uninstallation failed. failed to uninstall {component}

uninstallation failed. failed to uninstall {component}

Tried uninstall sophos agent for reinstall but no luck.Any workaround here you can advise. 

Thanks 

Regards



Added TAGs
[edited by: Qoosh at 11:02 PM (GMT -8) on 12 Dec 2022]
  • Hi  ,

    Thank you for reaching out to the Community Forum. What is the specific error message that you're getting? First, ensure that the Tamper Protection has been disabled - support.sophos.com/.../KB-000034808

    Once it's turned off you may then uninstall using the SophosZap.

    Let me know how it goes. Thank you.

    Gladys Reyes
    Global Community Support Engineer
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
  • Hi  
    Thanks for your reply. Temper Protection is off, Server lock is not enabled. Wanted to reinstall but uninstall from control panel and Zaptool is not working. When i tried to uninstall from control panel it simply stucks on File Integrity Monitoring component resulting to a failure. Tried changing registry folder values  but no luck. What else is there to uninstall the agent. 

    Thank You

    Bilal

  • Hi  ,

    Thanks for getting back to me. What happens when you run the SophosZap? If you can share snapshots of any error messages, that would be great.

    Have you also tried to uninstall using a command line or batch file? You may refer to the following article and see if it helps to completely uninstall Sophos - Sophos Central Endpoint and Server: Uninstall Sophos using the command line or a batch file.

    Gladys Reyes
    Global Community Support Engineer
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
  • Glayds,

    Please find the ZapLogs.


    2022-10-26T16:25:31.809Z 20452 INFO : ==== Started C:\\Users\\shahbaaz-srvadmin\\AppData\\Local\\Temp\\SophosZap-1668856981\\SophosZapHelper.exe ====
    2022-10-26T16:25:31.819Z 20452 INFO : Running version 1.4.146.0
    2022-10-26T16:25:31.844Z 20452 INFO : Parent process ID: 20444
    2022-10-26T16:25:31.844Z 20452 INFO : Running SophosZap functionality on x64 bit architecture
    2022-10-26T16:25:31.854Z 20452 INFO : Intialising COM subsystem.
    2022-10-26T16:25:31.874Z 20452 INFO : Performing prerequisite checks.
    2022-10-26T16:25:31.894Z 20452 ERROR : SophosZap exception. Exception message='AdjustTokenPrivileges (last error, SeDebugPrivilege)' failed. Code=system:1300: Not all privileges or groups referenced are assigned to the caller.
    2022-10-26T16:25:31.904Z 20452 INFO : Outcome error flag: 1
    2022-10-26T16:25:31.914Z 20452 INFO : Outcome reboot required: 0
    2022-10-26T16:25:31.914Z 20452 INFO : Summary of errors, see above for details:
    2022-10-26T16:25:31.919Z 20452 INFO : Failure reason: SophosZap exception
    2022-10-26T16:25:31.929Z 20452 ERROR : An error occurred. See log file for errors
    2022-10-26T16:26:05.194Z 20160 INFO : ==== Started C:\\Users\\shahbaaz-srvadmin\\AppData\\Local\\Temp\\SophosZap-205144789\\SophosZapHelper.exe ====
    2022-10-26T16:26:05.199Z 20160 INFO : Running version 1.4.146.0
    2022-10-26T16:26:05.204Z 20160 INFO : Parent process ID: 20272
    2022-10-26T16:26:05.204Z 20160 INFO : Running SophosZap functionality on x64 bit architecture
    2022-10-26T16:26:05.209Z 20160 INFO : Intialising COM subsystem.
    2022-10-26T16:26:05.214Z 20160 INFO : Performing prerequisite checks.
    2022-10-26T16:26:05.214Z 20160 ERROR : SophosZap exception. Exception message='AdjustTokenPrivileges (last error, SeDebugPrivilege)' failed. Code=system:1300: Not all privileges or groups referenced are assigned to the caller.
    2022-10-26T16:26:05.219Z 20160 INFO : Outcome error flag: 1
    2022-10-26T16:26:05.219Z 20160 INFO : Outcome reboot required: 0
    2022-10-26T16:26:05.224Z 20160 INFO : Summary of errors, see above for details:
    2022-10-26T16:26:05.224Z 20160 INFO : Failure reason: SophosZap exception
    2022-10-26T16:26:05.224Z 20160 ERROR : An error occurred. See log file for errors
    2022-10-30T12:11:04.387Z 3148 INFO : ==== Started C:\\Users\\shahbaaz-srvadmin\\AppData\\Local\\Temp\\SophosZap-1140902242\\SophosZapHelper.exe ====
    2022-10-30T12:11:04.392Z 3148 INFO : Running version 1.4.146.0
    2022-10-30T12:11:04.622Z 3148 INFO : Parent process ID: 3108
    2022-10-30T12:11:04.622Z 3148 INFO : Running SophosZap functionality on x64 bit architecture
    2022-10-30T12:11:04.622Z 3148 INFO : Intialising COM subsystem.
    2022-10-30T12:11:04.622Z 3148 INFO : Performing prerequisite checks.
    2022-10-30T12:11:04.627Z 3148 ERROR : SophosZap exception. Exception message='AdjustTokenPrivileges (last error, SeDebugPrivilege)' failed. Code=system:1300: Not all privileges or groups referenced are assigned to the caller.
    2022-10-30T12:11:04.627Z 3148 INFO : Outcome error flag: 1
    2022-10-30T12:11:04.627Z 3148 INFO : Outcome reboot required: 0
    2022-10-30T12:11:04.627Z 3148 INFO : Summary of errors, see above for details:
    2022-10-30T12:11:04.627Z 3148 INFO : Failure reason: SophosZap exception
    2022-10-30T12:11:04.627Z 3148 ERROR : An error occurred. See log file for errors

    I tried all but not with CMD yet. 

  • Hi  ,

    Thanks for sharing these. Looking at the logs, it's most likely a permission/assignment issue within the Global Policy settings. The credentials being used might not have the required permissions to complete the uninstallation.

    Kindly confirm, or if there's another administrator credential that you can use, you may also try that.

    Gladys Reyes
    Global Community Support Engineer
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
  • Hi  

    I tried with different admin credentials but no luck.

  • Hi  ,

    I found a few more steps that we can try. Please execute the SophosZap command through NT authority\system in PowerShell. You may look at this article if you need a reference - https://techexpert.tips/powershell/powershell-start-command-prompt-nt-authority-system/.

    This might require you to restart the machine and re-execute SophosZap. If this is a production server, please schedule some time for the reboot.

    Let me know how it goes. Thank you.

    Gladys Reyes
    Global Community Support Engineer
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids