Auto Close Popup for Sophos Disk Encryption Using Filed Focus as Trigger?

I disabled Sophos Disk Encryption, and have to get on a support call with the Help Desk to turn disk encryption back on - they need to take over screen and go into Terminal, etc. I don't have time to do that right now, so I am trying to use Keyboard Maestro (KM) to close the Sophos window every time it pops up.

Here is the example popup:
Screen Shot 2021-02-20 at 8.05.41 AM

I would love for KM to press "Postpone" everything that window pops up, but attempting to use the example in the RELATED POST below did not work, which I think is because the Sophos does not have an official title?

The Sophos popup does not appear to trigger an active application being active, but the windows does come to the foreground, AND the Password field does get focus.

Trigger Keyboard Maestro to auto click the "Postpone" button when the "Password" field has focus?

Use Keyboard Maestro to automate closing of repetitive popup windows?

Hey Jono,

Firstly I don't think I'd let anyone encrypt my regular data but Apple, and I'm very wary of doing that without having an unencrypted backup.

But that’s me.

Keyboard Maestro does not detect system-level modal dialog windows – unfortunately.


Keyboard Maestro cannot detect when a text field has focus – although there are some workarounds for this, they aren't applicable in this use-case.

You're best bet is to use a Pause Until action to wait until a button named “Postpone” exists and then press it with a Press a Button action.

IF – the pause-until action can see the button. You'll have to test to make sure.

I don't particularly like macros that depend upon this mechanism, unless they're part of a larger macro that has a start and end point.

So I would just create a macro that would let me hit P or something similar to Press the “Postpone” button if/when the dialog popped up.

Again – you'll have to test to make sure it'll work in with your situation.


Thank you @ccstone.

Encryption is done via Apple's FileVault, but the help desk team uses Sophos to manage encryption and other security tasks. My Mac is a mobile managed device, and requires the admin user account's credentials to reenable encryption. Will just have to wait for help desk.

I will try Pause Until, and Button Press (thanks for suggesting), however I suspect it will fail since keyboard focus goes to the password field, which means the keystroke I assign may not work… but it could.

Hi @chsweb,
A little while ago the VLC app that I use to view videos was updated on macOS and a bug was introduced that popped-up an error window whenever I moved onto the next video in a playlist. For a number of reasons, the popup window was hard to detect... a bit like your Sophos one.

Anyway, I wrote a macro to detect that popup and close it automatically (it can also be run manually via hotkey should the auto detection not work). I also had the macro in a VLC-specific macro group.

I don't have Sophos so I can't say the approach I took with my VLC problem will work for you but I'm uploading this macro for you to have a look at and maybe you can adapt it for your circumstances.

BTW, the VLC bug has now been fixed and my macro lies unused...

(I need to give a shoutout to @JMichaelTX for the script action.)

I hope it helps...

Get rid of annoying pop-up.kmmacros (7.0 KB)

1 Like

Thank you @tiffle I will give this, and @ccstone's solution a try. I get lost in KM quickly.

1 Like

No luck @tiffle. I changed VLC to Sophos Device Encryption and tried using the "Try" button and nothing happened.

I also tried some of these options:

^ that did not work, which I think is because the Sophos window does not have a title.

It all may not work because Sophos is never an active application. As you can see below, Sophos is not the active app even when I click on the popup - in this case Keyboard Maestro remains the current app.

@ccstone I took a shot at your suggestion. It is not working, but I may not have build the Keyboard Maestro macro correctly. Here is what I did (clicking "try") does not do anything.

Hi @chsweb, thanks for the feedback. (BTW - you seem to have posted more-or-less the same screenshot 3 times in your last post.)

I'm not surprised my macro didn't work because you need to do a bit more digging/modification. Furthermore, clicking "Try" takes focus away from the Sophos window and gives it to KM so as my macro is designed to use the frontmost window i.e. the popup, it would fail.

First off, find out if KM can or cannot see that Sophos window. Do this by installing and running the excellent utility macro created by @ccstone that you can find here:

(You'll need to trigger this utility macro using the hotkey - NOT "Try" - once the Sophos window appears.) If it tells you that KM can actually see the frontmost app's windows - in other words, it is actually a window listed within the operating system - you can move to the next step. If it tells you KM can't see the Sophos window you need to skip this next step and try a different approach as described in the last paragraph below.

Second step, modify my macro appropriately. This is the part you need to change:

The text in item 1 needs to match some or all of that listed in the above utility macro for the Sophos window - if of course it is visible to KM.

You tried changing the app shown in item 2 to Sophos, but if that doesn't work just disable this whole Bring Front Window to Front action leaving just the Type and Break actions remaining in the Switch action. This might work because the Sophos window is already at the front - provided you don't use "Try".

If KM can't see the Sophos window and/or If none of this works then the last resort would be to create a macro that "sees" the window pop up (as a Found Image) and reacts accordingly - maybe you will have to trigger that macro manually via a hot key if you find the trigger on focused window changes is not working for you.

Good luck!