Plan and troubleshoot Sophos Endpoint scans

Real-time Scanning remains the primary continuous control: it checks files when they are accessed or changed. A scheduled or manually triggered scan examines data that is already present. It is most useful for older, rarely accessed files and for a focused security investigation. Running a full scan of every device every day is not a replacement for real-time protection and can create unnecessary load.

There are two distinct workflows. Scheduled Scanning is configured persistently in a Threat Protection Policy, while Scan sends a one-time request to one computer. The Fusion scan action does not offer a choice of Quick Scan, Full Scan, folder, or drive. If you need a precise Windows scope or machine-readable results, use the Sophos Endpoint Scan CLI instead of duplicating its command details here.

Check the prerequisites

• The computer is visible in My Environment > Computers & Servers, and its Sophos Endpoint agent communicates with Fusion. An old Last active value is a communication issue to resolve before treating it as a scan failure.
• A schedule requires an enabled Threat Protection Policy that applies to the intended computer group. If necessary, verify assignment and precedence with the Sophos Fusion Endpoint policies guide.
• The schedule follows the endpoint computer’s local time, not UTC or the administrator’s time zone.
• Scheduled Scanning runs only when the computer is online at the scheduled time. A missed run is not caught up. In contrast, a Fusion on-demand scan requested while the computer is offline runs when it comes back online.
• The Fusion Scan action is unavailable on devices that use Sophos XDR Sensor.

Configure Scheduled Scanning in the policy

The exact current English Fusion path is My Products > Endpoint > Policies.

1. Create a Threat Protection policy, or open an existing policy for the pilot group.
2. Open Settings and make sure that the policy is turned on.
3. Find Scheduled Scanning and turn on Enable scheduled scan.
4. Select the time and one or more days. Choose a time when the pilot devices are likely to be powered on but not heavily used.
5. Turn on Enable deep scanning only for a defined need. It includes archives in scheduled scans and can make scanning significantly slower while increasing system load.
6. Save the policy and confirm that it is assigned to the intended pilot group.

Sophos states that Scheduled Scanning may not be needed when Real-time Scanning is on. Start with the purpose rather than the most aggressive schedule: checking rarely accessed legacy data, supporting an investigation, or meeting an internal control requirement. Background scanning is available only for Windows computers, so do not plan macOS devices around a Windows-only capability.

Scan one computer from Fusion

For a one-time administrative request, the current path is:

1. Go to My Environment > Computers & Servers.
2. Click the computer name and open Summary.
3. At the top, click Scan directly.

You can alternatively reach the computer under My Products > Endpoint > Computers. If the device is offline, the request remains pending until it returns online. If a scan is already running, the endpoint ignores the new request and continues the earlier scan. Repeated clicks therefore do not build a queue of additional scans.

This action is appropriate for a quick central check of a particular device. For a specific folder or drive, automation, or structured exit codes, use the separate CLI guide.

Pilot before broad rollout

A useful pilot group includes more than fast standard laptops. Include a frequently offline device, a computer with a large data set, and, where relevant, a developer or build workstation. This exposes schedule misses and noticeable load before the policy reaches a broad population.

1. Record the purpose, target group, days, and local start time.
2. Start without Enable deep scanning unless archives are explicitly in scope.
3. Observe at least one complete scheduled run and one deliberately missed time.
4. Compare user impact, duration, and events. Change only one variable at a time.
5. Expand the assignment only when the acceptance criteria are met.

A missed Scheduled Scan is not a reason to disable protection options globally. A more realistic time or an additional weekday is usually better for mobile devices. Sophos recommends off-peak hours to minimize the impact on system load.

Validate the result in Fusion

Go to Reports > Logs > General logs > Events. After a centrally requested scan, a Scan completed event should appear there. Successful cleanup events also appear in the event log. Alerts for unsuccessful cleanup appear under My Environment > Alerts.

For a scheduled scan, check the following for the same time period:

• whether the device was online at its local scheduled time;
• whether the expected Threat Protection Policy was effective;
• whether there is a completion, detection, cleanup, or missed-scan event;
• whether the endpoint still reports healthy protection and recent Fusion contact afterward.

Completion without a detection means that this scan finished. It does not prove that inaccessible or encrypted content was scanned, and it does not close an incident by itself. Effective scanning exclusions still apply and must be assessed separately during an investigation.

Troubleshoot by symptom

The scheduled scan did not run

Check Last active first and compare the computer’s local time with the time selected under Scheduled Scanning. If the device was offline, a missed-scan event is the expected explanation, and the scan does not start when the device is powered on later. If it was online, next confirm that the policy was enabled, assigned to the device, and already received by the endpoint. Only then change the schedule or policy.

Scan appears to do nothing

An offline computer waits for its next connection. If a scan is already running, the new request is ignored. Check Last active, the event timestamp, and any earlier scan before sending the request again. If Scan is absent entirely, check whether the computer uses Sophos XDR Sensor.

The scan takes unusually long

Check whether Enable deep scanning is on and whether the data set contains large archives. Compare the run with system load and storage activity during the same period, and move it to a quieter local time if appropriate. Change one pilot setting at a time. An organization-wide exclusion or weaker protection configuration is not a sound response to one slow device.

A threat is found or cleanup fails

Open the event and alert before excluding the detected file. For a detection, follow the Threat Cleanup runbook. An exclusion is appropriate only after a confirmed false positive and with the narrowest practical scope.

Fusion is current, but no local scan starts

If policy, connectivity, and the request are correct but completion never appears, check the local health state and installed Core Agent version. Collect logs with Summary > More actions > Diagnose, which runs Sophos Diagnostic Utility, and correlate the first error with the requested start time. Historical File Scanner issues have included version-specific and Windows-permission causes. Do not grant broad Full Control registry or GPO permissions as a generic fix. Update the agent to a current supported version first, and make ACL changes only from a current Sophos KBA that matches the log signature or with Sophos Support.

Frequently asked questions