Intercept X Endpoint Sysprep

Hi There,

Thank you for reaching us. On the script, you use in performing gold image. Did you turn off/disable tamper protection on it? 

Refer to sample script.

"C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe" -TPoff 216278579655

SC STOP "Sophos MCS Client"

SC CONFIG "Sophos MCS Client" start= delayed-auto

SC STOP "Sophos Managed Threat Response"

SC CONFIG "Sophos Managed Threat Response" start= delayed-auto

pause

Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Persist\Credentials" /q

Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Persist\EndpointIdentity.txt" /q

Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Persist\*.xml" /q

Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Cache\*.status" /q

Del "%ProgramData%\Sophos\AutoUpdate\data\machine_ID.txt" /q

Del "%ProgramData%\Sophos\Managed Threat Response\data\osquery.db\*" /q

Del "%ProgramData%\Sophos\Managed Threat Response\config\policy.xml" /q

Echo [McsClient] > "%ProgramData%\Sophos\Management Communications System\Endpoint\Config\registration.txt"

Echo Token=(Token here) >> "%ProgramData%\Sophos\Management Communications System\Endpoint\Config\registration.txt"

"C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe" -TPon

If so? You can turn off tamper protection and try again.


Also can you confirm if the master image boots successfully before deployment? 

Hi There,

Thank you for reaching us. On the script, you use in performing gold image. Did you turn off/disable tamper protection on it? 

Refer to sample script.

"C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe" -TPoff 216278579655

SC STOP "Sophos MCS Client"

SC CONFIG "Sophos MCS Client" start= delayed-auto

SC STOP "Sophos Managed Threat Response"

SC CONFIG "Sophos Managed Threat Response" start= delayed-auto

pause

Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Persist\Credentials" /q

Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Persist\EndpointIdentity.txt" /q

Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Persist\*.xml" /q

Del "%ProgramData%\Sophos\Management Communications System\Endpoint\Cache\*.status" /q

Del "%ProgramData%\Sophos\AutoUpdate\data\machine_ID.txt" /q

Del "%ProgramData%\Sophos\Managed Threat Response\data\osquery.db\*" /q

Del "%ProgramData%\Sophos\Managed Threat Response\config\policy.xml" /q

Echo [McsClient] > "%ProgramData%\Sophos\Management Communications System\Endpoint\Config\registration.txt"

Echo Token=(Token here) >> "%ProgramData%\Sophos\Management Communications System\Endpoint\Config\registration.txt"

"C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe" -TPon

If so? You can turn off tamper protection and try again.


Also can you confirm if the master image boots successfully before deployment? 

Yes, the tamper protection is disabled via the script and the master image boots successfully without sophos.

In the script the tamper protection is first disabled an then re-enabled again. So that ist the problem. I deleted this line from the script:

"C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe" -TPon

Now it works.

Regards

Kaan

Hello Kaan,

Thank you for your confirmation. I'm Glad to hear that you're able to make it work now. If you encounter any issues related to our product please feel free to reach us.