Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 14 subscribers
  • Views 19034 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Uninstalling Sophos after deleting endpoint

Robert Romig

I've got an endpoint that had Sophos installed on it and was deleted from Sophos Central.  I've followed the instructions from KB 124377 about recovering a tamper-protected endpoint, but two of the registry changes are reverted upon reboot:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection (set to 0, reverts to 1)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config\SAVEnabled (Set to 0, reverts to 1)

Attempting to reinstall gives an error that Tamper Protection must be disabled.  Attempting to uninstall from Programs and Features fails with an error message saying "Uninstallation failed.  Unable to locate Sophos Health MSI".

Any advice on being able to reinstall Sophos so that this endpoint reappears in the Sophos Central console would be appreciated.



This thread was automatically locked due to age.
Parents
  • 0

    Hello Robert Romig,

    [I'm not using Central so I can't test or confirm the possible cause for the revert]
    did you disable the services, in particular the MCS agent?

    Unable to locate Sophos Health MSI
    dunno if the MSI is cached as for most other components. If then the Installer should first try the cached MSI, if not found fall back to the InstallSource in AutoUpdate's cache. Did you already uninstall other components?

    Christian

Reply
  • 0

    Hello Robert Romig,

    [I'm not using Central so I can't test or confirm the possible cause for the revert]
    did you disable the services, in particular the MCS agent?

    Unable to locate Sophos Health MSI
    dunno if the MSI is cached as for most other components. If then the Installer should first try the cached MSI, if not found fall back to the InstallSource in AutoUpdate's cache. Did you already uninstall other components?

    Christian

Children
No Data
Unfiltered HTML