Sophos Cloud - How to re-register a Mac if it has been deleted

  • Article ID: 120825
  • Rating:
  • 4 customers rated this article 2.3 out of 6
  • Updated: 27 Mar 2015

Following the deletion of a Mac computer in Sophos Cloud the computer cannot be re-registered with the Cloud without uninstalling and re-installing Sophos Anti-Virus.

First seen in
Sophos Cloud Managed Endpoint

Operating systems
Mac OS X

When the Sophos Installer is re-run over the top of an existing install, it is seen as an upgrade and not a fresh install as all the registration has already been performed. The following message will appear in Install.log:

Upgrading the "saas" product.

As the computer has been deleted in the Cloud interface, the Mac cannot communicate using the existing registration information.

What To Do

It is recommended to remove and re-install Sophos Anti-Virus for Mac. For more information on how to remove Sophos Anti-virus for Mac see article 121507 or 120856.  

Note: Sophos Cloud stores previously generated Tamper Protection passwords and these can be found under  This maybe required if a new password has been generated after a Mac was deleted from Sophos Cloud.

To force a re-registration without uninstalling and re-installing the following procedure may also be followed:

  1. Open Keychain Access, located in /Applications/Utilities.
  2. Select the Sophos Keychain and choose the Category All Items
  3. Delete the two Sophos Keychain entries:

    Primary Server
    Sophos Cloud Credentials

  4. To perform a new registration open Activity Monitor, also located in /Applications/Utilities.
  5. Highlight the process SophosMcsAgentD
  6. Choose the icon to Kill the process. It will restart automatically with a new PID.

The Mac will now perform the registration and appear as managed.

Note: For Yosemite (10.10) it is not possible to delete the keychain entries in the same way as detailed above.  To remove the Sophos keychain entries on 10.10 and later do as follows:

  1. Quit the Keychain program. For example press Cmd + Q, or select 'File' | 'Quit' from the menu bar. Ensure the program is not shown in the dock as running.

  2. Open Terminal from Spotlight (press Cmd + Spacebar, type 'terminal', and press enter). Example:

  3. Type the following and press enter: 
    cp /Library/Preferences/ ~/Desktop/

    Note: A new .plist file will appear on the Desktop of your computer.

  4. Type the following and press enter:
    cp ~/Desktop/ ~/Desktop/

    This command creates a copy (backup) of the file. Ignore the .orig file as we won't be using it further in these instructions.

  5. Open the .plist file in a text editor (not the .plist.orig). For example right-click the file, select 'Open With', if you see 'TextEdit' select that, otherwise select 'Other' and pick 'TextEdit' from the list of applications. You can use your favour plain text editor if you like.

  6. Search (Cmd + F) the file for mentions of 'Sophos' and remove all blocks that start '<dict>' and end '</dict>' that contain a mention of Sophos. There may be multiple blocks that mention Sophos. Example:

  7. Save and close the file.

  8. Copy the file back to the original location by typing the following and pressing enter:
    sudo cp ~/Desktop/ /Library/Preferences/

    Note: You are prompted for your password. Enter the same password you use when installing an application or unlocking a system panel. The password will not appear on screen but is being accepted. Once you have enter you password press enter. If you make a mistake just press enter to try again.

  9. Open the keychain access application (Cmd + Spacebar | Type: 'keychain' | Press enter) and conform the Sophos chain is gone. If it is still there you either need to fully quit the program and reopen, or go back to step five above and work through from that step again.

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent