Time to get disabling tamper protection to work

In the meanwhile we managed to uninstall it, but I'm still curious about the time it takes if we disable the tamper protection from Sophos Central.

Hello Jo,

Thank you for reaching the community forum.

It should turn off the settings immediately on the endpoint, provided there's no communication issue from the device going to Sophos Central. However, just to ensure that the action taken from Sophos Central will take effect immediately on the endpoint, it would be better to do a manual update on the endpoint itself. Hopes this answers your questions. 

Dear Glenn,

thank you very much. We indeed found out by filling the tamper protection password locally and then go into the settings and disable tamper protection, we were able to uninstall it.

I thought as well it should disable tamper protection immediately after disabling it via Sophos Central, but it always takes a lot of time.

Jo

What is the best way to accept your reply as best answer?

By any chance, was there any error message showing on your communication management services that can be found when you open endpoint self-help on your endpoint client?
Only when having communication issues is the only thing that causes your device not to grab the changes on your central dashboard.
Also, to ensure that the endpoint receives the changes made on Sophos central, we do that by practice, especially if you're performing some tests not just disabling tamper protection but also for policy changes. Though as I said, it should be automatic and does not need administrators' intervention unless there's a communication issue from the endpoint going to Sophos central. 

No, nothing came up, only we were unable to uninstall as we needed to enter the password for disabling the tampering. But even if it was entered, it didn't work. We found out what to do after entering the password.

Dear Glenn, how can I accept your answer as best answer? Is this by selecting Verify answer? Or is there an other way?

Jo

Same boat here, the remote "Turn off tamper protection" feature has never worked for us.

I have taken to using "Live Response" and running SEDCLI https://support.sophos.com/support/s/article/KB-000043008?language=en_US 

Hello Chris,

When you mentioned Remote "turnoff tamper protection,"? Are you talking about the option that can be found under Global settings or the option that can be found on individual devices? 

Not being able to use this feature means there might be some issues related to communication from central to your endpoint devices, as this feature relies on communication to work. 

Have you tried connecting one of your Devices via an Open internet network and see if you can turn off tamper protection via Sophos Central?

Hi Glenn, 

Specifically the option under individual devices, never had any luck with it.  We make use of Message Relays and have devices on the "open" internet that this doesn't work with. 

Same devices can be sent a lockdown request that will put them into lockdown mode and Live Response also works, so not sure if it is specifically a comms issue.

Thanks

Chris