Sophos Central Windows Endpoint: RE-register a device on Sophos central without reinstalling when accidentally deleted from the dashboard

Disclaimer: This information is provided as-is and should be referenced at your own risk.

---

Hi Everyone,

There are many instances when the user accidentally deletes the device from the central dashboard, and the machine has Sophos endpoint installed. However, it does not report to the central dashboard.

Deleting the device from the Sophos central dashboard does not uninstall the Sophos endpoint on the machine. To uninstall Sophos, please follow the steps mentioned in this article, which need to be performed after disabling tamper protection.

1. Login into Sophos central
2. Make sure to disable first the Tamper Protection. You can Retrieve tamper protection password for deleted endpoints and servers from Sophos Central. This option is located in Logs & Reports > Recover Tamper Protection passwords. Click on View details to expand the password(s) that has been set on the endpoint or server. The password at the top of the list is the most recent. This password can be used to authenticate on the local endpoint or server, allowing access to the Settings and the option to disable Tamper Protection.
   
   

You will be able to view the list of the deleted endpoints by clicking on View Password Details.

Note: If the device name is not showing under recover tamper protection password, you will need to recover the tamper password with the help of this article. 

3. On the endpoint, Stop the Sophos MCS Client service.
4. Set the Sophos MCS Client service to have a startup type of Automatic (Delayed Start)
5. Stop the Sophos Managed Threat Response Service (If you have installed the Managed Threat Response component)
6. Delete the files "Credentials," "EndpointIdentity.txt," and those with the .xml extension that are located in the following path:

Windows 7 and later: C:\ProgramData\Sophos\Management Communications System\Endpoint\Persist

Windows XP: %ALLUSERSPROFILE%\Application Data\Sophos\Management Communications System\Endpoint\Persist

7. Restart the stopped services (MCS Client and MCS Agent) and perform force update on the endpoint.
8. Check if the Endpoint is back reporting to the Central.

Linked recover tamper article
[edited by: Shweta at 5:19 PM (GMT -8) on 22 Dec 2020]