I recently deployed the new Sophos Central Endpoint to over 300 workstations to replace our older Sophos Endpoint. Approximately 20% of the workstations failed during install and were left with these three programs listed in Programs and Features:
- Sophos AutoUpdate XG
- Sophos Endpoint Defense
- Sophos Management Communications System
When I attempt to reinstall the Sophos Central Endpoint on one of these workstations, I get the following error: You must disable Sophos Tamper Protection before you continue. Contact your administrator or see Sophos KBA 119175.
When I attempt to remove the Sophos Endpoint Defense application from Programs and Features, I get the same error. I have attempted to disable Tamper Protection through Sophos Central as well but this has no effect.
I contacted support and was referred to Sophos KBA 124377 which explains how to resolve this issue by booting into safe mode, modifying the registry to disable Sophos Endpoint Defense, and then booting back into Windows. Unfortunately, this is not a workable solution since we have over 60 affected clients all over the country. I have tried modifying the registry keys mentioned in KBA 124337 using Group Policy (both using startup scripts and using Registry Group Policy Preferences) but this has no effect because tamper protection is enabled before they run which locks down the registry keys I need to change.
Anyone have any thoughts on how I can get Sophos Central Endpoint reinstalled on these workstations without having to boot each one into safe mode and manually modifying the registry? Or how to redeploy the client to these workstations since they do have the AutoUpdate component?
This thread was automatically locked due to age.
