uninstallation failed. failed to uninstall {component}

Hi BilalAmjad ,

Thank you for reaching out to the Community Forum. What is the specific error message that you're getting? First, ensure that the Tamper Protection has been disabled - support.sophos.com/.../KB-000034808

Once it's turned off you may then uninstall using the SophosZap.

Let me know how it goes. Thank you.

Hi Gladys 
Thanks for your reply. Temper Protection is off, Server lock is not enabled. Wanted to reinstall but uninstall from control panel and Zaptool is not working. When i tried to uninstall from control panel it simply stucks on File Integrity Monitoring component resulting to a failure. Tried changing registry folder values  but no luck. What else is there to uninstall the agent. 

Thank You

Bilal

Hi BilalAmjad ,

Thanks for getting back to me. What happens when you run the SophosZap? If you can share snapshots of any error messages, that would be great.

Have you also tried to uninstall using a command line or batch file? You may refer to the following article and see if it helps to completely uninstall Sophos - Sophos Central Endpoint and Server: Uninstall Sophos using the command line or a batch file.

Glayds,

Please find the ZapLogs.

2022-10-26T16:25:31.809Z 20452 INFO : ==== Started C:\\Users\\shahbaaz-srvadmin\\AppData\\Local\\Temp\\SophosZap-1668856981\\SophosZapHelper.exe ====
2022-10-26T16:25:31.819Z 20452 INFO : Running version 1.4.146.0
2022-10-26T16:25:31.844Z 20452 INFO : Parent process ID: 20444
2022-10-26T16:25:31.844Z 20452 INFO : Running SophosZap functionality on x64 bit architecture
2022-10-26T16:25:31.854Z 20452 INFO : Intialising COM subsystem.
2022-10-26T16:25:31.874Z 20452 INFO : Performing prerequisite checks.
2022-10-26T16:25:31.894Z 20452 ERROR : SophosZap exception. Exception message='AdjustTokenPrivileges (last error, SeDebugPrivilege)' failed. Code=system:1300: Not all privileges or groups referenced are assigned to the caller.
2022-10-26T16:25:31.904Z 20452 INFO : Outcome error flag: 1
2022-10-26T16:25:31.914Z 20452 INFO : Outcome reboot required: 0
2022-10-26T16:25:31.914Z 20452 INFO : Summary of errors, see above for details:
2022-10-26T16:25:31.919Z 20452 INFO : Failure reason: SophosZap exception
2022-10-26T16:25:31.929Z 20452 ERROR : An error occurred. See log file for errors
2022-10-26T16:26:05.194Z 20160 INFO : ==== Started C:\\Users\\shahbaaz-srvadmin\\AppData\\Local\\Temp\\SophosZap-205144789\\SophosZapHelper.exe ====
2022-10-26T16:26:05.199Z 20160 INFO : Running version 1.4.146.0
2022-10-26T16:26:05.204Z 20160 INFO : Parent process ID: 20272
2022-10-26T16:26:05.204Z 20160 INFO : Running SophosZap functionality on x64 bit architecture
2022-10-26T16:26:05.209Z 20160 INFO : Intialising COM subsystem.
2022-10-26T16:26:05.214Z 20160 INFO : Performing prerequisite checks.
2022-10-26T16:26:05.214Z 20160 ERROR : SophosZap exception. Exception message='AdjustTokenPrivileges (last error, SeDebugPrivilege)' failed. Code=system:1300: Not all privileges or groups referenced are assigned to the caller.
2022-10-26T16:26:05.219Z 20160 INFO : Outcome error flag: 1
2022-10-26T16:26:05.219Z 20160 INFO : Outcome reboot required: 0
2022-10-26T16:26:05.224Z 20160 INFO : Summary of errors, see above for details:
2022-10-26T16:26:05.224Z 20160 INFO : Failure reason: SophosZap exception
2022-10-26T16:26:05.224Z 20160 ERROR : An error occurred. See log file for errors
2022-10-30T12:11:04.387Z 3148 INFO : ==== Started C:\\Users\\shahbaaz-srvadmin\\AppData\\Local\\Temp\\SophosZap-1140902242\\SophosZapHelper.exe ====
2022-10-30T12:11:04.392Z 3148 INFO : Running version 1.4.146.0
2022-10-30T12:11:04.622Z 3148 INFO : Parent process ID: 3108
2022-10-30T12:11:04.622Z 3148 INFO : Running SophosZap functionality on x64 bit architecture
2022-10-30T12:11:04.622Z 3148 INFO : Intialising COM subsystem.
2022-10-30T12:11:04.622Z 3148 INFO : Performing prerequisite checks.
2022-10-30T12:11:04.627Z 3148 ERROR : SophosZap exception. Exception message='AdjustTokenPrivileges (last error, SeDebugPrivilege)' failed. Code=system:1300: Not all privileges or groups referenced are assigned to the caller.
2022-10-30T12:11:04.627Z 3148 INFO : Outcome error flag: 1
2022-10-30T12:11:04.627Z 3148 INFO : Outcome reboot required: 0
2022-10-30T12:11:04.627Z 3148 INFO : Summary of errors, see above for details:
2022-10-30T12:11:04.627Z 3148 INFO : Failure reason: SophosZap exception
2022-10-30T12:11:04.627Z 3148 ERROR : An error occurred. See log file for errors

I tried all but not with CMD yet. 

Hi BilalAmjad ,

Thanks for sharing these. Looking at the logs, it's most likely a permission/assignment issue within the Global Policy settings. The credentials being used might not have the required permissions to complete the uninstallation.

Kindly confirm, or if there's another administrator credential that you can use, you may also try that.

Hi Gladys 

I tried with different admin credentials but no luck.

Hi BilalAmjad ,

I found a few more steps that we can try. Please execute the SophosZap command through NT authority\system in PowerShell. You may look at this article if you need a reference - https://techexpert.tips/powershell/powershell-start-command-prompt-nt-authority-system/.

This might require you to restart the machine and re-execute SophosZap. If this is a production server, please schedule some time for the reboot.

Let me know how it goes. Thank you.

Hi BilalAmjad ,

I found a few more steps that we can try. Please execute the SophosZap command through NT authority\system in PowerShell. You may look at this article if you need a reference - https://techexpert.tips/powershell/powershell-start-command-prompt-nt-authority-system/.

This might require you to restart the machine and re-execute SophosZap. If this is a production server, please schedule some time for the reboot.

Let me know how it goes. Thank you.