This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

turn off tamper protection via terminal on mac

Sophos User1175 10 months ago

hi all,

i know you can turn off tamper protection on pc via cmd via the SEDcli.exe command

C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe -OverrideTPoff password

is there anyway to do this on mac via terminal?

thanks,

rob

This thread was automatically locked due to age.

Parents

0 Gladys 10 months ago

Hi Sophos User1175 ,

Thank you for reaching out to the Sophos Community forum.

May I know what's the macOS version running on your device? Are you trying to turn off the tamper protection to uninstall the endpoint?

Gladys Reyes

Global Community Support Engineer
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Sophos User1175 10 months ago in reply to Gladys

thank you Gladys its macOS monterey and above
Cancel
Vote Up 0 Vote Down

Cancel
0 Gladys 10 months ago in reply to Sophos User1175

Hi Sophos User1175 ,

Upon checking, there's no way to turn off the Tamper Protection via the terminal. However, if you would like to remove the Sophos endpoint without turning off the TP, then you may check out the provided answers in this thread - community.sophos.com/.../uninstall-sophos-in-mac-without-tamper-protection-password

Gladys Reyes

Global Community Support Engineer
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 1TruBob 8 months ago in reply to Gladys

Gladys - this process worked for me a couple weeks ago, but today the "sudo rm" commands all return "Operation not permitted". The installed Sophos version is 2024.1.0.49 and I've reproduced this on both MacOS 13.6.1 and 14.3.1

Can you provide an update?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 1TruBob 8 months ago in reply to Gladys

Gladys - this process worked for me a couple weeks ago, but today the "sudo rm" commands all return "Operation not permitted". The installed Sophos version is 2024.1.0.49 and I've reproduced this on both MacOS 13.6.1 and 14.3.1

Can you provide an update?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Qoosh 8 months ago in reply to 1TruBob

As of version 2024.1 and later, Tamper Protection can only be disabled from Sophos Central or using the "Admin Login" option on the local Endpoint UI. If your situation is urgent, I'd suggest calling Sophos Support using the regional phone numbers on the following page.
- Sophos Contact Support

If the device has been deleted or is no longer present in Sophos Central, you can find the password from the "Recover tamper protection passwords" page.

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 1TruBob 8 months ago in reply to Qoosh

That really doesn't help. We keep finding Macs where Sophos is installed and TP is enabled, but they're not registered with our tenant. So there's no password in the tenant for us to recover. They were installed with the correct installer from our tenant but the registration went wrong somehow, and we only find this out when there's a problem much later.
Cancel
Vote Up 0 Vote Down

Cancel