26/1/2017 SophosEndpointDefense:HowtorecoveratamperprotectedsystemSophosCommunity

Sophos Endpoint Defense: How to recover a tamper

protected system
124377 14 oct 2016 0 personas lo han encontrado til

English | Espaol | Italiano | | Franais | Deutsch

Overview
This article describes how to recover a tamper protected system if you've lost the tamper protection
password and the client cannot receive a new policy with a known password.

NOTE: Do a backup of your registry before you attempt this procedure.

The following sections are covered:

How to recover a tamper protected system

Related information
Feedback and contact

Applies to the following Sophos products and versions

Sophos Endpoint Security and Control 10.6.4
Sophos Cloud Managed Endpoint

How to recover a tamper protected system

Sophos Enterprise Console managed client:

To recover a tamper protected system, you must disable Enhanced Tamper Protection.
Do the following:

1.BootthesystemintoSafeMode.
2.ClickStart>Run>services.msc>rightclickSophosAntiVirusservice>properties>settodisabled>OK
3.ClickStart>RunandtyperegeditandthenclickOK.
4.Gotothefollowinglocationintheregistryeditor:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SophosEndpointDefense\TamperProtection\Config
5.SetthefollowingDWORDvaluesto0:SAVEnabledandSEDEnabled
6.Gotothefollowinglocationintheregistryeditor:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtectionandsettheREG_DWORDEnabledto0
7.Rebootthesysteminnormalmode.

Sophos Central managed client:

https://community.sophos.com/kb/enus/124377 1/3
26/1/2017 SophosEndpointDefense:HowtorecoveratamperprotectedsystemSophosCommunity

To recover a tamper protected system, you must disable Enhanced Tamper Protection.
Do the following:

1. Boot the system intoSafe Mode.

2. ClickStart >Run> services.msc > right-click Sophos Anti-Virus service > properties > set to disabled > OK
3. ClickStart>Runand typeregeditand then clickOK.
4. Go to the following location in the registry editor:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SophosMCSAgent and set the REG_DWORD
Start to 0x00000004
5. Goto the following location in the registry editor:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SophosEndpoint
Defense\TamperProtection\Config and set the following REG_DWORD valuesSAVEnabledandSEDEnabled
to 0
6. Go to the following location in the registry editor:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtectionand set the
REG_DWORD Enabled to 0
7. Reboot the system in normal mode.

Enhanced Tamper Protection is now disabled.

You should now be able to access the system.

Registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SophosEndpoint
Defense\TamperProtection\Config

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SophosMCSAgent

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SavService\TamperProtection

Related information
https://community.sophos.com/kb/enus/124377 2/3
26/1/2017 SophosEndpointDefense:HowtorecoveratamperprotectedsystemSophosCommunity

Sophos Endpoint Defense: Default conguration settings

0x00000082: The installation could not be started
Sophos Endpoint Defense: Overview
Sophos Endpoint Defense: FAQs on Enhanced Tamper Protection
Sophos Endpoint Defense: Supported operating systems
Sophos Endpoint Defense: How to enable Tamper Protection
Sophos Endpoint Defense: How to disable Tamper Protection
Sophos Endpoint Defense: Relevant les, folder, and registry entries
Enhanced Tamper Protection not supported on systems with Sophos Update Manager

Feedback and contact

If you've spotted an error or would like to provide feedback on this article, please use the section
below to rate and comment on the article.
This is invaluable to us to ensure that we continually strive to give our customers the best
information possible.

El artculo aparece en los siguientes temas

Endpoint Security and Control
Sophos Cloud
Endpoint Security and Control > Endpoint Protection
Sophos Cloud > Endpoint protection

Le ha proporcionado este artculo la informacin que buscaba?

Todos los comentarios enviados son ledos (por una persona), pero no podemos contestar a
preguntas tcnicas especcas. Si necesita soporte tcnico, publique una pregunta en nuestra
comunidad. Como alternativa, en el caso de los productos con licencia, abra una solicitud de soporte.

https://community.sophos.com/kb/enus/124377 3/3