last update failed- sophos endpoint

Hello Hanan Al Mutairi 

Please check out the information in this article, it touches on some troubleshooting steps for getting the NTP service started.

for this 

• Rebuild the Sophos AutoUpdate Cache 
• Also try out the steps in: Advance troubleshooting for endpoint reporting one or more service not running/Missing

the trouble is I can't turn off tamper protection because Sophos cloud  appears this device did not install endpoint protection 

Hi Hanan Al Mutairi 

Please refer to this article to disable the tamper protection from the machine in the safe mode. Once it is done, tamper protection will be disabled and you can follow the above-mentioned articles to install the NTP successfully. For reporting to the central, I would suggest you follow the below steps:

1. Stop the Sophos MCS Client service
2. Set the Sophos MCS Client service to have a startup type of Automatic (Delayed Start)
3. Stop the Sophos Managed Threat Response Service (If you have installed the Managed Threat Response component)
4. Rename the files Credentials, EndpointIdentity.txt and those with the .xml extension that are located in the following path:
   
   • Windows 7 and later: C:\ProgramData\Sophos\Management Communications System\Endpoint\Persist
   • Windows XP: %ALLUSERSPROFILE%\Application Data\Sophos\Management Communications System\Endpoint\Persist
5. Rename the files with the .status extension that are located in the following path:
   
   • Windows 7 and later: C:\ProgramData\Sophos\Management Communications System\Endpoint\Cache
   • Windows XP: %ALLUSERSPROFILE%\Application Data\Sophos\Management Communications System\Endpoint\Cache
6. Rename the file machine_ID.txt that is located in the following path:
   
   • Windows 7 and later: C:\ProgramData\Sophos\AutoUpdate\data
   • Windows XP: C:\Documents and Settings\All Users\Application Data\Sophos\AutoUpdate\data
7. Set the Sophos MCS client service to have a startup type of Automatic
8. Start Sophos Managed Threat response if you stopped it.
9. Start the Sophos MCS Client service.

Please let us know how it goes.

Hi Hanan Al Mutairi 

Please refer to this article to disable the tamper protection from the machine in the safe mode. Once it is done, tamper protection will be disabled and you can follow the above-mentioned articles to install the NTP successfully. For reporting to the central, I would suggest you follow the below steps:

1. Stop the Sophos MCS Client service
2. Set the Sophos MCS Client service to have a startup type of Automatic (Delayed Start)
3. Stop the Sophos Managed Threat Response Service (If you have installed the Managed Threat Response component)
4. Rename the files Credentials, EndpointIdentity.txt and those with the .xml extension that are located in the following path:
   
   • Windows 7 and later: C:\ProgramData\Sophos\Management Communications System\Endpoint\Persist
   • Windows XP: %ALLUSERSPROFILE%\Application Data\Sophos\Management Communications System\Endpoint\Persist
5. Rename the files with the .status extension that are located in the following path:
   
   • Windows 7 and later: C:\ProgramData\Sophos\Management Communications System\Endpoint\Cache
   • Windows XP: %ALLUSERSPROFILE%\Application Data\Sophos\Management Communications System\Endpoint\Cache
6. Rename the file machine_ID.txt that is located in the following path:
   
   • Windows 7 and later: C:\ProgramData\Sophos\AutoUpdate\data
   • Windows XP: C:\Documents and Settings\All Users\Application Data\Sophos\AutoUpdate\data
7. Set the Sophos MCS client service to have a startup type of Automatic
8. Start Sophos Managed Threat response if you stopped it.
9. Start the Sophos MCS Client service.

Please let us know how it goes.