Reinstalling Sophos with Previously Deleted Users

I am a business owner and have several Mac users who were deleted but the agents were not uninstalled. 

I am trying to re-add them to new licenses but the 60 days has passed since they were removed so I can't get their tamper protection passwords so can't remove the agents to reinstall them. 

They are all remote so I do not have physical access to the machines. 

 

Is there any way to remotely remove the agent/have them remove it so that I can reinstall it?

  • Hi  

    Could you please check under recover tamper protection if you are able to see deleted users/devices. Please check this article and let me know how it goes.

  • In reply to Shweta:

    Shweta, 

     

    As I put in the original post, the 60 days has passed since they were deleted so I am unable to recover the tamper protection passwords. 

  • In reply to John Price1:

    You can uninstall it from terminal with a switch for the tamper password I believe.

     

    How to uninstall Sophos Anti-Virus for Mac

    Managed by Sophos Central

    1. Open Terminal and run the command cd /Library/Application\ Support/Sophos/saas/Installer.app/Contents/MacOS/tools/.
    2. Run the command sudo ./InstallationDeployer --remove --tamper_password <pw> where <pw> is the tamper protection password which can be found in the device information on the Sophos Central. 

     

     

    See here for more: https://community.sophos.com/kb/en-us/14179

     

    You should be able to type up instructions on that for a user to complete.  I think any admin user would work but I could be wrong.  You could also try enabling root and then running the command with the password to see if that would take.  If you cannot get someone instructions I believe team viewer has a trial license you could use to remote in.

     

     

  • In reply to Badrobot:

    The user cannot access terminal because the  Sophos agent is blocking it. 

     

    please read the original post, I do not have the tamper protection password as it has been more than 60 days since the user was originally. 

  • In reply to John Price1:

    Again I cannot verify this since I cannot replicate the scenario but you can try to boot the Mac in recovery mode and access terminal from there.

     

    Then you can try to remove Sophos, there are a few links online that show different methods I would look them over.  

    Also have you tried technical support?  They may be able to help.

  • In reply to John Price1:

    Hi  

    I would request you to open a support case and message me the case number. 

  • In reply to Yashraj:

    Support case is 9310151