequence via SCCM

[malware]

We’re having similar issues although hadn’t noticed anything in the Sophos UI.

 

File explorer etc just doesn’t feel as responsive as it should, although randomly will work as usual.

 

Ours is installed as part of a task sequence via SCCM

 

Everything works fine until Windows Update is run, and then everything really slows down. Trying to open any software tends to take like 1-5 minutes sometimes! It's completely unusable.

[kierans]

Everything works fine until Windows Update is run, and then everything really slows down. Trying to open any software tends to take like 1-5 minutes sometimes! It's completely unusable.

 

Dell hardware by any chance? I found applying the driver packages improved performance, still not acceptable though

 

I only upgraded a single brand new I7 machine and initially performance was awful as you describe, the drivers seemed to improve somewhat

Edited August 2, 2024 by kierans

[malware]

Dell hardware by any chance? I found applying the driver packages improved performance, still not acceptable though

 

I only upgraded a single brand new I7 machine and initially performance was awful as you describe, the drivers seemed to improve somewhat

 

At first I was reusing Win 10 drivers and letting Windows Update grab the rest, but after the issue I used Dell Command to grab the latest Win 11 drivers but didn't fix it for me.

 

Yeah only seems to be Dell that have the issue, but we have many models, OptiPlex 3000/3020/3080/7010 SFF/7010 Micro and many Lattitudes too!

[kierans]

At first I was reusing Win 10 drivers and letting Windows Update grab the rest, but after the issue I used Dell Command to grab the latest Win 11 drivers but didn't fix it for me.

 

Yeah only seems to be Dell that have the issue, but we have many models, OptiPlex 3000/3020/3080/7010 SFF/7010 Micro and many Lattitudes too!

 

Only seems to be Dell here too, tried an Optiplex 3090, Latitude 3540 and 5450 all with the issue.

 

I wouldn’t say applying the drivers resolves the issue but has improved performance

[malware]

Only seems to be Dell here too, tried an Optiplex 3090, Latitude 3540 and 5450 all with the issue.

 

I wouldn’t say applying the drivers resolves the issue but has improved performance

 

We have just tried moving the device into an OU with no GPOs applied and that seems to have fixed it, so I think it might just be a process of elimination now? Something not happy with Sophos/Windows 11/Smoothwall.

[yettoasty]

We are currently scratching our heads with this exact issue! Sophos and Windows 11 23H2… Moving OUs, or running GP update seems to fix, for a while… it’s totally random PCs across our estate, all new Dell Optiplex 7020s. Did you ever get anywhere with your investigations and manage to resolve?

[DarkMaster]

have you checked to see whether windows built in av is running

 

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f

 

even with sophos installed it can still run

[yettoasty]

Hi - Defender for EndPoint it's running in Passive Mode when Sophos is installed. There is some confusing conflicting documentation by Microsoft on how Defender should behave when a third-party AV is installed, but have just gone through disabling Defender for a test machine, so will see if that helps... Curious to know what 'malware' found, if anything, to improve, as his symptoms are very similar to ours currently. Thanks for the suggestion 'DarkMaster', will see if disabling Defender helps (AMRunningMode = Not Running)

[DarkMaster]

yes it should run in passive mode, but if you look in task manager it can sometimes run along side sophos and cripple the machine

[smithson83]

I've been testing the DisableAntiSpyware regedit with a few low powered machines we have, and it does seem to make a big difference.

 

My question is, is there any notible negative security impact, assuming Sophos EP is running as is should, by doing this?

 

I'm keen to widen the test pool, but just wanted to check for opposite opinions first.

[DarkMaster]

we haven't seen any impact as long as Sophos is running and we have it across all six of our sites

[Olliedawg]

I can't say we've had any issues with Sophos Endpoint at all on our windows 11 machines. 

 

We add the sophos install as part of the task sequence when imaging, after the OS has installed.

[si05101974]

No issue's what so ever here also. We install Sophos stand alone with installer form our cloud account currently, although not for much longer.