Completed (Minor Issue)

Tamper protection clarification needed in KBA

In https://support.sophos.com/support/s/article/KB-000034808?language=en_US, In the "On the installed Sophos Agent on a Windows device" section, there is a note that "Sophos Central will automatically turn on Tamper Protection after four hours", though no such note resides under the "On the installed Sophos Agent on a macOS device" section. 

Does this note also apply to macOS devices?

  • My apologies. It seems that the KB does have information about tamper protection via the console, though it does not explicitly mention whether tamper protection is automatically enabled (or not) after x amount of time.

  • Thank you for the follow-up and I appreciate the clarification.

    For your consideration: In thinking about this further, the other place where Tamper Protection can be enabled/disabled is in the Sophos Central console. For whatever it is worth, in my test using one system, after turning off tamper protection within the console for an asset, tamper protection does not turn on after 4 hours. So, while the KB is accurate because it is dealing with tamper protection being enabled/disabled on the devices, it would be MORE complete if EITHER this KB included information on tamper protection on the console OR had a link to a different KB that dealt with tamper protection being enabled/disabled on the console. That way, the reader would understand the nuance of tamper protection as it pertains to agent/device vs console.

  • Hello, tamper protection will also be turned on after 4  hours on macOS devices.