Hello everyone, this is Kushal from the Sophos Community and today we will be going
over how to recover a device from a Tamper Protected state. This video will cover steps relevant
for devices managed from Sophos Central. If you’re looking for the steps for Sophos
Enterprise Console-managed clients, check the links in the description for the video that’s relevant
to your environment.
We’ll demonstrate how to disable Tamper Protection using the command line, then we’ll
walk through the recovery steps for current and legacy operating systems.
We’ll first take a look at using the command line to disable Tamper Protection. This can
be useful for scripting, or for situations where interacting with the Sophos UI does
not disable Tamper Protection. If you know the tamper protection passcode
for a device, but entering the code in the UI does not work, try using the following
steps. Open Command Prompt as administrator
Change directory to C:\Program Files\Sophos\ Endpoint Defense\
Run the following command sedcli.exe -overrideTPoff followed by the passcode
You can also run the command with the -h switch to get help on the cli options.
Relevant documentation going into further detail will be in the video description.
Moving on to the Recovery Steps, for Windows 10 or 11, Windows Server 2012,
2016 and 2019 that are running Core Agent 2.15.4 or later, the following steps will
apply. In this video, we’ll be using Windows 10.
We’ll first go to the Windows Settings Menu and select “Update & Security”
Click Recovery in the left hand tab and Under advanced Startup, select “Restart
now” Once the restart occurs, you’ll select “Troubleshoot > Advanced
Options > and Command Prompt” The device will restart again and you’ll need
to select an account with “Administrator” access.
We’ll get logged in here and Command prompt will now open.
Type C: and hit enter. Next, type DIR or “dir”. If this doesn’t show you
the Operating System folders, you can use the command “diskpart” and “list
volume” to determine what drive letter your System drive is.
On my test device we’ll need to go to the “D:” drive. We can confirm this is the
correct one by running DIR once again. Type “cd Windows\System32\drivers and
press enter. We’ll rename the Endpoint Defense driver
by Typing “ren SophosED.sys SophosED.sys.old” and press enter.
Type exit and press Enter once again.
Now at the menu we’ll select continue to boot to Windows.
Now that we’re back in the normal windows environment, we’ll log in and open the registry
editor. Back up the registry as a precautionary measure
– we always recommend doing this before making any modifications to the registry. Right-click
on Computer and select “Export”. I like to name the backup after the date or
time it was taken.
We’ll be navigating through the registry for many of these steps. I recommend using the
arrow keys, as well as the keyboard to get to relevant sections faster. For example,
pressing S on the keyboard will take you to the entries within the section that begin
with the letter “S”. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos
MCS Agent . Open the entry named “Start” and
set the Value data field to 4. Next, we’ll go to \SAVService in the
same Services location, Open the Start entry here and set the Value data field to 4.
We’ll do the same thing under \Sophos AutoUpdate Service
Now we’ll go back to the root of the registry and navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Services
and under every subkey in this location set the Value data of Protected to 0.
Go to the \Config folder and set
the Value data of SAVEnabled and SEDEnabled to 0. Lastly, we’ll change the following value.
This will depend on whether you have a 32 or 64bit OS. For 64bit, we’ll go to:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection And for 32-bit machines, that would be:
HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SAVService\TamperProtection Set the “Value Data” field of enabled to
0 Restart the endpoint or server to apply
the changes and off Tamper Protection.
This section will cover Legacy OS’, including
Windows 7 and Windows Server 2008 R2 systems. For this video we’ll be using Windows 7.
Turn on or restart the Endpoint or Server. Press F8 while the system is powering
on, to open Advanced Boot Options. Select Repair Your Computer
And at the System Recovery Options screen, select a language and keyboard input method and
click Next. Select a local administrative account to sign
in to and click OK. Under System Recovery Options, click Command
Prompt: Authenticate with Administrator credentials
and the command prompt will open. Type: D: and press Enter.
I recommend running the “dir” command to ensure you're in the OS drive. You
can also use the commands ”DiskPart” and ”list volume” to display the available volumes.
Next we’ll Type: cd Windows\System32\drivers and press Enter.
Type: ren SophosED.sys SophosED.sys.old and press Enter. Type: exit and press Enter once again.
And click Restart. Once back in the Windows environment, we’ll
get signed in and open Registry Editor.
Back up the registry as a precautionary measure – we always recommend doing this before
making any modifications to the registry. Right-click on Computer and select “Export”, I
like to name file after the date on which the backup is taken.
Next, we’ll go to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent
Here we’ll set the Value data field of Start to 4 Next, we’ll \Sophos Endpoint Defense\ in
the same location and under \TamperProtection\Config set the Value data field of SAVEnabled and SEDEnabled to 0.
Lastly, set the Value data of Enabled to 0 in the following registry location.
This will vary depending on whether your operating system is 64 or 32-bit.
For 64-bit, we’ll go to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection
And if you’re using a 32-bit machine, navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SAVService\TamperProtection Once completed, restart the Endpoint or Server
in Normal Mode to complete setting enhanced Tamper Protection to off.
That covers the two different scenarios
you’re likely to encounter when recovering a device from a Tamper Protected State specific
to Sophos Central. There is one additional set of steps relevant
for Core Agent 2.10.8 and earlier, but the process involves booting the affected device
into “Safe Mode” instead of the Windows Recovery Environment, after which, the steps
are much the same in making registry changes. A link that details these steps can be found
in the video description below.
Thanks for watching! I hope this video helped you out, if you found it useful, be
sure to hit the thumbs up button on Techvids, or on Youtube. And if you have any questions feel
free to reach out to us on the Community forums at community.sophos.com.