Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 2324 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to uninstall old Sophos enterprise console from our Windows domain

Ruben Alvarez

Hi,

I've been using Sophos Cloud for a couple years now, but we used to use Sophos endpoint protection with on-premise Enterprise console.  Our old Sophos server is long gone, but there still are some old Sophos user objects and groups present in our domain controllers. 

I'd like to clean them up.  So just as a precaution, I always disable user objects or rename group and let them sit for a few weeks before I delete them if I'm not 100% sure I know what will happen.

So I renamed all the Sophos groups to:

z_SophosAdministrator

z_SophosDomainAdministrator

z_SophosDomainPowerUser

z_SophosDomainUser

z_SophosFimDataReaders

z_SophosOnAccess

z_SophosPowerUser

But today I came back to Active Directory Users and Computers and they are all back!  Something has recreated all the groups.  I can see in attributes the creation date is today.

 

Can someone explain what is going on? 



This thread was automatically locked due to age.
  • +1

    Hello Ruben Alvarez,

    all the groups listed are used by the Endpoint component and not specific to an SESC installation (except SophosFimDataReaders for File Integrity Monitoring) - i.e. they exist in a Central installation as well. Guess they are recreated when SAV is updated on a DC - there's perhaps some corresponding entry in the SAV Install log in \Windows\Temp.

    Christian

  • 0 in reply to QC

    I think you're right.  I do have Endpoint installed on the DC.  I also have it installed on my workstation and I also have those groups.  I'll just leave those groups alone.

Unfiltered HTML