Sophos Endpoint Defense: How to recover a tamper protected system

05/04/2018 2 Comments

Sophos Central

Sometimes it fails when you try to remove Sophos Endpoint Protection, for some weird reason tamper protection get’s messed up, and keep telling you that the entered code is invalid or maybe you lost it, due to cancellation of the Sophos Central Account, this can help you get things going again:

Overview

This article describes how to recover a tamper protected system if  the tamper protection password is lost and the client cannot receive a new policy with a known password.

The following sections are covered:

Applies to the following Sophos products and versions
Central Windows Endpoint
Sophos Endpoint Security and Control

How to recover a tamper protected system

Remember to do a backup of the registry before attempting these procedures.

Sophos Enterprise Console managed client

To recover a tamper protected system, you must disable Enhanced Tamper Protection, do the following:

  1. Boot the system into Safe Mode.
  2. Click Start > Run > type services.msc > right-click Sophos Anti-Virus service > Properties > set the Startup type to Disabled > then click OK.
  3. Click Start > Run > type regedit and then click OK.
  4. Go to the following location in the registry editor:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config
  5. Set the following DWORD values to 0: SAVEnabled and SEDEnabled
  6. Go to the following location in the registry editor:
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection and set the REG_DWORD Enabled to 0.
  7. Reboot the system in normal mode.

Sophos Central managed client

From 20th January 2018 the Tamper Protection passwords can be retrieved for deleted endpoints/servers from within Sophos Central. To obtain this information:

  1. Log in to Sophos Central.
  2. Access Logs & Reports > Recover Tamper Protection passwords.
  3. Click on View details to expand the password(s) that has been set on the endpoint/server. The password at the top of the list is the most recent.

This password can be used to authenticate on the local endpoint/server, allowing access to the Settings and the option to disable Tamper Protection.

Note: The report will display endpoints/servers that have been deleted over the previous 60 days. For release, the start date for displaying any deleted endpoints/servers is 09th December 2017.

If you do not have access to Sophos Central the following steps can be used.

To recover a tamper protected system, you must disable Enhanced Tamper Protection. Do the following:

  1. Boot the system into Safe Mode.
  2. Click Start > Run > type services.msc > right-click Sophos Anti-Virus service > Properties > set the Startup type to Disabled > then click OK.
  3. Click Start > Run > type regedit and then click OK.
  4. Go to the following location in the registry editor:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent and set the REG_DWORD Start to0x00000004.
  5. Go to the following location in the registry editor:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config and set the following REG_DWORD values SAVEnabled and SEDEnabled to0.
  6. Go to the following location in the registry editor:
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection and set the REG_DWORD Enabled to 0.
  7. Reboot the system in normal mode.

Enhanced Tamper Protection is now disabled and you should now be able to access the system.

Registry keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SavService\TamperProtection

Related information

Source: https://community.sophos.com/kb/en-us/124377

Related Posts

2 Comments

  1. Karl

    The problem with this is it means individually touching each machine.

    We recently faced a situation after a reorganisation where we had about 250 endpoints which had been part of a previous estate which was now closed so we could not recover their tamper protection passwords to point them to our new estate using the –registeronly switch.

    The Sophos documentation implies that we’d need to go into Safe Mode to fix each of them. This wasn’t possible with the manpower available.

    We crafted a solution using an SCCM task sequence.

    High level view: create a task sequence to:

    Suspend Bitlocker (if you’re using it)
    Reboot into Windows PE
    Mount the installed OS registry in WinPE
    Change the registry keys that would normally be changed in Safe Mode using Sophos’ instructions and disable the MCS service (so it doesn’t immediately TP itself again on restart)
    Restart the computer in the regular OS
    Run SophosSetup with –quiet –registeronly to get the machine onto the new estate
    Re-enable MCS and restart again to get all the Sophos components working.
    Step 3-4 are handled by a script:

    reg load HKLM\TEMPSYSTEM C:\Windows\System32\config\SYSTEM
    reg load HKLM\TEMPSOFTWARE C:\Windows\System32\config\SOFTWARE

    reg add “HKEY_LOCAL_MACHINE\TEMPSYSTEM\ControlSet001\Services\Sophos MCS Agent” /v Start /t REG_DWORD /d 0x00000004 /f

    reg add “HKEY_LOCAL_MACHINE\TEMPSYSTEM\ControlSet001\Services\Sophos Endpoint Defense\TamperProtection\Config” /v SAVEnabled /t REG_DWORD /d 0 /f

    reg add “HKEY_LOCAL_MACHINE\TEMPSYSTEM\ControlSet001\Services\Sophos Endpoint Defense\TamperProtection\Config” /v SEDEnabled /t REG_DWORD /d 0 /f

    reg add “HKEY_LOCAL_MACHINE\TEMPSOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection” /v Enabled /t REG_DWORD /d 0 /f

    reg unload HKLM\TEMPSYSTEM
    reg unload HKLM\TEMPSOFTWARE

    Step 7 is a command line:

    sc config “sophos mcs agent” start= auto

    Reply ↓
    1. Martin (Post author)

      Great job – thanks for the procedure above 😉

      Best regards
      Martin

      Reply ↓

Leave a Comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close