Sophos Endpoint UI is missing and I cant uninstall or disable tamper protection

Hi Sys Dev,

Try running the below commands in an administrative command prompt.  Replace <password> with the password of the machine in Sophos Central.  You will need to turn Tamper Protection back on in order to show this.

cd "C:\Program Files\Sophos\Endpoint Defense\"

SEDcli.exe -TPoff <password>

Once disabled try uninstalling again.  If it still fails you may have to run through safe mode recovery: https://community.sophos.com/kb/en-us/124377

Hi Sys Dev,

Try running the below commands in an administrative command prompt.  Replace <password> with the password of the machine in Sophos Central.  You will need to turn Tamper Protection back on in order to show this.

cd "C:\Program Files\Sophos\Endpoint Defense\"

SEDcli.exe -TPoff <password>

Once disabled try uninstalling again.  If it still fails you may have to run through safe mode recovery: https://community.sophos.com/kb/en-us/124377

That work for disabling Tamper Protection but now during uninstall I get the below message. This is what I got the first time I ran it.

Hi Sys Dev,

It looks like a component failed to uninstall.  Take a look in %temp% for a Sophos Endpoint Agent Uninstall log file and search for the keyword "fail".  This should tell you the component that failed to uninstall.  Upload a copy of that log file for us to investigate, it is also stored in %temp%.

Here are all the logs I found.

8838.Sophos Health Uninstall 2019_08_09_19_56_36Z.log1651.Sophos Standalone Engine Install Log 20190809 115647.txt

6102.Sophos ML Engine Uninstall Log 20190809 115647.txt

3652.Sophos Endpoint Agent Uninstall 2019_08_09_19_56_47Z.log8103.Sophos Endpoint Defense Uninstallation 2.1.3 8-9-2019 11_56_58 AM.log5554.Sophos Health Uninstall 2019_08_09_19_52_01Z.log7455.Sophos Endpoint Agent Uninstall 2019_08_09_19_51_59Z.log3005.jusched.log0456.Sophos Endpoint Agent Uninstall 2019_08_09_19_54_28Z.log5807.Sophos Health Uninstall 2019_08_09_19_54_29Z.log3225.Sophos Clean Uninstall log 20190809T195658.txt8666.Sophos Health Uninstall 2019_08_09_19_56_52Z.log5126.Sophos Endpoint Agent Uninstall 2019_08_09_19_56_36Z.log

Hi Sys Dev,

Looks like a registry key may not have changed when we turned off Tamper Protection.  Open up registry editor and navigate to this location:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\SavService\TamperProtection

Make sure the value for Enabled is 0, if it is not set it to 0.

Also check this location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config

Make sure SAVEnabled and SEDEnabled are both set to 0 and attempt another uninstall.

This fixed my issue! Thank you very much. I did have to stop the services before I could change the reg keys.