Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 11 replies
  • Answers 2 answers
  • Subscribers 15 subscribers
  • Views 55437 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos central - How to Recover/undelete a deleted computer from Manage protection field

shane kelm

Hello, 

I deleted a computer from the Manage Protection field before attempting to uninstall Sophos Endpoint from a clients workstation. Too make matters harder I did not know the Sophos Central computer name held a specific Tamperproof password before uninstalling the application from the workstation.

I have attempted a uninstall - fail need Tamperproof password

Tried options (neither worked) from https://community.sophos.com/kb/en-us/122126 and https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/5972/restoring-a-computer-after-accidental-removal-from-enterprise-console

 

Oh! we are not using Active Directory sync

 

Shane



This thread was automatically locked due to age.
Parents
  • 0

    HI shane,

    You would need to disable the Tamper Protection and also change the MS Agent in Safe Mode and then reboot with Normal mode and uninstall from control panel 

    To recover a tamper protected system, you must disable Enhanced Tamper Protection.
    Do the following:

    1. Boot the system into Safe Mode.
    2. Click Start > Run and type regedit and then click OK.
    3. Go to the following location in the registry editor:
       HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent and set the REG_DWORD Start to 0x00000004
    4. Go to the following location in the registry editor:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config
    5. Set the following DWORD values to 0: SAVEnabled and SEDEnabled
    6. Reboot the system in normal mode.

    Taken from Article 124377

    Thanks and Regards

    Aditya Patel | Network and Security Engineer.

    Regards,

    Aditya Patel
    Global Escalation Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Aditya Patel

    Hi Aditya,

      Do you have the steps for a Mac user with the same problem?

    Thx, Owen

  • 0 in reply to Owen Lewis

    Hi Owen, 

    I have private message you the steps 

    Thanks and regards

    Aditya Patel

    Regards,

    Aditya Patel
    Global Escalation Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

Reply Children
Unfiltered HTML