Cannot delete Sophos Endpoint as Administrator

Hello there,

Thank you for reaching community forum. With regards to this query, you may follow the steps listed in this knowledge base Article. Please don't hesitate to reach us if you face any issues while applying the steps. 

Thank you Glenn for sharing this article. I don't think I had seen this before.

Under "Information" you have the line:

"The removal tool will work with all releases of Sophos Anti-Virus for Mac. To use the tool, follow the steps below:

Download the Removal Tool for Sophos Anti-Virus." When I do and try to open it, I get the message:

“Remove Sophos Endpoint” can’t be opened because Apple cannot check it for malicious software." I then get a request to contact the developer for further information. 

Anyway, I also note this instruction in the article:

"MacOS 12.1 and higher

Remove Sophos Endpoint.app requires user consent on MacOS 12.1, but it does not trigger the dialog properly. This only occurs on MacOS 12.1 and higher at this time. This has been raised with Apple. The workaround for this is as follows: 

After opening Terminal, I note this command to type in: Run: sudo /Library/Application\ Support/Sophos/saas/Installer.app/Contents/MacOS/tools/InstallationDeployer --remove  "

I'm assuming that "Run" is not part of the command? Then is this one command or two? That is, is "sudo /Library/Application\" one command, followed by the next line as second command? Either way (entering as just one command or two) after entering the command, the word "Password" appears on a new line next to the icon of a key. However it doesn't let me enter a password, nor is it clear which password it requires.

Please advise. Thank you.

Hi Philip Richardson,

For macOS 12.1 and later, you must use the Terminal commands due to Apple restrictions. The removal tool can be used with Terminal commands. You can find the steps here - https://support.sophos.com/support/s/article/KB-000033340?language=en_US .

Let me know if this helps. Thank you.

Thank you, Gladys. I wasn't clear which of the options in this link is the one I should follow. However, I have tried all of them! I either get the response: "cd: no such file or directory:" or "zsh: event not found: Ld2>" etc. Sometimes the word "password" then appears next to a key icon. If it is asking for a password (which is not clear), there doesn't seem to be a way of entering one (it won't then let me type anything like a password). Please advise!

Hi Philip Richardson,

Thank you for the update. If you haven't already, kindly have the Root account enabled, you may refer to the following article from Apple , and then use the Terminal commands again to remove Sophos. Let us know how it goes.

Thank you, Gladys. I was successful in following those instructions and logging in as Root, but I was unsuccessful in uninstalling Sophos even when logged in as Root. I tried each of the possible uninstall methods set out in your support page you sent me previously (although the line "Re-perform the Terminal uninstall command for your product" is unclear since there is more than one option! However, I tried all of them). I must say this is the most complicated app I have ever had to uninstall!

I've not received a reply to my last message from 3 months ago. Any further suggestions? Sophos Endpoint still appears as a "User" on booting up the MacBook even though according to "Users and Groups" in Applications it isn't there. Does it need to be quite this difficult to uninstall the user when the application itself has been uninstalled? Thanks for your help.

I've not received a reply to my last message from 3 months ago. Any further suggestions? Sophos Endpoint still appears as a "User" on booting up the MacBook even though according to "Users and Groups" in Applications it isn't there. Does it need to be quite this difficult to uninstall the user when the application itself has been uninstalled? Thanks for your help.