SIMS Summer 2025 loads of failed installed

[AGA]

29 minutes ago, 5nowman said:

Where are you doing this AMSI protection? or Exploit Mitigation and activity monitoring?

 

I cannot see it under any tampering sophos policy.

 

I cannot see it anywhere on the Sophos central management!

 

Any help would be good. thank you. 

 

 

 

In Sophos central its under Endpoint Protection > Global Exclusions > Add Exclusion > Exclusion Type > Scroll down the list

[5nowman]

19 minutes ago, AGA said:

In Sophos central its under Endpoint Protection > Global Exclusions > Add Exclusion > Exclusion Type > Scroll down the list

I saw this and it is only realtime or scheduled.

 

no amsi or exploit management options...

Edited August 29, 2025 by 5nowman

[AGA]

23 minutes ago, 5nowman said:

I saw this and it is only realtime or scheduled.

 

no amsi or exploit management options...

Select the top dropdown shown there 'Exclusion Type'

[5nowman]

9 minutes ago, AGA said:

Select the top dropdown shown there 'Exclusion Type'

Thank you. 

 

there is a box mitigations - protect applications. - this application will not be checked for exploits - enable right?

 

21:00 I am tired.. sorry if it is a bad question

[willtech]

Correct.

[5nowman]

39 minutes ago, willtech said:

Correct.

no joy here!

 

Behaviour Monitoring approved program list

• C:\ProgramData\Capita\Solus3\Deployments\*
• D:\Sims\Sims\Setups\SIMSManualSetup.exe
• D:\Sims\Sims\Setups\SIMSApplicationSetup.exe
• D:\Sims\Sims\Setups\SIMSAMPARKSetup.exe
• S:\SIMS\Setups\SIMSManualSetup.exe
• S:\SIMS\Setups\SIMSApplicationSetup.exe
• S:\SIMS\Setups\SIMSAMPARKSetup.exe
• C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.OfflineDeployer.exe
• C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.PackageDeployer.exe
• C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.AgentService.exe
• C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.UI.exe
• C:\Program Files\Solus3\*
• C:\ProgramData\Capita\*

where did you put those? I put them in end point and server thread policy exclusions.  I could not see any behaviour monitoring approved program list and Allowed Applications
under general.

 

Edited August 29, 2025 by 5nowman

[5nowman]

Thank you for this thread. I never thought I'd have to mess around with sophos! once set this should be done.

 

I do have questions for anyone that has got this all working and also @SIMS_Customer_Support @AGA @willtech

 

These are questions for sophos central:

1. Global Exception List        
Trusted Windows Program List:
S:\SIMS\Setups\SIMSAMPARKSetup.exe
S:\SIMS\Setups\SIMSApplicationSetup.exe
S:\SIMS\Setups\SIMSManualSetup.exe
D:\SIMS\Sims\Setups\SIMSManualSetup.exe
D:\SIMS\Sims\Setups\SIMSApplicationSetup.exe
D:\SIMS\Sims\Setups\SIMSAMPARKSetup.exe
C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.OfflineDeployer.exe
C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.PackageDeployer.exe
C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.UI.exe
C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.AgentService.exe

 

Question: Is this my products > General Settings > Allowed applications?

What about FMS?
What about simsinst.exe? fmsinst.exe? should those not be included? eg s:\sims\setups\simsinst.exe? 

 

2. Local Policy Level (Real-Time Scan ONLY Exclusions)
Folders
C:\Program Files\Solus3
C:\Program Files\sims\Sims .net
C:\ProgramData\Capita
C:\ProgramData\Solus 3
File
C:\Windows\sims.ini    

 

Question:
Is this    my products > General Settings > Global Exclusions
?
Should FMS not also be on this list? e.g. C:\Program Files\SIMS\FMSSQL

 

--

3. Behaviour Monitoring approved program list:
C:\ProgramData\Capita\Solus3\Deployments\*
D:\Sims\Sims\Setups\SIMSManualSetup.exe
D:\Sims\Sims\Setups\SIMSApplicationSetup.exe
D:\Sims\Sims\Setups\SIMSAMPARKSetup.exe
S:\SIMS\Setups\SIMSManualSetup.exe
S:\SIMS\Setups\SIMSApplicationSetup.exe
S:\SIMS\Setups\SIMSAMPARKSetup.exe
C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.OfflineDeployer.exe
C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.PackageDeployer.exe
C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.AgentService.exe
C:\Program Files\Solus3\AgentService\Sims.Solus3.Agent.UI.exe
C:\Program Files\Solus3\*
C:\ProgramData\Capita\*

Question: Where is this in Sophos? I do not see anything called "Behaviour Monitoring."
Is it "file or folder" ? process exclusion? Ransomware folder / process exclusion?

 

--

 

4. 
AMSI Protection:
C:\ProgramData\Capita\Solus3\Deployments\

Real-time only:
C:\ProgramData\Capita\Solus3 - Real-time only

Exploit Mitigation And Activity Monitoring:
C:\ProgramData\Capita\Solus3\Deployments\**

Confirmation: AMSI protection, Files and folders real-time only and Exploit Mitigation And Activity Monitoring.

 

6. Question: That should be everything right? nothing in individual endpoint or server policies?

 

7. Question: Failing that.. I cannot see anywhere in sophos central where we can stop sophos for 4 hours to push out solus / sims / fms - just disable real time scanning?

 

Thank you in advance.

 

5nowman

Edited August 30, 2025 by 5nowman

[SIMS_Customer_Support]

Hi @5nowman 

 

Thank you for your follow-up questions. I've passed them along for review and will get back to you shortly with a response. Appreciate your patience in the meantime!

 

Best wishes

Sally 

[SIMS_Customer_Support]

Hi @5nowman 

 

SOLUS-Sophos Follow Up Answers.docx

 

Best wishes

Sally

[willtech]

Sorry for the delay, been slammed with work. 

 

1. Lob them in Process (Windows) Exclusion

Add FMS in as well.

SIMSinst and FMSinst are not really used now, especially if you are using SOLUS3 . You can add if you want, but don't see any value in doing so. 

 

2. Yes File or folder (Windows) Global Exclusion

Again add FMS

 

3.This is Exploit Mitigation and Activity Monitoring (Windows) to add it to. You could add to Ransomware exclusion as well, personally I have not. 

 

6. The Global exclusions will cover both endpoint and server. 

 

7. Two options:

1.Turn off Tamper Protection on the console for the device then login to the device and disable what you need.

2.Create a policy turning it off what you need and then temporally assigning that policy then revert after.

 

Sadly both options will take time to sync down on busy times.

Edited September 1, 2025 by willtech

[5nowman]

47 minutes ago, SIMS_Customer_Support said:

Hi @5nowman 

 

SOLUS-Sophos Follow Up Answers.docx 14.25 kB · 3 downloads

 

Best wishes

Sally

Thank you for the doc. Hope it helps others too. 

2 and 4 worked

[5nowman]

7 hours ago, willtech said:

Sorry for the delay, been slammed with work. 

 

1. Lob them in Process (Windows) Exclusion

Add FMS in as well.

SIMSinst and FMSinst are not really used now, especially if you are using SOLUS3 . You can add if you want, but don't see any value in doing so. 

 

2. Yes File or folder (Windows) Global Exclusion

Again add FMS

 

3.This is Exploit Mitigation and Activity Monitoring (Windows) to add it to. You could add to Ransomware exclusion as well, personally I have not. 

 

6. The Global exclusions will cover both endpoint and server. 

 

7. Two options:

1.Turn off Tamper Protection on the console for the device then login to the device and disable what you need.

2.Create a policy turning it off what you need and then temporally assigning that policy then revert after.

 

Sadly both options will take time to sync down on busy times.

!!

 

Appreciate the time that you took to reply. Thank you.

 

Mental first day back and it's only teacher training day lol.

Sophos has caused chaos! I think  it is also causing delays with papercut too.. long times to view it.

 

Going to throw exclusions just incase.

 

Hope it goes well.. FYI   I just did sections 2 and 4 in my post and like 2-3 reboots so it pushes the exclusions etc. Hero Mode and pushed out 100 sims, 4 failed due to someone switching the machines off!

 

Edited September 1, 2025 by 5nowman

[DrCheese]

@5nowman (& everyone else who's helped!)

Thanks for this - Went to do SIMS Summer last night to try and clear up an error we're having and hit this - Not fun!

 

Did 2 and 4 in Sophos like you & got it running again. Big help so cheers for coming back to say  

Edited September 3, 2025 by DrCheese

[SIMS_Customer_Support]

8 hours ago, DrCheese said:

@5nowman (& everyone else who's helped!)

Thanks for this - Went to do SIMS Summer last night to try and clear up an error we're having and hit this - Not fun!

 

Did 2 and 4 in Sophos like you & got it running again. Big help so cheers for coming back to say  

 

8 hours ago, DrCheese said:

@5nowman (& everyone else who's helped!)

Thanks for this - Went to do SIMS Summer last night to try and clear up an error we're having and hit this - Not fun!

 

Did 2 and 4 in Sophos like you & got it running again. Big help so cheers for coming back to say  

 

8 hours ago, DrCheese said:

@5nowman (& everyone else who's helped!)

Thanks for this - Went to do SIMS Summer last night to try and clear up an error we're having and hit this - Not fun!

 

Did 2 and 4 in Sophos like you & got it running again. Big help so cheers for coming back to say  

 

8 hours ago, DrCheese said:

@5nowman (& everyone else who's helped!)

Thanks for this - Went to do SIMS Summer last night to try and clear up an error we're having and hit this - Not fun!

 

Did 2 and 4 in Sophos like you & got it running again. Big help so cheers for coming back to say  

@DrCheese great to read the article @SIMS_Customer_Support provided has helped resolve the issue you were experiencing  

[5nowman]

@DrCheese @SIMS_Customer_Support

@ Everyone... well done. 

You are all epic. I would be drowing right now.

There is apparently a KB on sims about this now. I do not know the number.

[SIMS_Customer_Support]

@5nowman

@drcheese

 

The KBA reference is https:// help.parentpaygroup.com/csm?id=kb_article_view&sysparm_article=KB0013909

[jamiehall]

Even with the exclusions, we're now having issues with the installer processes hanging after they finish which then eventually times out in SOLUS3 - it is eventually logging it as successful as the setup does run, but means ~30 minute timeout delay between each part of the deployment. This also happens when installing manually from extracted packages (you can see the processes continue to run in task manager). This appears to being caused by the Sophos "Malicious Behaviour Detection" module which Sophos has started turning on. We've got a case open with Sophos at the moment to troubleshoot further.

[Sheridan]

We're still seeing it too with the exceptions added. However I've spent too much time on this now so I've just accepted the fact that the Solus 3 console installation result is unreliable - staff let me know when the update has failed as they see the incompatible database error!

[ITGuyNW]

There's a new SOLUS update soon. 3.12.86 .  We're getting it at some point over the next few weeks.

[Sheridan]

We're on 3.12.86.1 and have had the issue since July

[jamiehall]

So I had stupidly skimmed over the exclusion for "Exploit Mitigation And Activity Monitoring" which has rectified the issue. I skipped it as I couldn't see it as an option and presumed it was for a different license type. Turns out this isn't available for Sophos Central Enterprise top level and therefor has to be carried out for each and every sub-estate with a new policy so you can't use policy templates!

 

Have queried with Sophos as I don't personally fancy cloning then editing workstation and server policies for 25 sub estates...

[Sheridan]

I deployed via Solus today to 1 client and.....it worked!

 

Haven't tried to deploy to anymore than that so not sure if Solus/Sophos have updated since I last tried

[5nowman]

12 hours ago, Sheridan said:

I deployed via Solus today to 1 client and.....it worked!

 

Haven't tried to deploy to anymore than that so not sure if Solus/Sophos have updated since I last tried

I did 2  over the weekend. Never seen it install so fast.

 

Then I realised I hadn't installed sophos on those machines! FML!

 

[David44]

Is SIMS now installing without the exe file hanging for everyone else or have you just learned to live with it?

We have been deploying SIMS by launching SIMSApplicationSetup.exe (and the other exe files) and then forcing it to close after 5 minutes to get around the issue but I'd like to sort this out properly, especially for SIMS updates. Did the Sophos exceptions work for anyone in the end?

We want our users to be able to run SIMSLoad.exe to update SIMS. Currently when they do this, they see the same issue as is being reported with SOLUS, SIMSApplicationSetup.exe will launch (and get to 100%, before disappearing from the Windows task tray) but it will remain running and SIMSLoad will never move on to the next exe.

We don't use SOLUS so the only exceptions I have added to Sophos, under Endpoint Protection - Global Exclusions are the following...
C:\Program Files (x86)\SIMS\SIMS .net\

 

S:\SIMS\Setups\SIMSApplicationSetup.exe

S:\SIMS\Setups\SIMSManualSetup.exe

S:\SIMS\Setups\SIMSAMPARKSetup.exe

 

I also tried adding \\servername\capita\SIMS\Setups\SIMSApplicationSetup.exe

These changes don't seem to have made any difference, the .exe files still run successfully and then hang when they are run silently from the command line or called by SIMSLoad.exe

Is everyone running SIMS and Sophos still seeing this issue?

[5nowman]

4 minutes ago, David44 said:

Is SIMS now installing without the exe file hanging for everyone else or have you just learned to live with it?

We have been deploying SIMS by launching SIMSApplicationSetup.exe (and the other exe files) and then forcing it to close after 5 minutes to get around the issue but I'd like to sort this out properly, especially for SIMS updates. Did the Sophos exceptions work for anyone in the end?

We want our users to be able to run SIMSLoad.exe to update SIMS. Currently when they do this, they see the same issue as is being reported with SOLUS, SIMSApplicationSetup.exe will launch (and get to 100%, before disappearing from the Windows task tray) but it will remain running and SIMSLoad will never move on to the next exe.

We don't use SOLUS so the only exceptions I have added to Sophos, under Endpoint Protection - Global Exclusions are the following...
C:\Program Files (x86)\SIMS\SIMS .net\

 

S:\SIMS\Setups\SIMSApplicationSetup.exe

S:\SIMS\Setups\SIMSManualSetup.exe

S:\SIMS\Setups\SIMSAMPARKSetup.exe

 

I also tried adding \\servername\capita\SIMS\Setups\SIMSApplicationSetup.exe

These changes don't seem to have made any difference, the .exe files still run successfully and then hang when they are run silently from the command line or called by SIMSLoad.exe

Is everyone running SIMS and Sophos still seeing this issue?

 

Did you do the following in sophos too - server and workstation?:

 

AMSI Protection:

C:\ProgramData\Capita\Solus3\Deployments\
C:\ProgramData\Capita\Solus3 - Real-time only
 
Exploit Mitigation And Activity Monitoring:

C:\ProgramData\Capita\Solus3\Deployments\**

Edited December 12, 2025 by 5nowman