Uninstalling Sophos W10 Dell Laptop

Hello Gary,

Thank you for reaching out to the Sophos Community. In order to assist in the removal process, I recommend using the "Sophos Zap" tool, instead of attempting a normal uninstall. 
- https://support.sophos.com/support/s/article/KB-000038989?language=en_US

One way you can ensure Tamper Protection is being disabled is as follows. 

- Obtain the Tamper Protection Passcode from Sophos Central
- On the local machine open Command Prompt as Administrator and enter the following (without the dash at the beginning)
- cd C:\Program Files\Sophos\Endpoint Defense\
- SEDcli.exe -tpoff <passcode> 

You will enter the digits of the passcode where <passcode> is present above. If the command returns "Incorrect SED  Tamper Protection password provided" you will need to use the following KBA prior to attempting the Sophos Zap tool. 
- https://support.sophos.com/support/s/article/KB-000036125?language=en_US

Let me know if this helps. 

You can't stop the Sophos Endpoint Defense Service.  It's a protected service (PsProtectedSignerAntimalware-Light) regardless of Tamper Protection.

SERVICE_LAUNCH_PROTECTED_INFO (winsvc.h) - Win32 apps | Microsoft Docs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense Service
LaunchProtected = 3

SophosZap should do the job.  To know why we would need to know the component and see the MSI log.  It would be in %temp% if you ran the uninstaller as your logged on account.

Kushal

Thank yo for the advice - however, when I try to disable tamper protection using the steps above I receive the message "Access to SED Tamper Protection status was denied".  I have re-checked tamper protection passcode via Sophos Central and the passcode used is the right one.

Can you clarify if I should use the next solution as provided above i.e. "......the following KBA prior to attempting the Sophos Zap tool. 
- https://support.sophos.com/support/s/article/KB-000036125?language=en_US" ?

I wait to hear from  you

Regards

Gary Evans

Hello Gary,

When trying this on my side I am returned "Access to SED Tamper Protection status was denied" only when the Command-Prompt window is not launched as "Administrator". Can you confirm if this is being done prior to running the commands? 

- From the Windows Start menu type "CMD"
- Right-click on the "Command Prompt" option and select "Run as Administrator" 

If you are still seeing access denied errors being returned, then it is recommended to use the "Recover a tamper protected system" KBA you linked above.