Hello All,
We have an interesting issue with Sophos Endpoint.
I have had a small number of users running Windows 10 where the Sophos Endpoint has not updated for months. A call was recently raised and I have been looking into this.
Out Sophos Endpoint is controlled via Sophos Cloud (Sophos Central) where we have thousands of devices and users.
Currently the Sophos client reports as status ‘unknown’ and continue to fail to update all the time.
I figured there is some kind of issue with the Sophos Client and went to remove this.
I have tried to disable tamper protection from the Sophos Cloud – This still states tamper protection is enabled.
I have used the tamper protection code to disable all services – This still fails and states Tamper protection is enabled.
I am unable to stop the Sophos services.
I attempted to edit the Registry via the following Sophos Article and it I get access denied (Only on the Sophos entries in the registry, Other entries I can edit).
https://community.sophos.com/kb/en-us/124377
I have used PSEXEC to load Regedit as the local system account using the following command
psexec -i -d -s c:\windows\regedit.exe
And I have the same issue, I can edit anything except the Sophos Entries.
I have attempted all the above as Local Admin, Domain Admin, Sophos Administrator.
I have attempted this in Safe Mode.
I have attempted this from MS:
So to summarise:
Windows 10, Any Local or Domain admin account we cannot remove Sophos. We cannot disable services or edit registry keys even as System account. We cannot take permission of Registry Entries even in safe mode.
We are stuck because we have an AV Client that does not update but we also cannot remove.
To add to this the computer have no other AV / Protection software, Fairly basic builds on a domain with MS Office.
PLEASE HELP!!!!!!!!
This thread was automatically locked due to age.
