Invisible Device

Question

Hello Guys, 
 
 I'm experiencing some issues with computers that have Intercept X intalled and updated, but that don't appear on Sophos Central. 
 
 I can't remove cause of Tamper Protection and can't add manually to Central. 
 
 What can i do? 
 
 Right now i'm removing manually the Sophos files on C:\, but this is awfull. 
 
 Best Regards,

Sophos User930 · Accepted Answer

As a bit of background, when you run the Central installer, the computer registers with Sophos Central. This gives the computer a unique endpoint ID and it has a tenant id which is the Central account. They can be viewed, for example: 
 PS C:\> Get-Content 'C:\ProgramData\Sophos\Management Communications System\Endpoint\Persist\EndpointIdentity.txt' 12f5bb23-83ce-f441-ab79-cb1a73b3352e PS C:\> Get-Content 'C:\ProgramData\Sophos\Management Communications System\Endpoint\Persist\CustomerIdentifier.txt' 12b90f2d-2483-4f1e-872d-34eb6df8cdeb 
 The URL of the device in Sophos Central is based off this EPID, e.g. For an non-server device: 
 https://cloud.sophos.com/manage/devices/computers/ 12f5bb23-83ce-f441-ab79-cb1a73b3352e /summary 
 If this "page" doesn't exist in the Central account either the computer was deleted or it was registered against a different account. 
 If in Central you to this page: 
 https://cloud.sophos.com/manage/account/administration/support 
 You should see the same UUID as in CustomerIdentifier.txt to know it is the same account the endpoint was deployed from. 
 If it was deleted, the report: https://cloud.sophos.com/manage/reports/deleted-devices/create should have the tamper protection password at least for 90 day after deletion. With the password, at the endpoint you can use the local Sophos UI or run: 
 SEDCli -tpoff <pass> 
 to disable tamper protection before re-deploying or 
 SophosSetup -registeronly would do, but you could uninstall and re-install.

Invisible Device

Top Replies