Return
-
Title
Defender Desktop login stops working after a recent update was applied to Sophos CredGuard on the client system -
Description
The Defender Desktop login screen will allow you to enter the username, password and passcode, however the login does not proceed beyond this point.No error message is shown.
Sophos Credguard is installed on the same client and has recently received an update. -
Cause
Sophos CredGuard is preventing Defender using the lsass.exe process -
Resolution
WORKAROUND 1:
- Exclude all One Identity folders using Sophos Policy
C:\Program Files\One Identity\Defender
%username%\AppData\Local\One Identity
ProgramData\One Identity\
WORKAROUND 2:
- For Sophos Intercept X with Credential Guard feature:
Disable the "Prevent credential theft" feature under "Protect processes" of the Threat Protection policy for Endpoint Protection. Give this a few minutes to transition to the machine, then reboot and test login again
STATUS:
Waiting for a fix in a future release of Defender.
244610: Users are not able to login to Defender Desktop Login machine due to the recent updates of Sophos Credguard
-
Change Request
244610