Uninstall Sophos Endpoint on Mac

To uninstall Sophos your first point would be to see if you locate Remove Sophos Endpoint. This can be either run from launchpad or type it in spotlight. When you run that app it should then go away and uninstall the programme. It would be best to reboot the machine once the exercise is complete. I have found it does sometimes error out or fails but on a reboot this will tell you if you have managed to uninstall it. Help file link.

On the error fail it could be linked to the security and privacy issue Sophos not having full disc access for the uninstaller which is documented here but according to Sophos its pointing to a Monterey issue everything higher does not have the blip. I beg to differ as I have tried it in Sonoma and Sequoia with the same error blip however on a reboot its fixed the issue and the software was uninstalled.

If you cannot find the remove tool the Sophos website will point you to several options the first is go to this website and fill in the form (I Know annoying) You can put anything in there really as it does not send you a url of the download link when you click Submit Query it just goes to the link which allows you to download the zip file.

As always Sophos seems to had its own laws on if you can uninstall it. Also if the Tamper Protection is turned on and you don’t know the password then its to Terminal for force it to be uninstalled. According to Sophos website you have to contact them for support. However there are 2 options run the terminal commands or you can (last resort) wipe the machine and restore from Time Machine Backup without installing the App’s otherwise you back where you started from.

#!/bin/bash
sudo rm -R /Library/Sophos\ Anti-Virus/
sudo rm -R /Library/Application\ Support/Sophos/
sudo rm -R /Library/Preferences/com.sophos.*
sudo rm /Library/LaunchDaemons/com.sophos.*
sudo rm /Library/LaunchAgents/com.sophos.*
sudo rm -R /Library/Extensions/Sophos*
sudo rm -R /Library/Caches/com.sophos.* 

I know the above commands do work when I tried it recently but I stress Sophos have made a big thing about contact support to get round the password lock.

Here is another command that ChatGPT informs me it works.  
sudo /Library/Sophos/saas/uninstall.sh 
You will need the admin password for this to work in Terminal.

I would do a reboot if you find the programme is still hanging around and run the Remove Sophos Endpoint which should this time bypass the password protection issue.

Here is the comprehensive chart for uninstalling Sophos from your Mac. I found the option from within System settings did not work for me but the download of the tool from the page above did work.

Finally I have logged into the Sophos Home Dashboard and you do get the option to delete devices bound to that account.

In short I would try the Remove Sophos Endpoint option either from the machine or get the download and run the programme for the first port of call and see how you get on if its password lock the Terminal is your friend.