Invisible Device

I would suggest to follow:

Sophos Endpoint Defense: Recover a tamper protected system

to disable tamper protection then use SophosZap to remove the endpoint before re-installing.

Article Detail (sophos.com)

As a bit of background, when you run the Central installer, the computer registers with Sophos Central.  This gives the computer a unique endpoint ID and it has a tenant id which is the Central account.  They can be viewed, for example:

PS C:\> Get-Content 'C:\ProgramData\Sophos\Management Communications System\Endpoint\Persist\EndpointIdentity.txt'
12f5bb23-83ce-f441-ab79-cb1a73b3352e

PS C:\> Get-Content 'C:\ProgramData\Sophos\Management Communications System\Endpoint\Persist\CustomerIdentifier.txt'
12b90f2d-2483-4f1e-872d-34eb6df8cdeb

The URL of the device in Sophos Central is based off this EPID, e.g. For an non-server device:

https://cloud.sophos.com/manage/devices/computers/12f5bb23-83ce-f441-ab79-cb1a73b3352e/summary

If this "page" doesn't exist in the Central account either the computer was deleted or it was registered against a different account.

If in Central you to this page:

https://cloud.sophos.com/manage/account/administration/support

You should see the same UUID as in CustomerIdentifier.txt to know it is the same account the endpoint was deployed from.

If it was deleted, the report: https://cloud.sophos.com/manage/reports/deleted-devices/create should have the tamper protection password at least for 90 day after deletion.  With the password, at the endpoint you can use the local Sophos UI or run:

SEDCli -tpoff <pass>

to disable tamper protection before re-deploying or

SophosSetup -registeronly 

would do, but you could uninstall and re-install.

As a bit of background, when you run the Central installer, the computer registers with Sophos Central.  This gives the computer a unique endpoint ID and it has a tenant id which is the Central account.  They can be viewed, for example:

PS C:\> Get-Content 'C:\ProgramData\Sophos\Management Communications System\Endpoint\Persist\EndpointIdentity.txt'
12f5bb23-83ce-f441-ab79-cb1a73b3352e

PS C:\> Get-Content 'C:\ProgramData\Sophos\Management Communications System\Endpoint\Persist\CustomerIdentifier.txt'
12b90f2d-2483-4f1e-872d-34eb6df8cdeb

The URL of the device in Sophos Central is based off this EPID, e.g. For an non-server device:

https://cloud.sophos.com/manage/devices/computers/12f5bb23-83ce-f441-ab79-cb1a73b3352e/summary

If this "page" doesn't exist in the Central account either the computer was deleted or it was registered against a different account.

If in Central you to this page:

https://cloud.sophos.com/manage/account/administration/support

You should see the same UUID as in CustomerIdentifier.txt to know it is the same account the endpoint was deployed from.

If it was deleted, the report: https://cloud.sophos.com/manage/reports/deleted-devices/create should have the tamper protection password at least for 90 day after deletion.  With the password, at the endpoint you can use the local Sophos UI or run:

SEDCli -tpoff <pass>

to disable tamper protection before re-deploying or

SophosSetup -registeronly 

would do, but you could uninstall and re-install.