Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 7 replies
  • Answers 2 answers
  • Subscribers 4 subscribers
  • Views 14619 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot delete Sophos Endpoint as Administrator

Philip Richardson

I am using a MacBook Pro. I had Sophos Endpoint as free anti-virus software. I have deleted Sophos from Applications and emptied the trash. No Sophos applications appear to be left on my MacBook. However, Sophos Endpoint still appears as an administrator when I boot up the computer to log in. If I go into "Users and Groups" in System Preferences, Sophos Endpoint does not appear, so I cannot delete it in the usual way that one would delete an administrator. What can I do to delete it? Thank you for your assistance.



This thread was automatically locked due to age.
  • 0

    Hello there,

    Thank you for reaching community forum. With regards to this query, you may follow the steps listed in this knowledge base Article. Please don't hesitate to reach us if you face any issues while applying the steps. 

    Glenn ArchieSeñas (GlennSen)
    Global Community Support Engineer

    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to GlennSen

    Thank you Glenn for sharing this article. I don't think I had seen this before.

    Under "Information" you have the line:

    "The removal tool will work with all releases of Sophos Anti-Virus for Mac. To use the tool, follow the steps below:

    Download the Removal Tool for Sophos Anti-Virus." When I do and try to open it, I get the message:

    “Remove Sophos Endpoint” can’t be opened because Apple cannot check it for malicious software." I then get a request to contact the developer for further information. 

    Anyway, I also note this instruction in the article:

    "MacOS 12.1 and higher

    Remove Sophos Endpoint.app requires user consent on MacOS 12.1, but it does not trigger the dialog properly. This only occurs on MacOS 12.1 and higher at this time. This has been raised with Apple. The workaround for this is as follows: 

    After opening Terminal, I note this command to type in: Run: sudo /Library/Application\ Support/Sophos/saas/Installer.app/Contents/MacOS/tools/InstallationDeployer --remove  "

    I'm assuming that "Run" is not part of the command? Then is this one command or two? That is, is "sudo /Library/Application\" one command, followed by the next line as second command? Either way (entering as just one command or two) after entering the command, the word "Password" appears on a new line next to the icon of a key. However it doesn't let me enter a password, nor is it clear which password it requires.

    Please advise. Thank you.

  • 0 in reply to Philip Richardson

    Hi ,

    For macOS 12.1 and later, you must use the Terminal commands due to Apple restrictions. The removal tool can be used with Terminal commands. You can find the steps here - https://support.sophos.com/support/s/article/KB-000033340?language=en_US .

    Let me know if this helps. Thank you.

    Gladys Reyes
    Global Community Support Engineer
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to Gladys

    Thank you, Gladys. I wasn't clear which of the options in this link is the one I should follow. However, I have tried all of them! I either get the response: "cd: no such file or directory:" or "zsh: event not found: Ld2>" etc. Sometimes the word "password" then appears next to a key icon. If it is asking for a password (which is not clear), there doesn't seem to be a way of entering one (it won't then let me type anything like a password). Please advise!

  • 0 in reply to Philip Richardson

    Hi ,

    Thank you for the update. If you haven't already, kindly have the Root account enabled, you may refer to the following article from Apple , and then use the Terminal commands again to remove Sophos. Let us know how it goes.

    Gladys Reyes
    Global Community Support Engineer
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to Gladys

    Thank you, Gladys. I was successful in following those instructions and logging in as Root, but I was unsuccessful in uninstalling Sophos even when logged in as Root. I tried each of the possible uninstall methods set out in your support page you sent me previously (although the line "Re-perform the Terminal uninstall command for your product" is unclear since there is more than one option! However, I tried all of them). I must say this is the most complicated app I have ever had to uninstall!

  • 0 in reply to Philip Richardson

    I've not received a reply to my last message from 3 months ago. Any further suggestions? Sophos Endpoint still appears as a "User" on booting up the MacBook even though according to "Users and Groups" in Applications it isn't there. Does it need to be quite this difficult to uninstall the user when the application itself has been uninstalled? Thanks for your help.

Unfiltered HTML