Isolated PC, "Failed to clean up threats" because they were removed. How to re-run the scan?

Hi Jim Oliver 

You will require a tamper protection password to remove the device from isolation, or you can contact your IT administrator so that they can remove the device from isolation from central dashboard. Please refer to this article for more information. 

Considering we are in a national emergency these days, there needs to be a way to remove a device from isolation without the admin.  How can we get this policy changed?

Hi Jim Oliver 

You can turn off the option to isolate red health devices from your Endpoint Threat Protection policy so these don't get isolated moving forward, in the meantime.

For devices that are currently isolated due to this setting, these would need to be removed from isolation by an Admin.

But it is not a "red health" device.

I fixed the issue.

How can a non-admin get Endpoint to re-test a device?

Hi Jim Oliver 

Would you please help us to understand the meaning of re-test a device? What do you want to test on the endpoint?

I just mean re-run whatever scan the anti-virus used to lock down my PC in the first place.

In my case, Sophos detected SoftPulse, certainly annoying but not the biggest threat out there.  I removed the infected files, but by then the damage was done....Sophos marked my machine as "isolated" and bricked it.

Note Sophos did more damage to my machine that the virus.

I would like to have the ability to re-run the virus scan, and if Sophos did not find the threat anymore, unbrick the device.

There should be a way to do this.  Note the admin cannot visit my house, because we are under a mandatory stay-at-home order.  You don't want to violate state law, do you?

I need to be able to do this.  With a bricked device, there is a good chance that I will not be able to contact the admin in any case.  This is unacceptable.

I need to be able to unbrick my own machine, if I have managed to remove the virus...which I did.

Please modify the Sophos Endpoint so a user can re-run the scan, and if the virus is not found, the device is no longer "Isoloated" (i.e. bricked.)

Hi Jim Oliver 

These are Sophos policies that are set by your Admin, and they are the ones who will be able to remove the machine from the "isolated" state.

Depending on how/why your machine is isolated, will be the process to be followed to get your machine working again. This process involves some action in the Sophos Central Dashboard, and there is no need for a physical visit by an IT administrator.

For any Sophos product enhancement requests, please submit, or vote on an existing one here.

How do I contact the admin with a bricked machine?

Hi Jim Oliver 

You should be able to contact them via phone or from a different device; following your company's IT policy/processes.

And if they are not available?

Hi Jim Oliver 

There is always an IT policy which provides the path in case if admin is not available whom you need to contact. That is the reason DianneY has also mentioned about IT policy in his statement.

Hi Jim Oliver 

There is always an IT policy which provides the path in case if admin is not available whom you need to contact. That is the reason DianneY has also mentioned about IT policy in his statement.