How to manually disable Tamper Protection

Hello Jeff Pascone 

We appreciate your reaching out to the Sophos Community Forum.

If you can't find the tamper protection password in Sophos Central, you can use the tamper protection password recovery option. Please refer to this article for a step-by-step process: https://support.sophos.com/support/s/article/KB-000036125?language=en_US.

Note: You must follow the recovery steps in recovery mode, not safe mode. 

In addition, you can try this article to manage the tamper protection locally on the device: https://support.sophos.com/support/s/article/KB-000043008?language=en_US.

Let me know how it goes. 

Regards,

Hello Jeff Pascone 

We appreciate your reaching out to the Sophos Community Forum.

If you can't find the tamper protection password in Sophos Central, you can use the tamper protection password recovery option. Please refer to this article for a step-by-step process: https://support.sophos.com/support/s/article/KB-000036125?language=en_US.

Note: You must follow the recovery steps in recovery mode, not safe mode. 

In addition, you can try this article to manage the tamper protection locally on the device: https://support.sophos.com/support/s/article/KB-000043008?language=en_US.

Let me know how it goes. 

Regards,

Rutvik, I have been tried the step by step twice and followed the directions to a T. I get to this step:

Type ren SophosED.sys SophosED.sys.old and press

And it does not let me rename the file.

Thanks,

Jeffrey

I have also tried the article to manage the TP but get stuck at this step:

-OverrideTPoff password

Because I have no password.

Thanks,

Jeffrey

Can you confirm that you are in the Windows recovery environment when you are running this command? 

Are you seeing an "Access Denied" or "File not found"?

Hello Qoosh!

I am booting into Windows recovery mode.  I am getting an Access Denied message when trying to rename SophosED.sys

Hello Jeff,

Thank you for your response. 

Can you confirm if the C:\ drive hard disk volume name differs from the source? You can follow the steps in this KB article and apply changes if it's confirmed that the C:\ drive uses a different Volume name.