Sophos uninstall with command line access

Standard

Gather the uninstall commands

On an endpoint computer open the registry editor (Start | Run | Type: regedit.exe | Press return).
Expand the left hand tree to the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
Note: On a 64-bit computer you will need to check both the key above and the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
Click through the list and locate the first Sophos component you need to uninstall.
In the list of values find the ‘UninstallString’, right-click it and select ‘Modify’.
Copy the string into a text editor.
Repeat steps three to five for all other component you need to remove.

Windows installer parameters

The uninstall strings copied from the registry may contain MSIEXEC.exe parameters or you may want to add your own parameters to control what the end user sees on screen and how the computer behaves. For example the uninstall string for Sophos Anti-Virus v10 is:

MsiExec.exe /X {9ACB414D-9347-40B6-A453-5EFB2DB59DFA}

But can be modified so that the uninstall is silent:

MsiExec.exe /X {9ACB414D-9347-40B6-A453-5EFB2DB59DFA} /qn

Or to suppress a reboot (A restart is normally required for Sophos Client Firewall and Sophos Anti-Virus) so that you may perform it at a later time:

MsiExec.exe /X{9ACB414D-9347-40B6-A453-5EFB2DB59DFA} /qn REBOOT=SUPPRESS

It is advisable to create a log file (a separate file is needed for each component) as part of this process for each component being removed to help facilitate troubleshooting should an issue arise:

MsiExec.exe /X{9ACB414D-9347-40B6-A453-5EFB2DB59DFA} /qn REBOOT=SUPPRESS /L*v %windir%\Temp\Uninstall_SAV9-10_Log.txt

If you need further information on Windows Installer (MSIEXEC.exe) and associated parameters we recommend you consult up to date Microsoft documentation.

 

Prior to uninstalling the endpoint components, you should stop the Sophos AutoUpdate Service to prevent a potential update of the endpoint software during the removal.  A command line such as the following can be used.

net stop "Sophos AutoUpdate Service"

The order in which the endpoint components are removed is important.  Therefore reorder your uninstall strings (that you extracted from the registry editor) as shown below.

  1. Sophos Patch Agent
  2. Sophos Compliance Agent
  3. Sophos Remote Management System
  4. Sophos Client Firewall
  5. Sophos Anti-Virus
  6. Sophos AutoUpdate