This article will show you how to remove the Sophos Central Endpoint Client from your Windows system, even if the tamper protection prevents this.

Prepare scripts to remove Sophos Endpoint. Create group policy. Configuration 3.1 Create a share folder on Windows Server. The first step we need to do is to create a share folder to contain the scripts file that can be used to remove the sophos endpoint so that workstations can access to execute the scripts file. How to use the command line or create a batch file. Restart the computer or server. Turn off tamper protection on the computer or server. Note: Unlock the server before uninstalling Sophos. Go to the Servers' list, then under the. Open a Command Prompt with admin privilege and run the following.

Important: This method of uninstalling the Endpoint Client should only be used if there is no chance to disable tamper protection in the normal way. This may be because you forgot your password or deleted your computer from Sophos Central without uninstalling the Endpoint Client on your computer. How to disable tamper protection in the proper way is explained in this tutorial.

Manual Remove Sophos Software

Option 1

Manual Remove Sophos Security

1. Boot your Windows system into Safe Mode.
2. Click Start, than Run and type services.msc and then confirm with Enter or click on OK
3. Search for the Sophos Anti-Virus service and click on it with the right mouse button.
4. From the context menu, select Properties and then deactivate the service.
5. Now you can click on Start and type Run again. Enter regedit this time. Confirm with Enter or click OK.
6. Go to the following location in the registry editor: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSophos MCS Agent and set REG_DWORD Start to 0x00000004
7. Next, Go to the following location in the registry editor: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSophos Endpoint DefenseTamperProtectionConfig set the following REG_DWORD-values SAVEnabled and SEDEnabled to 0.
8. Finally, go to the following location in the registry editor: HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeSophosSAVServiceTamperProtection and set the value at REG_DWORDto 0.
9. Reboot the system in normal mode.

Option 2

Manual Remove Sophos Antivirus

1. Boot your Windows system into Safe Mode.
2. Then open the command line (Shell) and execute the following commands:
3. Reboot the system in normal mode.

Manually Remove Sophos

No matter which of the two options you choose, they should both result in the tamper protection being disabled and you can uninstall the Endpoint Client without any problems.