I dislike the complexity of this process, but what I found (if Tamper Protection is enabled), is that you log into your Sophos Cloud console, find the specific device and copy the "Tamper Protection" password. Then on the local machine, open the Sophos Endpoint Security and Control>Authenticate user (paste password here). You will then be able to open Configure anti-virus and HIPS>On-access scanning. It is here that you can disable the "on-access" scanning. Tony
↧