Manually prepare a ‘gold’ image
Stop the Sophos MCS Client service and set its start-up type to Automatic (Delayed Start)
Stop the Sophos Managed Threat Response service if it is installed
Delete the files:
• C:\Programdata\Sophos\Management Communications System\Endpoint\Persist\EndpointIdentity.txt
• C:\Programdata\Sophos\Management Communications System\Endpoint\Persist\*.xml
• C:\Programdata\Sophos\Management Communications System\Endpoint\Persist\endpoint.jwt
• C:\Programdata\Sophos\Management Communications System\Endpoint\Cache\*.status
• C:\ProgramData\Sophos\AutoUpdate\data\machine_ID.txt
• C:\ProgramData\Sophos\Managed Threat Response\config\policy.xml
• C:\ProgramData\Sophos\Managed Threat Response\\data\isquery.sd
Obtain the registration token from:
• C:\Programdata\Sophos\Management Communications System\Endpoint\Config\Config.xml
Create or update the registration.txt file:
• C:\Programdata\Sophos\Management Communications System\Endpoint\Config\registration.txt
Example file:
[McsClient]
Token=YourRegistrationToken