yettoasty

Hi - Defender for EndPoint it's running in Passive Mode when Sophos is installed. There is some confusing conflicting documentation by Microsoft on how Defender should behave when a third-party AV is installed, but have just gone through disabling Defender for a test machine, so will see if that helps... Curious to know what 'malware' found, if anything, to improve, as his symptoms are very similar to ours currently. Thanks for the suggestion 'DarkMaster', will see if disabling Defender helps (AMRunningMode = Not Running)

We are currently scratching our heads with this exact issue! Sophos and Windows 11 23H2… Moving OUs, or running GP update seems to fix, for a while… it’s totally random PCs across our estate, all new Dell Optiplex 7020s. Did you ever get anywhere with your investigations and manage to resolve?

We have made some changes to how profiles work at our school, moving away from Roaming user profiles to Local user profiles. We have a GPO set to delete the local profiles older than 3 days for both staff and students. We also have Folder Redirection setup for Documents, Music, Pictures, Desktop, etc. as well as the 'HomeDrive' field in AD completed, which should map a U: drive within their file explorer. Since moving from Roaming Profiles to Local Profiles, we have seen a number of students when logging in are not getting their Documents Redirected nor the U: drive mapped correctly, with event viewer on their machine showing failed to apply policy and redirect folder "documents" to "%HOMESHARE%\Users\studentusernameError details: "The specificed path is invalid" Sometimes, restarting the PC fixes the problem, moving to another PC also sometimes resolves the problem. We think it's something to do with the local profiles on the machines, and perhaps when a profile exists on a PC they're trying to login to it errors, but when logging into a PC without any existing profile, it works, though there are some occasions that students have issues that don't end up matching with this theory, so at a bit of a loss. Has anyone else seen this issue, or perhaps have any suggestions on what may be causing the problem and where I can look next? Cheers.