I have further information after some investigation. We use UPM with profile streaming and active write back. Sophos is locking some of the files as they are streamed down and written to the local profile, causing significant delays to the logon process. This is visible to the end user as the logon process showing "Waiting for User profile Service" for a prolonged period. This also has knock on effects to WEM processing, which is also slower and sits at "Processing Filters" while it waits for the desktop to be ready. The resulting session also feels sluggish compared to normal. On logout, UPM cannot delete the locked files and they remain on the server. This also appears to cause the next logon to be even slower as the UPM logs indicate it is still trying to synchronize the locked files. If the user reconnects to the same server you will see a build up of profile folders in C:\Users.