Sophos endpoint reinstall remotely

Hi Sophos User1878 

Unfortunately, it is not possible to re-install the from Sophos central, however please check this article to uninstall using a batch file, and then you can install the same by pushing the client via SCCM. 

You can also use the Sophos ZAP tool to completely uninstall. 

Is there a way to bulk turn off tamper protection? 

Hi Sophos User1878 

If you want to disable for all endpoints you can click on Global settings> General> Tamper protection. Please check this article for more information. 

You can also use Sophos Central APIs to enable/disable Tamper Protection for a list of endpoints.

For a scenario like this, personally I would try identifying the cause of the issue and find steps to resolve it as this may be more easily scaled.  If this proves too challenging or time consuming I would fall back to the uninstall/reinstall for a clean slate fix.  What is the error that you see on the endpoints?  Is there any fail or error messages in C:\ProgramData\Sophos\AutoUpdate\logs\SophosUpdate.log?  If it references a failed product install/uninstall, is there any fail, error, or "return value 3"s in that log file located in C:\Windows\Temp\?

You may not need to uninstall/reinstall.  Try disabling Tamper Protection on a device and then run the installer in registration mode.

SophosSetup.exe --registeronly

That will re-register the device with Central without the need to uninstall and reinstall.

It's worth a shot.

Joe

As long as AutoUpdate is functioning, there isn't much advantage to redeploying to fix failing components as AutoUpdate will attempt to re-install them anyway.

If you delete:
\Programdata\Sophos\AutoUpdate\data\status\SophosUpdateStatus.xml
then AutoUpdate will run the setup plugins of each component.  

If you just want to force one component to re-install you can change the installedThumbprint entry for the component in the XML to be empty, e.g. "" rather than a number such as "95fd5b947d7c1495240f9e8a6d11ee4b50b73eb3a4be05e17359d8a3216925f3".

For any failing component, AutoUpdate will be trying to install it anyway. 

You can force an update as detailed here:

https://community.sophos.com/products/intercept/early-access-program/f/live-discover-response-queries/120147/live-response---force-an-update-from-the-command-line-and-checking-status

This post also details the above information as well.

If an component is failing to install, then the logs will be under \windows\temp\ if AutoUpdate is failing to install it.  That is the best place to start

Jak