Uninstalling Sophos Endpoint

Hello John,

Thank you for reaching out to the Sophos Community. 

I have relayed this information to our internal teams. I will follow up on this thread as more information on future development becomes available. 

Hello John,

Thank you these sharing these informative links. I have passed along this information to our internal teams, who have mentioned that this is something they are looking into for future development cycles. Our team is consistently working on addressing improvements for macOS.

Thank you once again for your feedback.

Hello John,

Thank you these sharing these informative links. I have passed along this information to our internal teams, who have mentioned that this is something they are looking into for future development cycles. Our team is consistently working on addressing improvements for macOS.

Thank you once again for your feedback.

Hi Kushal, thanks for your previous interaction. 
Is there any update on this? The product just doesn't uninstall and I can't recommend the product to my company anymore until it's fixed.

Here is what we found and currently do.

1. A normal Mac following the normal process as per Sophos' own article of dragging app bundles to the Bin successfully uninstalls one of the two System Extensions but not the other. My suspicion is that macOS is 'confused' by the second one being embedded in an app which is itself embedded inside another app. All the proper macOS messages are shown but this one does not properly uninstall.

2. I did try writing a shell script which used AppleScript to tell the Finder to 'drag' the apps to the Bin. This works on a Mac that is not enrolled in Jamf Pro but fails on Macs enrolled in to Jamf Pro even though I have correctly told Jamf Pro PPPC to allow this. Jamf say this is a bug in both macOS Big Sur and Monterey.

3. Sophos do not yet support the new Apple API to fully automate uninstalling System Extensions. The impression I got from their response was that until I brought this to their attention they were not aware of this at all.

4. We currently successfully do the uninstall including System Extensions by a) turning SIP off, b) removing the first app and hence extension, c) rebooting, then d) removing the second one and e) rebooting and then running the Sophos uninstaller, then f) turning SIP back on. We have to get users to manually turn SIP off and on but the rest we have automated via two Jamf Self Service 'apps'.

A section was recently added to our KBA for removing Sophos from MacOS. Let me know if the steps described under "MacOS12.1" of the following article allows the full removal to be completed. 
- Sophos Anti-Virus for Mac: Removal tool

Qoosh

The issue is that your Removal tools do not remove the system extensions because you do not yet use and support the new Apple API for removing system extensions via such an automated uninstall process. (The drag to bin process is a manual process and as mentioned we found that only 'half' worked even under macOS Big Sur.)

In my organisations case we are all running macOS Big Sur so the referral to macOS12.1 is not applicable.

Your KBA says you have to turn off SIP to remove the system extensions and this process works and is what we are having to use but clearly is extremely enterprise and user unfriendly and requires each user to be talked through doing this. 

The most recent release notes mention that this will be corrected as of version 10.3.3. 

Let me know if you continue to experience this issue once Sophos is updated on your devices.

Edit: This update will be available to all customers as of March 8th.