24H2 update causes very long boot times

[cheekycharly]

How long does it take CDM to fire up? I find sometimes its 30+ seconds after logon and other times up to 3mins after boot.

 

It is very random when booting up and loading applications as to how long it will be before the user is good to go.

[kennysarmy]

With no Sophos on the two control devices logons and boot times are as normal.

 

With Sophos reinstalled we get slow logons again - only after first boot. Subsequent logons to a PC which is ON are as normal.

 

We're going to raise a case with Sophos Support.

[cheekycharly]

When I login to a laptop Sophos is the first to start but longest to get loaded up which delays all the other applications from starting promptly.

 

As you can see from my attached screenshot we don't have many applications that boot on startup. Is yours about the same amount?

 

[kennysarmy]

https://community.sophos.com/intercept-x-endpoint/f/discussions/147857/sophos-endpoint-performance-issues-with-24h2

 

 

[kennysarmy]

For those with SOPHOS and Slow Win11 bootup and logon performance issues can you please trying disabling the Sophos System Protection Service and testing.

 

We are finding with this STOPPED and DISABLED our Logon times return to normal.

 

 

[Oaktech]

That's interesting - we haven't noticeably had this issue since windows 7 - when we moved to 10 the problems stopped. The major difference in config at that time  was that we stopped using ESET in favour of SCCM Endpoint Protection. We haven't seen anything like it on 11/Intune/Managed Defender.

 

[kennysarmy]

Slow Logons

and Normal Logons

 

Narrowing down the Sophos elements which are causing the issue for us.

[cheekycharly]

So that's basically AV off when Real Time Scanning of files is knocked off. 

 

What about when you just knock off the Malicious Behavior Detection?

[kennysarmy]

Realtime scanning of files on it's own is fine.

 

But add in Malicious Behaviour Detection logon times increase by a factor of 3 for the first logon after a reboot.

[kennysarmy]

Currently doing this:

 

Boot process monitor log

1. Do steps one to three of the Normal process monitor log section.
2. Click Options > Enable Boot Logging.
3. Turn on Generate thread profiling events.
4. Select Every second and click OK.
5. Click Filter > Enable Advanced Output.
6. Restart your device and reproduce the issue.
7. Run Procmon64.exe.
8. Click Yes once prompted.
9. Zip the PML file and attach it to your reply to Sophos Support for your existing case, or see Sophos Support: Submit files .

[cheekycharly]

25 minutes ago, kennysarmy said:

Currently doing this:

 

Boot process monitor log

1. Do steps one to three of the Normal process monitor log section.
2. Click Options > Enable Boot Logging.
3. Turn on Generate thread profiling events.
4. Select Every second and click OK.
5. Click Filter > Enable Advanced Output.
6. Restart your device and reproduce the issue.
7. Run Procmon64.exe.
8. Click Yes once prompted.
9. Zip the PML file and attach it to your reply to Sophos Support for your existing case, or see Sophos Support: Submit files .

Keep us posted on that Monitoring. 👍

[kennysarmy]

Sophos have requested the following:

 

Logs Required: To further investigate the issue, please collect and provide the following logs from the affected machine

• BOOT PML Logs Get process monitor logs and system events using Process Monitor

• Latest SDU Logs Sophos Diagnostic Utility: Locate and download

• SFS & SSP Debug Logs (captured while replicating the issue): Sophos Endpoint Self Help: Product Logging

  When enabling and disabling the debug logs, kindly note down the exact timestamps along with the date. If possible, please also capture a screenshot showing the time.
  This will help us effectively correlate the logs with the boot timings.

Next Steps:

1. Reboot the machine and observe the current boot time.
   Please share how much time it is taking now.

2. Open Command Prompt with Administrator privileges, type the command FLTMC, and share a screenshot.
    This will help us identify if any third-party drivers are present.

 

I'm struggling with:

SFS & SSP Debug Logs (captured while replicating the issue): Sophos Endpoint Self Help: Product Logging

When enabling and disabling the debug logs, kindly note down the exact timestamps along with the date. If possible, please also capture a screenshot showing the time.
This will help us effectively correlate the logs with the boot timings.

 

 

I can see how to turn on Debug logs for SFS and SSP, but once turned on I don't see how to gather the logs?

[kennysarmy]

For those with issues do you have redirected desktops?

[Cat_Jam148]

 

On 07/04/2025 at 12:48, kennysarmy said:

For those with issues do you have redirected desktops?

 

We have our desktops redirected to a local folder on the C Drive. Just holds our icons.

 

Hoping to do some more tests on these issues during Easter if I get chance.

Edited April 10, 2025 by Cat_Jam148

[mikes]

With our black screen issue  we have no redirected desktops, (we have redirected start menu however) - and it happened on machines without sophos as well - though i haven't checked to see if this black screen issue is still happening this week

[kennysarmy]

Sophos is definitely the cause of our slow logons after a reboot.

They have taken countless logs and debug data and remoted in twice to see the issue, but so far no fix.

 

Only happens on PC's which we in-place upgraded to 24H2 from 23H2.

[cheekycharly]

How's the situation now after easter?

[kennysarmy]

I've had a bit of leave will touch base with the technicians today and report back later in the week.

[Langella]

Have you checked the certificates in your domain controller? 

Just fixed this today where logins were taking 3 minutes to happen, now 5 seconds.   It turns out in one of the DC servers in the Certificate Store / Computer / Personal  there was an User Authentication certificate for the domain expired.   

[kennysarmy]

2 hours ago, Langella said:

Have you checked the certificates in your domain controller? 

Just fixed this today where logins were taking 3 minutes to happen, now 5 seconds.   It turns out in one of the DC servers in the Certificate Store / Computer / Personal  there was an User Authentication certificate for the domain expired.   

 

Great news you've fixed your issue.

I'll see if we have anything similar lying around.

[kennysarmy]

Our logons immediately after a restart around 1 min 20 seconds but this reduces to 25 seconds if the PC has been on for a while.

 

I'm guessing this is normal as the Sophos AV and other services are still "readying" themselves?

[Lxshm]

4 hours ago, Langella said:

Have you checked the certificates in your domain controller? 

Just fixed this today where logins were taking 3 minutes to happen, now 5 seconds.   It turns out in one of the DC servers in the Certificate Store / Computer / Personal  there was an User Authentication certificate for the domain expired.   

 

does it need to be checked for each computer?

[GameOfGPOs]

Out of interest, did you ever get to a solution for this? We have a very similar problem that's been on and off for over a year now - coinciding with a move to Sophos. It’s started to be a problem yet again after updating to 24H2, we had the problem on 23H2 early doors, but not everywhere.

 

Similar setup to you, Sophos, Cloud Drive Mapper, Dell devices, imaged with SCCM.