Last Sophos Central Activity Shows 2 Months ago

Hi Krishna,

If the machine last contacted central/did update 30+ days ago, we usually recommend uninstall>reinstall.

What's the OS of that machine? are you getting Failed to Install SME64 : general error on that as well?

For now, try these steps. if it won't work then we really need to do reinstall:

Disable tamper protection on the machine.

Redownload sophos installer and save it to your C:\

Then open cmd as admin>cd to C:\ then type
SophosSetup.exe --registeronly

Regards,

Fernan Tutor

If this post solves your question, please use the "Verify Answer" button.

Thank you for the Answer , Its windows 10 and windows 8.1 pro OS both im getting this issue, Yes i Know reinstall will solve this issue but i thought someone found a solution without reinstalling it as i am getting this issue often in few systems. Anyways Thank You Fernan..

Yes as you said i will try and update you.

Hello Krishna,

If the issue still persist, You can stop and start MSC Agent and client services by navigating to services.msc. Ensure that TP is disabled before performing the said steps. Also please share the latest logs under C:\ProgramData\Sophos\Management Communications System\Endpoint\Logs for MCS Client and MCS agent.

Ok Will check that too and update you Glenn

Fernan and Glenn both of you instructed to disabled TP but its already disabled in central but its not disabling in client system, How to disable TP is any other option to disable it then only i can perform your steps.

Hello Krishna,

Have you tried manually putting the TP password by clicking "Admin Sign-in"? If not? then you may input it manually and disable tamper protection on UI. Or you can use SEDcli.exe by following the steps listed in this article. 

Yes i tried to disabled by inputting Password manually that also not working..

I tried your step but its shows incorrect password Pls check and suggest me any other steps to do to disable TP.

Central Password for your reference:

Thank you for sharing this, you may proceed with booting this system through safe mode and disable tamper protection. Once turned off. Download the latest installed on your central and open cmd as admin>cd to (point the path where the package is saved) SophosSetup.exe --registeronly

Glenn,

I cant able to disable TP from safe mode .. is there any other way or can you share me the steps to do it so that i can try..

or i need to do the following from the link https://support.sophos.com/support/s/article/KB-000036125?language=en_US

suggest me..

Awaiting solution for the same 

Hi Krishnakumar G

The steps below is my own personal work around. Feel free to try it if you have time.

If disabling tamper protection via safemode won't work for you, then please try this now step by step:
Open this kb:
support.sophos.com/.../KB-000038989
-> download sophoszap and paste it on your C:\ drive

Reboot the machine in safemode with command promt then type this:
REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config" /t REG_DWORD /v SEDEnabled /d 0 /f

After disabling tamper, cd to C:\ then type SophosZap --confirm. It should show reboot and re-execute if success. Reboot back in safemode with command prompt again and do SophosZap --confirm
If success, reboot back in normal mode. Sophos should now be removed on the machine.

This is my ultimate step already. If that won't work for you, then we need now to slave the drive to another machine and edit the registry from there to disable tamper.

Regards,

Fernan Tutor

Hi Krishnakumar G

The steps below is my own personal work around. Feel free to try it if you have time.

If disabling tamper protection via safemode won't work for you, then please try this now step by step:
Open this kb:
support.sophos.com/.../KB-000038989
-> download sophoszap and paste it on your C:\ drive

Reboot the machine in safemode with command promt then type this:
REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config" /t REG_DWORD /v SEDEnabled /d 0 /f

After disabling tamper, cd to C:\ then type SophosZap --confirm. It should show reboot and re-execute if success. Reboot back in safemode with command prompt again and do SophosZap --confirm
If success, reboot back in normal mode. Sophos should now be removed on the machine.

This is my ultimate step already. If that won't work for you, then we need now to slave the drive to another machine and edit the registry from there to disable tamper.

Regards,

Fernan Tutor