"Sorry, access to this computer is locked" with no recovery option.

Question

Here in the last week or so, I've gotten four tablet PCs with the same Sophos SafeGuard error which I cannot seem to replicate. Basically, what happens is it boots up, goes through the SafeGuard auto-boot process, which does not give any errors and just continues as normal, and boots up to the Windows XP login screen. Upon pressing Ctrl+Alt+Delete to login, Sophos SafeGaurd comes up with an error that says "Sorry, access to this computer is locked" and the only option is to shut it down.

Normally when our devices gets locked out, it boots up to the sophos startup and gives us the option to recover, (which as I understand is the normal recovery process?). Checking the status of these devices on the server, there is nothing on there that would alarm me to think that something is wrong with these devices. When trying to force the recovery process from the server to the device, nothing happens and the process explained above continues over.

These devices are Lenovo ThinkPad x201 tablets running Windows XP Tablet PC Edition. Any ideas or recommendations?

This thread was automatically locked due to age.

_JOEL_ · Accepted Answer

I had this issue and was able to fix with support from Sophos. Basically you got a corrupted install, my issue was because part of SGN got put on a dirty part of the filesystem. Make sure to verify your HDD with the manyfacturers tools and run a boot time 5 stage checkdisk with chkdsk /r to clean up the filesystem.

Here is the emergency removal instructions:

* boot into Safe Mode
* add following registry entries:
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer - change "Default" REG_SZ value to "Service"
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SGN_BEService - change "Default" REG_SZ value to "Service"
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BEDevctl - change "Default" REG_SZ value to "Service"
* close Registry Editor
* from command prompt run following commands:
* net start MSIServer
* net start SGN_BEService
* net start BEDevctl
* remove Safeguard Client from Add/Remove Programs
* on encrypted system - if you want to check decryption process, manualy start: C:\Windows\System32\be_encvExe.exe
* once decryption/deinstallation has finished, please reboot
* on next restart you will see a blue Windows installer screen with information: Starting SG Base Encryption Kernel deinstallation. Please wait... Release all allocated areas on disk. Process completed. Result OK.

Hope this helps.