Support

Fix Installation & removal issues - macOS

Articles in this section

macOS -Troubleshooting installation/upgrade issues

Avatar
Sophos Home Support
  • Updated

This article covers how to troubleshoot Sophos Home issues on macOS 11  through 14

 

TROUBLESHOOTING Post-installation (or upgrade) issues on Big Sur, Monterey, Ventura or Sonoma

Sophos Home requires 4 steps in order to run on macOS 11 and newer

1 - Enabling System Extensions
2 - Allowing Notifications *
3 - Granting Full Disk Access to components
4 - Rebooting the Mac
If any of those steps are not completed, or do not trigger, you may encounter issues.
Refer to our installation guide to ensure all steps are completed: macOS installation guide 
NOTE: Ensure no conflicting software is running during the installation. See Third Party Antivirus article 

 

Troubleshooting issues after completing the installation process

 

Updating message appears on the Sophos Home Shield

 The Updating message is informational, and will clear as soon as the update finishes. After that, you will be able to proceed with allowing notifications and completing the welcome screen popup.

 

Sophos Home Shield is Orange, yellow or red

The shield can change colors when a component/extension hasn't loaded properly, or when a significant change (such as a major update or installation) takes place. The first step to address this situation is restarting your Mac and ensuring macOS is updated to the latest version - https://support.apple.com/en-ca/HT201541 

This allows components to reload and will fix the situation in most cases. If the problem persists, follow these steps to force the system extensions to reload:

1 -Check if system extensions need to be allowed

There are 2 System Extensions for macOS: SophosScanD and Sophos Network Extension They both need to be allowed (sometimes one at a time, in between reboots), in order to fully load all components.

Video Steps

macOS Ventura and later steps 

If you haven't received the popups, navigate to > System Settings > Privacy & Security

Step-by-step-guide

  1. Click on the Apple menu from the taskbar then select  System Preferences…OR > System Settings > Privacy & Security (Ventura/Sonoma)
  2. Select Security & Privacy > General  OR scroll down until you find Security (Ventura/Sonoma)
    NOTE: If using macOS versions before Ventura click on the padlock to make changes
  3. Ensure "App Store and identified developers" option is selected under "Allow apps downloaded from" 
  4. You will see either "Details..." if more than one extension needs to be allowed, or "Allow"

    mceclip0.png mceclip1.png
    (Images are illustrative, your Mac might display this differently, but the content will be the same)
  5. Checkmark/click each extension to enable them (checkmarks or sliders will be present)
  6. Restart your Mac
     

2 -If no extensions are listed - Reload them- Video steps

Follow the video steps to force the system extensions to reload, then go back to step 1 to allow them as needed.

2.1 Step-by-step -Reload system extensions

Follow the steps to force the system extensions to reload, then go back to step 1 to allow them as needed.

  • Open Finder (Note: This requires Finder, no other interface will work.)
  • At the top menu, click Go > Go to folder...
  • You will be accessing 2 locations and moving 2 files to the Trash:

    First location (network extension)
    1. Navigate to:/Applications/Sophos/Sophos Network Extension.app/Contents/MacOS/
    2. Right-click Sophos Network Extension.app and select Move to Trash.

    Second location (scan extension)
    1. Navigate to: /Applications/Sophos/Sophos Scan.app/Contents/MacOS/
    2. Right-click SophosScanD.app and select Move to Trash.

  • NOTE: When moving the apps to the trash, the mac will prompt a message stating you’re removing a system extension, and it may be loaded. Click Continue and authenticate as prompted.
  • After having moved both extensions to the Trash:
  • Click the Trash icon in the lower right of your Mac screen.
  • Locate SophosScanD and Sophos Network Extension.app 
  • Right-click each extension and select Put Back.
  • Restart the mac and follow the prompts to re-allow the system extensions.

 

Scan aborted OR Action Required! appears on the shield

These messages appear when the scan component is not loaded.
To address them, ensure you are running the latest version of your macOS system, then reboot your Mac. If the problems persist after updating your mac and rebooting, follow these steps:

1 -Check if system extensions need to be allowed

There are 2 System Extensions for macOS : SophosScanD and Sophos Network Extension They both need to be allowed (sometimes one at a time, in between reboots), in order to fully load all components.

 

Video Steps

macOS Ventura and later steps 

If you haven't received the popups, navigate to > System Settings > Privacy & Security

Step-by-step-guide

  1. Click on the Apple menu from the taskbar then select  System Preferences…OR > System Settings > Privacy & Security (Ventura/Sonoma)
  2. Select Security & Privacy > General  OR scroll down until you find Security (Ventura/Sonoma)
    NOTE: If using macOS versions before Ventura click on the padlock to make changes
  3. Ensure "App Store and identified developers" option is selected under "Allow apps downloaded from" 
  4. Ensure "App Store and identified developers" option is selected under "Allow apps downloaded from" 
  5. You will see either "Details..." if more than one extension needs to be allowed, or "Allow"

    mceclip0.png mceclip1.png
    (Images are illustrative, your Mac might display this differently, but the content will be the same)
  6. Checkmark/click each extension to enable them (checkmarks or sliders will be present)
  7. Restart your Mac

2 -If no extensions are listed - Re-trigger them- Video steps

Allowing system extensions after restarting

macOS Ventura and later steps  

If you haven't received the popups, navigate to > System Settings > Privacy & Security

2.1 Step-by-step -Re-triggering prompts for system extensions

Follow the steps to force the system extensions to reload

  1. Open Finder (Note: This requires Finder, no other interface will work.)
  2. At the top menu, click Go > Go to folder...
  3. Navigate to  
    • /Applications/Sophos/Sophos Network Extension.app/Contents/MacOS/
    • Follow step 4
    • /Applications/Sophos/Sophos Scan.app/Contents/MacOS/
    • Follow step 4, then proceed with the rest of steps
  4. Right-click Sophos Network Extension.app / SophosScanD.app and select Move to Trash.
  5. The system may prompt that you’re removing a system extension, and it may be loaded. Click Continue if this appears, and authenticate as prompted.
  6. Click the Trash icon in the lower right of the screen.
  7. Find the files you just moved to Trash.
  8. Right-click on each file and select Put Back.
  9. Restart the mac and follow the on-screen message to allow the extensions

 

Welcome to Sophos Screen keeps appearing on reboot

The Welcome to Sophos popup appears when there are missing items under the Full Disk Access list. Follow the troubleshooting video/steps below to address this situation.

macOS Ventura users will see an additional trigger of Welcome to Sophos after upgrading, as it is required to address an Apple bug. Please see Sophos Home macOS Ventura Support 

 

Video Steps

The video is broken down into 3 parts - Be sure to restart the computer before and after completing each section of the steps. 
Part 1- Resolving the Welcome to Sophos Home window
Part 2- Allowing extensions
Part 3 -Adding missing components 

macOS Ventura steps  

older versions of macOS

Step-by-Step guide

 

Part 1- Resolving the Welcome to Sophos Home window

      1 - Click on Let's Start 
      2- Use the "Click here" button to access Full Disk Access
      3 - Unlock the padlock in Security & Privacy | Ventura scroll down to Full Disk Access
      4- Drag and drop the icons from the Welcome to Sophos Home window into the Full Disk Access list
      5 - Ensure all the components added have been checked-marked/slider enabled
      6 - Restart your computer     

Part 2 -Allowing extensions

Step-by-step-guide
  1. Click on the Apple menu from the taskbar then select  System Preferences…OR > System Settings > Privacy & Security (Ventura/Sonoma)
  2. Select Security & Privacy > General  OR scroll down until you find Security (Ventura/Sonoma)
    NOTE: If using macOS versions before Ventura click on the padlock to make changes
  3. Ensure "App Store and identified developers" option is selected under "Allow apps downloaded from" 
  4. Ensure "App Store and identified developers" option is selected under "Allow apps downloaded from" 
  5. You will see either "Details..." if more than one extension needs to be allowed, or "Allow"

    mceclip0.png mceclip1.png
    (Images are illustrative, your Mac might display this differently, but the content will be the same)
  6. Checkmark/click each extension to enable them (checkmarks or sliders will be present)
  7. Restart your Mac

Part 3- Adding missing components to Full Disk Access

***BEFORE YOU PROCEED***
You will not be able to perform these steps until Sophos Home has fully upgraded (wait for the Updating... message to clear).  A reboot is necessary after the installation in order to load the needed extensions. 
If an extension is already listed in the Full Disk Access, you DO NOT need to add it again, instead, ensure they are check-marked/slider enabled

1 -Click on the Apple logo -> System Preferences-> Security & Privacy 
2- Scroll down to locate Full Disk Access 3 - Unlock the padlock, then click "+" to add applications 4 - Search for the following, one at a time, and click Open for each

com.sophos.endpoint.scanextension.systemextension
[^^This may show as SophosScan instead]
Sophos Network Extension
Sophos Diagnostic Utility
SophosScanAgent
SophosCleanD
SophosServiceManager

5 - Restart the mac after adding all the components, to allow them to load

6. If you have followed all of the troubleshooting steps, but still have the same issues, please re-install Sophos Home. 

 

Related articles
Installing Sophos Home on M1 (Silicon) Mac computers 

 

 

How to remove Sophos system extensions

 

  1. Disable system integrity protection (this will let us make adjustments to Sophos extension in later steps) Note for the video below: If you are using a Mac with Apple silicon, you will need to continue to hold the power button down while starting the computer until the options window appears to access recovery mode.

    Text instructions for disabling System Integrity Protection can be found here
  2. Restart your mac and Uninstall Sophos Home
  3. Restart once more to ensure all components are properly unloaded
  4. After the reboot open up the terminal (it’s in the utilities folder of your applications) and type in each of the following commands (without quotes), pressing enter after each one:
    "sudo systemextensionsctl uninstall 2H5GFH3774 com.sophos.endpoint.scanextension"

    "sudo systemextensionsctl uninstall 2H5GFH3774  com.sophos.endpoint.networkextension"

  5. Restart your mac

  6. Re-enable system integrity protection

 

Related information

Re-install Sophos Home 

Related articles