Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 3 subscribers
  • Views 3804 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't Uninstall Sophos Endpoint Control (Sophos Central)

TitanRob16

Hi all,

We're currently using Sophos Cloud and one of our users has reported multiple Sophos icons appearing in her system tray. I've attempted to uninstall Sophos and reinstall it, but I receive the error message: "Please disable tamper protection before uninstalling." I've tried to use the Tamper Protection password from Sophos Central and have also tried resetting it, but the application doesn't recognise any of the passwords. 

I followed the advice in this article: http://sophos.com/kb/124377 but this hasn't worked as I'm still receiving the same error message. I've also tried to run the Microsoft Fix-It tool to no avail. How can I remove this software and reinstall it? 

Any help with this would be greatly appreciated. 



This thread was automatically locked due to age.
Parents
  • 0

    Hello RobCheale,

    as you mention Central the question is probably better asked in the applicable Central forum.
    If there are indeed multiple icons in the tray then it's perhaps a complex issue. The icon is displayed by almon.exe which is started with the user session. Does the same GUI open from these icons? Is there more than one instance of almon.exe running? Guess there's only one SAV version in Programs and Features (which one?). Without Endpoint Defense it should be possible to bypass TP by stopping all Sophos services.

    Christian

Reply
  • 0

    Hello RobCheale,

    as you mention Central the question is probably better asked in the applicable Central forum.
    If there are indeed multiple icons in the tray then it's perhaps a complex issue. The icon is displayed by almon.exe which is started with the user session. Does the same GUI open from these icons? Is there more than one instance of almon.exe running? Guess there's only one SAV version in Programs and Features (which one?). Without Endpoint Defense it should be possible to bypass TP by stopping all Sophos services.

    Christian

Children
  • 0 in reply to QC

    Hi Christian,

     

    Apologies - is it possible to move this thread to the appropriate place? 

    No, as soon as the user hovers over these icons in the system tray, they disappear one by one until one is left. That's the one she's then able to interact with. 

    I've tried stopping all of the services, but we still receive the message about Tamper Protection. 

  • 0 in reply to TitanRob16

    Hello RobCheale,

    is it possible to move this thread
    not sure if you can do it as user,     I've started already as moderator so I don't know. I could move it but I can do so only if you have joined the Central group first.

    they disappear one by one
    that suggests that the almon.exe process     crashes (for whatever reason).

    You did check the mentioned registry keys, didn't you? Which components are still installed, which did you try to uninstall?
    we still receive the message
    AFAIK it's an Installer CustomAction which does the check and it used to "ask" SavService about the TP status with the obvious decision to consider TP off if the service doesn't respond (obvious because otherwise an issue with SavService effect a Catch22). Don't think this has significantly changed. Shouldn't make a difference but you could try to disable all Sophos servcies, reboot, and then uninstall.

    Christian

  • 0 in reply to QC

    Thanks, Christian. I'll try it again soon.


    Regards,

     

    Rob

Unfiltered HTML