How to uninstall Sophos with tamper protection remotely?

Hello Quabena,

are you indeed talking about the on-premise ESC or perhaps Central/Intercept X?

we never planned to be working remotely
Do I understand correctly that previously when you had machines that [you had] to uninstall and re-install Sophos client (question is why and how often) Desktop support stopped by, booted into Safe Mode, disabled TP, rebooted, and un- and re-installed? Now that the machines are remote you can't disable TP remotely but if you could you could reinstall? 
better tools
what exactly do you need? Both ESC and Central allow TP to be turned off remotely. If this doesn't work some other tool would likewise fail unless it has an independent communication channel. If somehow the TP password is lost you'd need an equivalent of the PUK for SIM cards as some general tool that could disable TP without any secret would a priori annul TP., similarly a no-questions-asked uninstaller.

Last but not least - what happened to the machines that you have to uninstall?

Christian

Hello Quabena,

are you indeed talking about the on-premise ESC or perhaps Central/Intercept X?

we never planned to be working remotely
Do I understand correctly that previously when you had machines that [you had] to uninstall and re-install Sophos client (question is why and how often) Desktop support stopped by, booted into Safe Mode, disabled TP, rebooted, and un- and re-installed? Now that the machines are remote you can't disable TP remotely but if you could you could reinstall? 
better tools
what exactly do you need? Both ESC and Central allow TP to be turned off remotely. If this doesn't work some other tool would likewise fail unless it has an independent communication channel. If somehow the TP password is lost you'd need an equivalent of the PUK for SIM cards as some general tool that could disable TP without any secret would a priori annul TP., similarly a no-questions-asked uninstaller.

Last but not least - what happened to the machines that you have to uninstall?

Christian

Answer to the last question, those machines were somehow removed from Sophos Central admin Portal. 

So what I have to do is remotely access the staff's laptop and attempt to use the instructions provided to uninstall Sophos Endpoint without TP code available.

How long ago?  Are they not under the Tamper Protection report?

Since January, when I generated the last contact report.

Do they exist in this report 

https://cloud.sophos.com/manage/reports/deleted-devices/create

if so, you should be able l to use the command line tool

sedcli.exe -tpoff <pass>

Once tamper Kia disabled, then you can run the uninstall cli tool. Uninstallcli.exe I think it is called.

You could do this via live response I suspect. The live response session would get closed as Mcs gets removed.

No the devices no longer exist on the cloud, so I am unable to get the TP code from the deleted devices.

Without the TP passcode, uninstalling is not going to action.

Have the machines talked to Central lately? If not, why? Is there a connection issue?

You could try some of the archived TP passwords for the device. If it truly hasn't talked to Central it would have one of the older passcodes still stored locally.