This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

why are random PCs showing as registered to our cloud console?

I have opened case #7112044 asking about this last Thursday but nobody has responded yet... We do not use these IP ranges nor do we have Windows XP in our environment.

This thread was automatically locked due to age.

Parents

0 Garrett over 7 years ago

Are you, or any of the admins on your network, running sophos AD sync. That is the only way that I would think this would be possible.
Cancel
Vote Up 0 Vote Down

Cancel
0 gdriggs over 7 years ago in reply to Garrett

Yes, we do but these are not domain joined systems.
Cancel
Vote Up 0 Vote Down

Cancel
0 Garrett over 7 years ago in reply to gdriggs

Purely curious, but have you tried to ping that IP to see if anything responds?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Garrett over 7 years ago in reply to gdriggs

Purely curious, but have you tried to ping that IP to see if anything responds?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 gdriggs over 7 years ago in reply to Garrett

There's no route to those hosts. We use some networks in 10.0.0.0/8 but neither of the ones that these PCs are alleged to be in.
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 7 years ago in reply to gdriggs

Hi,

I suppose the obvious things to check/consider initially would be:

1. In the Central Audit logs (cloud.sophos.com/.../audit), no one other than expected admins have logged in to obtain the URLs of your installers?

2. None of your end users have taken the SophosInstall.exe home or shared it with friends?

3. The URLs of your installers (e.g. dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com/.../SophosInstall.exe) have been published/leaked/shared?

Regards,
Jak
Cancel
Vote Up 0 Vote Down

Cancel