How to remove Sophos Endpoint Security and Control from client computers

  • Article ID: 12360
  • Rating:
  • 305 customers rated this article 2.6 out of 6
  • Updated: 07 Dec 2015

This article describes how to remove the current versions of Sophos Endpoint Security and Control (the on-premise managed version on our endpoint software) from a Windows or Mac OS X computer.


  • This article does not troubleshoot errors or problems when uninstalling and is intended for guidance on correctly removing endpoint software.  Other articles document how to resolve corrupt or broken installations (e.g., 118140).
  • For information on uninstalling endpoint software that is installed on the management server see article 116912.
  • For information on uninstalling via a script (or command line) see article 109668.

What To Do

Before you start:

  • It is highly recommended that you close down any open applications on the computer before proceeding.
  • Check and ensure that Tamper Protection is disabled.

Removal instructions for Windows

  1. Log on to the computer with a Sophos Administrator account.  The administrator account may be your normal Windows account if you maintain your own computer.
  2. Make sure that an update is not currently being performed. You can check this by right-clicking the Sophos shield in the system tray of the taskbar and ensuring 'View updating status' is grayed out and cannot be selected.  Example of an update currently being performed:

    If an update is currently in progress wait for it to complete before continuing.
  3. Open Windows services (Start | Run | Type: services.msc | Press return), right-click on the 'Sophos AutoUpdate Service' and select 'Stop'1.
  4. Open the Add/Remove Programs (or Programs and Features) window (Start | Run | Type: appwiz.cpl | Press return). You can also access the Windows 'Run' box by press Windows+R on your keyboard.
  5. Using the list below remove the Sophos components installed on your computer in the order shown2.  If you cannot find one or more components listed below it may not be installed and you can move on to the next item.
    1. Sophos Patch Agent
    2. Sophos Compliance Agent (NAC)
    3. Sophos Network Threat Protection
    4. Sophos System Protection
    5. Sophos Client Firewall (SCF)
    6. Sophos Anti-Virus (SAV)
    7. Sophos Remote Management System (RMS)
    8. Sophos Management Communication System (MCS)
    9. Sophos AutoUpdate (SAU)
    10. Sophos SafeGuard components
  6. Restart the computer.

1Stopping the Sophos AutoUpdate service prevents an update from occurring during the uninstall.  If the service is not stopped and the uninstall of the Sophos AutoUpdate component is delayed for a period longer than the update schedule, then previously uninstalled components (see a-d above) could be re-installed.
2The order of removal is important to allow dependent components to be removed first without error.  Importantly the Sophos AutoUpdate component occurs at the end to preserve the local Cache folder of installers.  These installers may be required to resolve corrupt installations of other components.

Removal instructions for Sophos Anti-Virus for Mac

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent