Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 2 answers
  • Subscribers 5 subscribers
  • Views 42827 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Script UNISTALL SOPHOS ENDPOINT

AyoubSEFYAOUI

Hi There , 

So , i'm trying to remove sophos by using a script , i tried severals scripts but it doesn't work , he just disable and stop the sophos services 

 

Is there any File batch or script that can remove sophos definitely plzz 

 

Thank you 



This thread was automatically locked due to age.
  • 0 in reply to QC

    Hello QC , 

     

    I did a bat file like bellow , But i can see always the sophos endpoint icon in the control panel : 

    net stop "Sophos AutoUpdate Service"
    net stop "Sophos Agent"
    net stop "SAVService"
    net stop "SAVAdminService"
    net stop "Sophos Message Router"
    net stop "Sophos Web Control Service"
    net stop "swi_service"
    net stop "SntpService"
    net stop "sophossps"
    net stop "swi_filter"

    MsiExec.exe /X{66967E5F-43E8-4402-87A4-04685EE5C2CB} /qn
    MsiExec.exe /X{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} /qn
    MsiExec.exe /X{66967E5F-43E8-4402-87A4-04685EE5C2CB} /qn REBOOT=SUPPRESS
    MsiExec.exe /X{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} /qn REBOOT=SUPPRESS

     

  • 0 in reply to AyoubSEFYAOUI

    Hello AyoubSEFYAOUI,

    this is the complete script (why the same products twice) or just a part? Or can you find only these two Sophos products (SSP and NTP/MTD) under the Uninstall Registry keys? Did you check on the HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ path as well? Among others AutoUpdate and SAV would be there.

    Christian

  • 0

    I used this script to remove on-cloud/premise but should you recheck the string parameter for new version.

    Just you save to bat file.

    net stop "Sophos Anti-Virus"
    net stop "Sophos AutoUpdate Service"
    "C:\program files\Sophos\Sophos Endpoint Agent\uninstallcli.exe"
    :Sophos AutoUpdate
    MsiExec.exe /qn /X{7CD26A0C-9B59-4E84-B5EE-B386B2F7AA16} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{BCF53039-A7FC-4C79-A3E3-437AE28FD918} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{9D1B8594-5DD2-4CDC-A5BD-98E7E9D75520} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{E82DD0A8-0E5C-4D72-8DDE-41BB0FC06B3E} REBOOT=ReallySuppress
    :Sophos Anti-Virus (Endpoint)
    MsiExec.exe /qn /X{8123193C-9000-4EEB-B28A-E74E779759FA} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{36333618-1CE1-4EF2-8FFD-7F17394891CE} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{DFDA2077-95D0-4C5F-ACE7-41DA16639255} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{CA3CE456-B2D9-4812-8C69-17D6980432EF} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{3B998572-90A5-4D61-9022-00B288DD755D} REBOOT=ReallySuppress
    :Sophos Anti-Virus (Server)
    MsiExec.exe /qn /X{72E30858-FC95-4C87-A697-670081EBF065} REBOOT=ReallySuppress
    :Sophos System Protection
    MsiExec.exe /qn /X{934BEF80-B9D1-4A86-8B42-D8A6716A8D27} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} REBOOT=ReallySuppress
    :Sophos Network Threat Protection
    MsiExec.exe /qn /X{66967E5F-43E8-4402-87A4-04685EE5C2CB} REBOOT=ReallySuppress
    :Sophos Health
    MsiExec.exe /qn /X{A5CCEEF1-B6A7-4EB4-A826-267996A62A9E} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{D5BC54B8-1DA1-44F4-AE6F-86E05CDB0B44} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{E44AF5E6-7D11-4BDF-BEA8-AA7AE5FE6745} REBOOT=ReallySuppress
    :SDU (1.x)
    MsiExec.exe /qn /X{4627F5A1-E85A-4394-9DB3-875DF83AF6C2} REBOOT=ReallySuppress
    :Heartbeat
    MsiExec.exe /qn /X{DFFA9361-3625-4219-82C2-9EF011E433B1} REBOOT=ReallySuppress
    :Sophos Management Communications System
    MsiExec.exe /qn /X{A1DC5EF8-DD20-45E8-ABBD-F529A24D477B} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{1FFD3F20-5D24-4C9A-B9F6-A207A53CF179} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{D875F30C-B469-4998-9A08-FE145DD5DC1A} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{2C14E1A2-C4EB-466E-8374-81286D723D3A} REBOOT=ReallySuppress
    MsiExec.exe /qn /X{FED1005D-CBC8-45D5-A288-FFC7BB304121} REBOOT=ReallySuppress
    :UI
    MsiExec.exe /qn /X{D29542AE-287C-42E4-AB28-3858E13C1A3E} REBOOT=ReallySuppress
    :SophosClean
    "C:\Program Files\Sophos\Clean\uninstall.exe"
    :SED
    "C:\Program Files\Sophos\Endpoint Defense\uninstall.exe" /quiet
    :HMPA (managed) 3.5.3.563
    "C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe" /uninstall /quiet
    :HMPA 1.0.0.699
    "C:\Program Files (x86)\HitmanPro.Alert\uninstall.exe" /uninstall /quiet
    :HMPA 3.7.14.265
    "C:\Program Files\HitmanPro\HitmanPro.exe" /uninstall /quiet

     

  • 0

    I created a batch file that is deployed via GPO. It stops the update service, and then uninstalls the various components installed in our environment.  Info on finding the reg keys for your environment - https://community.sophos.com/kb/en-us/109668

    Also make sure you first disable tamper protection in your console - https://community.sophos.com/kb/en-us/119175

    The GPO is under Computer Configuration -> Policies -> Windows Settings -> Scripts -> Startup

    ----------------------------

    net stop "Sophos AutoUpdate Service"

    ::Sophos Remote Management System

    MsiExec.exe /X{FED1005D-CBC8-45D5-A288-FFC7BB304121} /qn REBOOT=SUPPRESS

    ::Sophos Network Threat Protection

    MsiExec.exe /X{604350BF-BE9A-4F79-B0EB-B1C22D889E2D} /qn REBOOT=SUPPRESS

    ::Sophos Endpoint Defense

    "C:\Program Files\Sophos\Endpoint Defense\uninstall.exe" /quiet

    ::Sophos Anti-Virus

    MsiExec.exe /X{01423865-551B-4C59-B44A-CC604BC21AF3} /qn REBOOT=SUPPRESS

    ::Sophos AutoUpdate

    MsiExec.exe /X{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54} /qn REBOOT=SUPPRESS

    ----------------------------

Unfiltered HTML