Uninstalling Sophos Central Endpoint - The Removal Failed

I'm currently unable to uninstall the Sophos Central Endpoint from one of our devices. 

MacOS 10.12.16 Macbook Air 2015

Sophos Central Endpoint version 9.6.3

When I run the Remove Sophos Endpoint app I get this error after I enter the tamper protection password and admin password:

 

I tried uninstalling via the terminal following the steps in this guide:
https://community.sophos.com/kb/en-us/14179

 

 

This is the command I ran and its output:

Justins-MacBook-Air:~ admin$ cd /Library/Application\ Support/Sophos/saas/Installer.app/Contents/MacOS/tools

Justins-MacBook-Air:tools admin$ ls

InstallationDeployer

Justins-MacBook-Air:tools admin$ pwd

/Library/Application Support/Sophos/saas/Installer.app/Contents/MacOS/tools

Justins-MacBook-Air:tools admin$ sudo ./InstallationDeployer --remove --tamper_password 186909911335

Password:

sudo: ./InstallationDeployer: command not found

 

 

I've tried both the application uninstall and command line version with tamper protection enabled and disabled, same results.

  • Hi Brentking,

    Apologies for inconvenience caused,

    Workaround: you can completely remove the Sophos Anti-Virus software from a Mac endpoint by removing the following files and directories. Obviously it will require admin / sudo permissions, and obviously, you should be quite careful as to not remove other things. Here is the list:

    • /Library/Sophos Anti-Virus/
    • /Library/Application Support/Sophos/
    • /Library/Preferences/com.sophos.*
    • /Library/LaunchDaemons/com.sophos.*
    • /Library/LaunchAgents/com.sophos.*
    • /Library/Extensions/Sophos*
    • /Library/Caches/com.sophos.*

    Reboot afterward, to ensure all of the existing processes and kernel extensions are gone from memory.

     
  • In reply to Aditya Patel:

    Thank you Aditya,

     

    Your information helped resolve my issue. I appreciate the quick response.

  • In reply to Aditya Patel:

    Hi Aditya,

     

    I have tried these steps but still have a "Sophos Endpoint" user at login on my Mac.

     

    I have also tried using the "Remove Sophos Endpoint" application, but it results in a failure.

     

    Can you recommend next steps?

     

    Kind regards,

    D

  • In reply to D B1:

    Hello  

    Try using the Removal Tool.

    Info on the Sophos User can be found in this related post.