Change Auditor agent is not compatible with Sophos Credential Theft feature (4369253)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

Change Auditor agent is not compatible with Sophos Credential Theft feature
Description

When using Sophos Intercept X or Exploit prevention, with the option to protect again Credential Theft enabled, the Change Auditor agent service will stop a few minutes after being started.
Cause

The Credential Theft feature prevents the Change Auditor agent from injecting into LSASS properly which is a core function of the agent and results in the agent needing to shutdown.
Resolution

This is a known issue when using Sophos Intercept X or Exploit prevention the Credential Theft is turned on. As per Sophos support, the only option is to turn off this policy option:

https://support.sophos.com/support/s/article/KB-000036331?language=en_US#Change-Auditor

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title