turn off tamper protection via terminal on mac

Hi Sophos User1175 ,

Thank you for reaching out to the Sophos Community forum.

May I know what's the macOS version running on your device? Are you trying to turn off the tamper protection to uninstall the endpoint?

thank you Gladys its macOS monterey and above

thank you Gladys its macOS monterey and above

Hi Sophos User1175 ,

Upon checking, there's no way to turn off the Tamper Protection via the terminal. However, if you would like to remove the Sophos endpoint without turning off the TP, then you may check out the provided answers in this thread - community.sophos.com/.../uninstall-sophos-in-mac-without-tamper-protection-password

Gladys - this process worked for me a couple weeks ago, but today the "sudo rm" commands all return "Operation not permitted". The installed Sophos version is 2024.1.0.49 and I've reproduced this on both MacOS 13.6.1 and 14.3.1

Can you provide an update?

As of version 2024.1 and later, Tamper Protection can only be disabled from Sophos Central or using the "Admin Login" option on the local Endpoint UI. If your situation is urgent, I'd suggest calling Sophos Support using the regional phone numbers on the following page. 
- Sophos Contact Support

If the device has been deleted or is no longer present in Sophos Central, you can find the password from the "Recover tamper protection passwords" page. 

That really doesn't help. We keep finding Macs where Sophos is installed and TP is enabled, but they're not registered with our tenant. So there's no password in the tenant for us to recover. They were installed with the correct installer from our tenant but the registration went wrong somehow, and we only find this out when there's a problem much later.