Cloud account expired, cannot disable tamper protection macOS

Hello Sophos,

I'm stuck, unable to remove Sophos from macOS. (tamper protected)

I had, 'Cloud Sophos Intercept X license for Servers and Endpoint' Licenses expired earlier in the year.

Foolishly I forgot to disable tamper protection before the licenses expired. I don't have access to the portal, I can log in but reports, policies etc, are inaccessible. 

I have used tamper protection workarounds for Windows servers and Windows endpoints (SophosZap and Reg edit hacks etc). Successfully uninstalled (while painful) from these devices. Lesson learned. 

However, for macOS I cannot uninstall Sophos due to tamper protection. I have tried everything I can find to remove the product (GitHub using terminal but cannot get around the keychain lockout)

My options, rebuilding macOS workstations or buying Sophos endpoint for macOS and re-activating my account, then disabling tamper protection. Frankly, it would be cheaper to buy Sophos again than re-building the workstations....

Your help would be greatly appreciated. 

Kindest regards,


Added tags
[edited by: Gladys at 10:09 AM (GMT -7) on 24 Apr 2024]