This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos keeps reinstalling after reboot

Hi all,

I recently bought a new laptop and I saw that Sophos endpoint was installed. I do not have the tamper key (no clue how to retrieve it, since I do not set it up), but I managed to deactivate it and unistall following the procedure. However when I turned on the computer the day after, it was there again. Then I uninstall everything again, using revouninstaller and I removed all the roots and all the files. Unfortunately, it was there again the day after.

Can you help me out to remove this completely? This is my personal, not used for work. I just want to have full control of my laptop. 

Thank you in advance!



This thread was automatically locked due to age.
  • Hi Gabry,

    Thanks for reaching out to the Sophos Community Forum.

    If you've purchased your device second-hand, I'd suggest performing a full wipe of the system before using it. Ideally, you will want to perform a fresh installation of Windows on the device, as it sounds like there are device management tools present which may prevent you from using the device freely.

    You can use the following command to obtain the Windows Product license key from your device prior to starting the process. 
    - wmic path softwarelicensingservice get OA3xOriginalProductKey

    If you want to find out how Sophos is being re-deployed onto the system, you can use something like Process Monitor and configure it to log activity on boot. See "Gathering a boot Process Monitor log" in the following link.
    - Gather system events using Process Monitor

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
  • That is the problem. My laptop is brand new, and I am the first user of it. Sophos was already installed in the OS. I do not want to restart the system. I just want to uninstall software over which I do not have control. Is there any way to override the reinstallation process?

  • If you can share a screenshot of what the Sophos UI looks like on your device, that may help clarify which steps will apply to you. 

    If the latest version of Sophos Home, or Sophos Intercept X Advanced is installed, the steps covered in the following article will apply. 
    - How to recover a tamper protected system

    Once done, I suggest running "Sophos Zap", as this is purpose-built to completely remove Sophos from a device. Using revouninstaller or other uninstaller utilities may leave remnants behind on the device which results in Sophos repairing the installation. 

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids