- #HOW TO UNINSTALL SOPHOS ENDPOINT FROM REGISTRY UPDATE#
- #HOW TO UNINSTALL SOPHOS ENDPOINT FROM REGISTRY WINDOWS#
Sc.exe delete "Sophos Web Control Service " REG Delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run " /v "Sophos AutoUpdate Monitor " /f Remove-Item -LiteralPath "C:\ProgramData\Sophos " -Force -Recurse Remove-Item -LiteralPath "C:\Program Files (x86)\Sophos " -Force -Recurse Remove-Item -LiteralPath "C:\Program Files\Sophos " -Force -Recurse Remove-Item -LiteralPath "C:\Program Files\Sophos* " -Force -Recurse Select-Object -Property DisplayName, UninstallString
$SNTPVer = Get-ChildItem -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall | #Uninstall Sophos Network Threat Protection Wmic service where "caption like '%Sophos%' " call stopservice Net stop "Sophos Endpoint Defense Service " Net stop "Sophos System Protection Service " REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection " /t REG_DWORD /v Enabled /d 0 /f REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config " /t REG_DWORD /v SEDEnabled /d 0 /f REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config " /t REG_DWORD /v SAVEnabled /d 0 /f REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent " /t REG_DWORD /v Start /d 0x00000004 /f REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SAVService " /t REG_DWORD /v Start /d 0x00000004 /f #Disable Tamper Protection (may require reboot) # ***Note: This tool needs to be run as an admin with Sophos Admin # # from Program Files, Program Files (x86), and ProgramData # # The tool will then remove all Sophos services and directories # # seek out uninstall strings for associated Sophos Products, # Therefore reorder your uninstall strings (that you extracted from the registry editor) as shown below.# This tool will stop all running Sophos Services and tasks, # The order in which the endpoint components are removed is important. A command line such as the following can be used.
#HOW TO UNINSTALL SOPHOS ENDPOINT FROM REGISTRY UPDATE#
Prior to uninstalling the endpoint components, you should stop the Sophos AutoUpdate Service to prevent a potential update of the endpoint software during the removal.
#HOW TO UNINSTALL SOPHOS ENDPOINT FROM REGISTRY WINDOWS#
If you need further information on Windows Installer (MSIEXEC.exe) and associated parameters we recommend you consult up to date Microsoft documentation. MsiExec.exe /X /qn REBOOT=SUPPRESS /L*v %windir%\Temp\Uninstall_SAV9-10_Log.txt For example the uninstall string for Sophos Anti-Virus v10 is:
The uninstall strings copied from the registry may contain MSIEXEC.exe parameters or you may want to add your own parameters to control what the end user sees on screen and how the computer behaves. Repeat steps three to five for all other component you need to remove. In the list of values find the ‘UninstallString’, right-click it and select ‘Modify’. HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\UninstallĬlick through the list and locate the first Sophos component you need to uninstall. Note: On a 64-bit computer you will need to check both the key above and the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ On an endpoint computer open the registry editor (Start | Run | Type: regedit.exe | Press return).Įxpand the left hand tree to the following key: