Sophos Tamper Protection is not enough

Question

Hi,

i have a question about the Tamper Protection.

It is a nice feature to prevent user from killing the On-Access security, but they are all still capable to set Exceptions on folders, files or whole drives....

Is there a chance for usn to prevent users from adding these exclusions to the local client installation?

This thread was automatically locked due to age.

FiberOptck · Accepted Answer

Tamper protection enables you to prevent unauthorized users (users with limited technical knowledge) and known malware from uninstalling Sophos security software or disabling it through the Sophos Endpoint Security and Control interface.

Tamper protection does not affect members of the SophosUser and SophosPowerUser groups. When tamper protection is enabled, they will be able to perform all tasks that they are usually authorized to perform, without the need to enter the tamper protection password. You should be able to change the policies which could change how users control the protection.

example:

Windows group Sophos group

Administrators	SophosAdministrator
Power Users	SophosPowerUser
Users	SophosUser