Just wrapped up a stressful Friday thanks to a classic "security vs. operations" clash with Intercept X. Wanted to share our experience so others can check their setups.
We rolled out the **Server Lockdown** feature on a handful of critical application servers last week. The idea was great—dramatically reduce the attack surface by preventing unauthorized executables. Our testing seemed fine, but we missed one crucial scheduled task: a legacy backup job that uses a small `.exe` to trigger the archive process. It’s been running for years without issue.
Come backup window, complete failure. The logs showed "Access Denied" but the real clue was in the **Sophos Central Event Log**: "Blocked by Server Lockdown - Path not authorized." The backup executable, living in `D:BackupTools`, wasn't in the allowed list. The lockdown feature is *really* strict—it doesn't just watch `C:Program Files`.
**Our quick migration-warrior checklist to fix this:**
* Immediately added the backup tool's directory to the Server Lockdown allowed list in the policy.
* Created an IT process to **audit all scheduled tasks and services** on any server before enabling Lockdown. Look for scripts, old utilities, anything that fires off an `.exe` or `.dll`.
* Realized we need to treat the allowed list like a migration cutover plan—every item is a dependency.
Has anyone else run into similar issues with whitelisting features breaking automated jobs? What’s your process for discovering these hidden dependencies before locking things down?