hmpalertsvc has an unquoted service path with a space in it.

I haven't tested with Hitman...but you can try this 

SC CONFIG YourServiceName binPath="C:\SomeDirectory\YourFile.EXE"

Access is denied using that command as Sophos Intercept X is blocking changes.

Did you disable Tamper Protection?

Did you disable Tamper Protection?

Yes, but I have 125 systems impacted. I do not want to have manually disable tamper protect on all of them. Is there any method schedule tamper protect to be disabled? If there is I have a script I can schedule to make the registry change.

In that case you could disable TP from the Central Console. I am pretty sure you can do that in bulk. If not, my next choice would be the API.

That is information I needed. I found the tamper control on/off switch for all endpoints. I can disable, run push the change out and then re-enable. Thank you.

Happy to help!