You must replace the hashed tamper-protection password stored in the machine.xml file with a known-good password hash. There are a number of prerequisites to complete the removal, so we’ll break them down into individual steps. To make things a little less painful, we can script those processes. 
However, if you are not the administrator who installed it and who has the password, you will need to obtain the password before you can carry out the procedure". The instructions for this are given below. Normally you would only disable tamper protection if you wanted to make a change to the local Sophos configuration or uninstall an existing Sophos product. See article 119175 for more information".įollowing the article link, we arrive at the dreaded FAQ: "Note: If enabled, the Sophos Tamper Protection policy must be disabled on the endpoints involved before attempting to uninstall any component of Sophos Endpoint Security and Control. While Sophos does provide some assistance with removal via a script here, it includes the caveat:
The company removes tamper protection from a large portion of administered endpoints, but it still needs to remove tamper protection from a number of outlying systems and notebooks. The previous AV administrators can’t remove tamper protection due to a domain change. The tamper protection password cannot be obtained. The company purchases a new AV product. I'd be grateful for any help anybody can offer.Several events can lead to this situation: Incidentally, I've uninstalled Sophos on a couple of 32-bit Windows machines and have not had this problem, so I'm wondering if it's something to do with it being 64-bit Windows. If I re-install Sophos and bring it up to date then everything is OK again - no other services fail to start or stop unexpectedly.ĭoes this sound familiar to anybody? Although Sophos appears to uninstall correctly it is clearly leaving something behind but I've no idea what. If I run Sysinternals Process Monitor it shows svchost trying to access and/or create various files in C:\ProgramData\Sophos. Looking in Services it appears that all Sophos Services have been correctly uninstalled and removed. LogMeIn and Perfect Disk's PDEngine service). Cloudberry Online Backup) or stop unexpectedly (according to Event Viewer) e.g. However, I then find that some other completely unrelated services either fail to start (e.g. The uninstall appears to proceed as expected, so I then reboot. (Those are the only two components installed as I've been updating remotely to my University's server.) I've followed the knowledgebase article, stopping the Auto Update service then uninstalling Sophos Anti-Virus first and Sophos Auto Update second. I'm having a strange problem when uninstalling Sophos Anti-Virus version 10.0 standalone on Windows 7 圆4.
0 kommentar(er)
