This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Uninstall Sophos in MAC without tamper protection password

In this case the scenario is one of the mac machines have Sophos agent and its don't have an tamper protection password.
we are planning to deploy Sophos agent (A new tenant) but it showing the Sophos agent already exist.

Help me to remove the Sophos agent without tamper password to deploy newer one (or) to change the tenant of Sophos central without removing of Sophos agent.



This thread was automatically locked due to age.
  • Hi  ,

    Thank you for reaching out to our Community Forum. Please follow the following steps to uninstall the Sophos Endpoint on Mac while the Tamper Protection is turned on.

    Open terminal
    'command + spacebar' search for "terminal"

    1. vi kill_sophos
    2. Copy the text below, right-click on the terminal window and select 'Paste':
    #!/bin/bash
    sudo rm -R /Library/Sophos\ Anti-Virus/
    sudo rm -R /Library/Application\ Support/Sophos/
    sudo rm -R /Library/Preferences/com.sophos.*
    sudo rm /Library/LaunchDaemons/com.sophos.*
    sudo rm /Library/LaunchAgents/com.sophos.*
    sudo rm -R /Library/Extensions/Sophos*
    sudo rm -R /Library/Caches/com.sophos.*
    3. Press 'Esc' on your keyboard
    4. Enter ' :wq' and press return
    ( Colon W Q Enter)
    5. sudo chmod +x kill_sophos
    6. Enter the local mac password
    7. Run the script by entering below on the terminal
    ./kill_sophos
    8. Enter the password and watch everything die
    9. Open Finder and go to 'Applications'
    10. Click Remove Sophos Endpoint
    11. It’ll then let you remove Sophos Endpoint without the tamper protection password.

    Let me know how it goes. Thank you.

    Update: The commands above are not supported by Sophos Support. This will no longer work as of version 2024.1. Please call Sophos Support if you require urgent assistance with Tamper Protection on MacOS. 

    Gladys Reyes
    Global Community Support Engineer
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
  • Thanks Gladys,

    Its working fine we have uninstalled and reinstalled successfully.

    once again thanks for the guidance.

  • Do these instructions apply to Endpoint 10.4.7 ?

  • These steps will also work for version 10.4.7, though it's recommended to first try the removal tool. You can also find the removal tool standalone at the following link.
    - Sophos Anti-Virus for Mac: Removal tool

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids