In this case the scenario is one of the mac machines have Sophos agent and its don't have an tamper protection password.
we are planning to deploy Sophos agent (A new tenant) but it showing the Sophos agent already exist.
Help me to remove the Sophos agent without tamper password to deploy newer one (or) to change the tenant of Sophos central without removing of Sophos agent.
Hi Anishkumar C ,
Thank you for reaching out to our Community Forum. Please follow the following steps to uninstall the Sophos Endpoint on Mac while the Tamper Protection is turned on.
Open terminal
'command + spacebar' search for "terminal"
1. vi kill_sophos
2. Copy the text below, right-click on the terminal window and select 'Paste':
#!/bin/bash
sudo rm -R /Library/Sophos\ Anti-Virus/
sudo rm -R /Library/Application\ Support/Sophos/
sudo rm -R /Library/Preferences/com.sophos.*
sudo rm /Library/LaunchDaemons/com.sophos.*
sudo rm /Library/LaunchAgents/com.sophos.*
sudo rm -R /Library/Extensions/Sophos*
sudo rm -R /Library/Caches/com.sophos.*
3. Press 'Esc' on your keyboard
4. Enter ' :wq' and press return
( Colon W Q Enter)
5. sudo chmod +x kill_sophos
6. Enter the local mac password
7. Run the script by entering below on the terminal
./kill_sophos
8. Enter the password and watch everything die
9. Open Finder and go to 'Applications'
10. Click Remove Sophos Endpoint
11. It’ll then let you remove Sophos Endpoint without the tamper protection password.
Let me know how it goes. Thank you.
Update: The commands above are not supported by Sophos Support. This will no longer work as of version 2024.1. Please call Sophos Support if you require urgent assistance with Tamper Protection on MacOS.
These steps will also work for version 10.4.7, though it's recommended to first try the removal tool. You can also find the removal tool standalone at the following link.
- Sophos Anti-Virus for Mac: Removal tool
