Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 3 subscribers
  • Views 19916 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot UNInstall Sophos Endpoint -

Alex Friend

Hi,

I have Sophos Endpoint Defense installed on my home standalone laptop. My employer had a contract with Sophos such that they ran a server which managed Sophos on employees' office and personal PCs. This software was installed from my employer's web site around 2011. Sophos is still the AV software of my employer but they recently requested all employees to uninstall Sophos Endpoint and install Sophos Home on their personal laptops as the server service would soon be unavailable.

My problem is that I cannot UNINSTALL Sophos Endpoint. I tried uninstalling it as Administrator on the laptop. In Control Panel it shows these programs for Sophos:

I doubleclicked the first item in the list 'Sophos AV' attempting to uninstall it but after about 30 secs it returned:

However, there is no Sophos Administrator user group on my laptop.

'SophosAdministrator User Group' was most likely my employer's server-side permissions group. It doesn't exist on my laptop.

I checked the the Sophos Endpoint Control console window and it shows the Tamper Protection section greyed out as in the image below:

I assume that there is a group policy or service which needs to be cancelled before I can disable Tamper Protection. But I don't know how to do this.

  • How do I disable Tamper Protection?
  • How do I make myself a Sophos Administrator so I can uninstall?
  • Or, How do I override or cancel the group policy - if that is what is preventing the laptop administrator account from uninstalling it?

When I contacted my employer's help desk about the problem, they didn't know the answer and asked me to contact you.

Thanks in advance for any suggestions.

Alex.



This thread was automatically locked due to age.
Parents
  • 0

    Hello Alex,

    they didn't know the answer
    great ... Employee Home Use is granted under the condition that support is solely through the licensee [:)].
    Anyway - not the first case like this [and I'm not Sophos]. SophosAdministrator is a local (not server-side or AD) security group, it's supposed to exist. If it does, add yourself (i.e. your admin account) to it, if it doesn't create it and add yourself.
    Sophos is installed (and consequently uninstalled) using the Windows Installer - and it doesn't run in Safe Mode.

    Christian

Reply
  • 0

    Hello Alex,

    they didn't know the answer
    great ... Employee Home Use is granted under the condition that support is solely through the licensee [:)].
    Anyway - not the first case like this [and I'm not Sophos]. SophosAdministrator is a local (not server-side or AD) security group, it's supposed to exist. If it does, add yourself (i.e. your admin account) to it, if it doesn't create it and add yourself.
    Sophos is installed (and consequently uninstalled) using the Windows Installer - and it doesn't run in Safe Mode.

    Christian

Children
  • 0 in reply to QC

    I have Windows 7 Home Premium and there is no means of creating a local group through the windows user interface.

    I tried the following in a cmd window as local administrator:

    net localgroup SophosAdministrator /add

    but it returned

    "System error 5 has occurred. Access denied."

    Alex.

  • 0 in reply to Alex Friend

    From a google search I got round the "system error 5" problem and added my admin account to the SophosAdministrators group.

    In Sophos Endpoint Control Console the Tamper Protection command is now available and  I've UNchecked 'Enable Tamper Protection'.

    Authenticate User is still greyed out.

    Is there anything more I need to configure before attempting to uninstall Sophos?

    Alex.

  • 0 in reply to Alex Friend

    Just to add that Authenticate User became available (not sure what I did to cause that) and I authenticated my admin account and the tamper protection log confirms that admin has been added as an authenticated user.

    A.

  • 0 in reply to Alex Friend

    Hello Alex,

    Authenticate User is for authentication to Tamper Protection - if TP is disabled there's no need for a SophosAdministrator to perform authentication in order to turn off TP (its purpose is to restrict a local Windows administrator's rights w.r.t. the AV settings).
    But were you able to uninstall?

    Christian

  • 0 in reply to QC

    Hi Christian,

    Yes, I just uninstalled without problem and am now in process of installing Sophos Home.

    Thanks very much for your help!

    Have a good day.

    Alex.

Unfiltered HTML