Remove Sophos from Mac without tamper protection password.md

cd /Library/Preferences
sudo rm com.sophos.sav.plist

cd /Library/Application\ Support/Sophos/cloud/Installer.app/Contents/MacOS/tools/
sudo ./InstallationDeployer —force_remove

The IT guys get a notification o something like that if you do this?

The IT guys get a notification o something like that if you do this?

@samuaz If your IT are any good they will know you've removed it. If you're on a work/school computer, I wouldn't mess around - It's there for a reason. If it's blocking you from working/studying have a discussion with your IT department and go from there. In short, don't remove it unless you're authorized.

Just testing out these scripts and it seems like it works great, except it leaves behind the Sophos System Extensions, including an endpoint security system extension and a network system extension.

Any idea how to remove those with a script as well?

Just testing out these scripts and it seems like it works great, except it leaves behind the Sophos System Extensions, including an endpoint security system extension and a network system extension.

Any idea how to remove those with a script as well?

To remove them disable System Integrity:
Shut off
Hold power button or CMD+R (depending on the mac) > options > terminal
csrutil disable
Enter username
Enter password
Wait for confirm
Reboot

Open terminal
systemextensionsctl list
systemextensionsctl uninstall TEAMID BUNDLEID (teamid is an id string, the bundleid is com.sophos… etc)
repeat the command for the second extension

Re-enable System Integrity:
Shut off
Hold power button or CMD+R (depending on the mac)> options > terminal
csrutil enable
Enter username
Enter password
Wait for confirm
Reboot

Hello ,

Iam trying to remove sophos from vmware workspace one .

can anyone help me how exactly this works .

Open terminal 'command + spacebar' search for "terminal" vi kill_sophos Copy text below, right-click on terminal window and select 'Paste': #!/bin/bash sudo rm -R /Library/Sophos\ Anti-Virus/ sudo rm -R /Library/Application\ Support/Sophos/ sudo rm -R /Library/Preferences/com.sophos.* sudo rm /Library/LaunchDaemons/com.sophos.* sudo rm /Library/LaunchAgents/com.sophos.* sudo rm -R /Library/Extensions/Sophos* sudo rm -R /Library/Caches/com.sophos.* Press 'Esc' on your keyboard Enter ' :wq' and press return ( Colon W Q Enter) sudo chmod +x kill_sophos Enter local mac password run script by entering below on terminal ./kill_sophos enter password and watch everything die Open Finder and go to 'Applications' click Remove Sophos Endpoint It will now let you remove Sophos Endpoint without the tamper protection password Rejoice Thank you for all the help. It's been rough lol

It worked like a charm, thanks

Amazing, thank you so much!

Does not work anymore as of 2024.1 as stated here.

I have version 2024.2.*
Did anybody find a solution?

Hi everyone. I was able to uninstall Sophos 2024 version. It's actually kinda funny.

First I used MacPaw's Clean My Mac to Uninstall Sophos. It removes most of the files but the endpoint itself is still active yet damaged. Also "Install Sophos" app is still in the Library. I used "Install Sophos" to reinstall Sophos. It starts blocking as usual after few hours.

Then I ran Uninstall Sophos app which doesn't require any passwords. And it removed Sophos completely from my mac which was wild.

I know this description is a bit clunky and requires a different app to uninstall Sophos, but at least this may serve as a workaround before someone savvy writes a terminal code.

This actually leaves out two SystemExtensions com.sophos.endpoint.scanextension and com.sophos.endpoint.networkextension which are difficult to delete. I followed this instruction to disable System Integrity Protection in recovery mode, delete the extensions and enable the SIP again. So now finally no more Sophos on my mac.