Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 3699 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot uninstall Endpoint Security and Control due to missing registry permissions?

fffree

Hi there,

I currently have Sophos Endpoint Security and Control 9.5 installed on my home computer (Win XP) but have recently started having problems with the updates, so wanted to uninstall Sophos and go from there. I've been able to uninstall the auto updater just fine, but when I try to uninstall the "Sophos Anti-Virus" entry from Add/Remove Software the installer always ends with error 3004 which says that "Sophos cannot be installed (sic!) due to inappropriate permissions for registry keys"*.

I've tried finding all the Sophos registry keys and set permissions on the ones I've found so that anybody can modify them, but that didn't help. I've also tried stopping all Sophos services before the uninstall and running one of the Sophos "removal scripts" I found for 9.5, which said it worked but Sophos is still there. I am logged in as admin on the system and manipulation protection is not enabled on the sophos install, though I am SophosAdministrators either way.

I'd be extremely grateful if anybody could help me.

* The installation is not in English, so apologies if the English error message for this reads slightly differently.

:26757


This thread was automatically locked due to age.
  • 0

    HI,

    If you run through the uninstall with Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) running, you can filter out files access.  When it errors, stop Process Monitor capturing and work up from the bottom.  This tool should help you figure out which keys it is trying to work with.

    If you have a MSI log you can match up the time it fails and the custom action or failure message might provide some context to help narrow down the window when it errors.  Searching the Process Monitor log for "Access Denied" is always a good first step and takes no time.

    You can force MSIs to create log files as per: http://support.microsoft.com/kb/314852 as needed.  I'm sure that SAV will create an MSI log on uninstall but I can't remember off the top of my head but that key will if it doesn't.

    Regards,

    Jak

    :26761
  • 0

    Thanks jak, that's great! It seems that it wasn't happy with "Everybody" having all permissions to HKLM\SOFTWARE\Classes, after adding Administrator and SYSTEM it worked. Thanks!

    :26799