Friday, 10 November 2017

The correct way to uninstall Sophos Endpoint Security and Control from a Windows workstation.

  1. Move the workstation out of the Sophos synchronized AD OU into a non synched AD OU.
  2. Reboot the workstation.
  3. Delete the workstation from the Sophos Enterprise Console.
  4. The Sophos Endpoint Anti-tamper protection must be disabled before you can remove Sophos anti-virus. You need a password for this.
  5. Log in to the computer with a Sophos Administrator account.  The administrator account may be your normal Windows account if you maintain your own computer.
  6. Make sure that an update is not currently being performed. You can check this by right-clicking the Sophos shield in the system tray of the taskbar and ensuring 'View updating status' is grayed out and cannot be selected. If an update is currently in progress wait for it to complete before continuing.

  7. Open Windows services (Start | Run | Type: services.msc | Press return), right-click on the 'Sophos AutoUpdate Service' and select 'Stop'1.

  8. Open the Add/Remove Programs (or Programs and Features) window (Start | Run | Type: appwiz.cpl | Press return). You can also access the Windows 'Run' box by press Windows+R on your keyboard.

  9. Using the list below remove the Sophos components installed on your computer in the order shown. If you cannot find one or more components listed below it may not be installed and you can move on to the next item. You do not have to restart the computer until you get to Step f.
    1. Sophos Patch Agent
    2. Sophos Compliance Agent (NAC)
    3. Sophos Network Threat Protection
    4. Sophos System Protection
    5. Sophos Client Firewall (SCF)
    6. Sophos Anti-Virus (SAV)
    7. Sophos Remote Management System (RMS)
    8. Sophos Management Communication System (MCS)
    9. Sophos AutoUpdate (SAU)
    10. Sophos SafeGuard components
    11. Sophos Health
    12. Sophos Heartbeat
    13. Sophos Endpoint Defense

  10. Restart the computer.

    The information in this blog post is an edited version of a Sophos Knowledge Base article found here.

No comments: