How to remove Sophos Endpoint for Windows machines

Sophos is very difficult to remove, even if you are an administrator of your machine. If you are not an administrator of your machine, this article is not for you.

Sophos Endpoint has a password protected application. The Application can only be uninstalled if the password is entered.

In case you don’t know the password but you are the administrator of your machine, then you came to the right place.

Sophos doesn’t let you uninstall through normal uninstall process, unless you have the password. Even if you create another administrator user in the same system, Sophos Endpoint lets itself on the other user also. Through the other user also you cannot delete Sophos.

There are a number of different work-arounds available in the internet as to how to uninstall Sophos Endpoint without having the password. But, believe me, none of them work.

The reason is simple. Sophos Endpoint is active while you login to the windows. While Sophos is active, it will not let you uninstall it without the password.

I found out a work around through the thought process which runs like this: what is the time point where the windows system is running and Sophos Endpoint is inactive?

Such a point exists in the recovery environment of Windows.

First step is to enter the recovery environment. While you are logged in, go to settings and select System>Recovery. Once there, find “Advanced Startup” and then click on “Restart Now” button.

Next, the system will restart. It will take you to recovery environment. Find “Advanced Options” and click on it.

This will open a screen where some options are available. Find “Command Prompt” and click on it. A command prompt window will open.

In the command prompt, type “explorer.exe”. File explorer window will open. Go to the “C” drive and go to “program files” folder and locate Sophos Endpoint folder. Select and click on “delete”. Again, go to “program files x86” folder. Locate Sophos Endpoint folder and click on “delete”. You can also right-click and select “delete”. Voila! Sophos is deleted.

If, by any chance, you are unable to open file explorer from Command Prompt in the recovery environment, don’t worry. There is another work-around.

In the command prompt, type “notepad.exe”. A notepad will open. On the notepad, click on “File>Open”. It will allow you to browse the drives. However, it will only show text documents. Next to the file name box, there will be a drop down. Drag it down and select “All Files” in the place of “text documents”. Again, you will be able to browse the folders. Go to “Program Files” and “Program Files X86” folders and delete Sophos Endpoint folders from there.

After that, restart normally and you won’t see Sophos again in your system.

Please note that this is a crude work-around as some of the registry entries and some short-cuts will remain. Also, Sophos will continue to be shown as a part of installed apps. However, it will not annoy you.

Please also be careful while browsing folders in the recovery environment. In the recovery environment, there is nothing like delete confirmation dialogue which normally is present in the logged-in system. If there is a delete confirmation dialogue, it will ask you whether you want to delete such and such a file. If it is a mistake, you have a second chance by saying “no” to the dialogue.

However, in the recovery environment, there is no such thing as delete confirmation dialogue. Once you click on “delete”, it will be permanently deleted without any dialogue and it will not be present in the Recycle bin also.

Therefore, be careful while doing this exercise and you do at your own risk. If you delete any other folder by mistake, you CANNOT bring it back. Risk is yours not mine.

The repercussions after deletion of Sophos Endpoint are entirely to be borne by you. I am not in any way responsible as to what happens after you carry out the steps listed above.

Before doing this, it is always better to create a system restore point first.

If you cannot understand what is being described in this article, please don’t try it yourself. Show this article to a person who understands technology and that person can do it for you.