How to uninstall Sophos Endpoint Security and Control from the command line or with a batch file

  • N.º del artículo: 109668
  • Calificación:
  • 100 clientes puntuaron este artículo con un 3.0 sobre 6 de media.
  • Actualizado: 20 ago 2015

This article explains how to uninstall Sophos endpoint security software via a batch script or command line.

The instructions explain what to do on one computer however once the batch file has been created you can run it on any number of computers and if the same components are found they will be removed.


  • This article does not troubleshoot errors or problems when uninstalling and is intended for guidance on correctly removing endpoint software with a Windows batch script.  Other articles document how to resolve corrupt or broken installations (e.g., Troubleshooting and resolving problematic Sophos endpoint upgrade and uninstall issues).
  • The instructions below have limited testing and are therefore provided 'as is' and without full support.  You must fully test the batch file created on a test system before using in your production environment.
  • Read this article fully before attempting the instructions.
  • Do not run batch file uninstalls on the Sophos management server, message relay servers, or computers running server-side components such as Sophos Update Manager (SUM), Sophos PureMessage, etc.
  • Before using the Windows registry editor read article 10388.
  • If you encounter a problem when running your script we recommend you test uninstalling the components manually with Add/Remove Programs to ensure the normal method works correctly before troubleshooting further or contacting technical support.
    Note: Different product version may have different uninstall strings and hence this can mean the script does not uninstall components as expected.

  • We do not accept responsibility for any loss of data resulting from following these instructions.

Known to apply to the following Sophos product(s) and version(s)
Sophos Endpoint Security and Control

What To Do

You need to collect all the required uninstall strings from a typical endpoint computer (so you get the correct commands), copy them into a new text file (one per line), save the file as a .bat extension (batch file) and fully test it works as desired.

Note: If enabled, the Sophos Tamper Protection policy must be disabled on the endpoints involved before attempting to uninstall any component of Sophos Endpoint Security and Control.  See article 119175 for more information.

Gather the uninstall commands

  1. On an endpoint computer open the registry editor (Start | Run | Type: regedit.exe | Press return).
  2. Expand the left hand tree to the following key:
    Note: On a 64-bit computer you will need to check both the key above and the following key:
  3. Click through the list and locate the first Sophos component you need to uninstall.
  4. In the list of values find the 'UninstallString', right-click it and select 'Modify'.
  5. Copy the string into a text editor.
  6. Repeat steps three to five for all other component you need to remove.

Windows installer parameters

The uninstall strings copied from the registry may contain MSIEXEC.exe parameters or you may want to add your own parameters to control what the end user sees on screen and how the computer behaves.  For example the uninstall string for Sophos Anti-Virus v10 is:

MsiExec.exe /X {9ACB414D-9347-40B6-A453-5EFB2DB59DFA}

But can be modified so that the uninstall is silent:

MsiExec.exe /X {9ACB414D-9347-40B6-A453-5EFB2DB59DFA} /qn

Or to suppress a reboot (A restart is normally required for Sophos Client Firewall and Sophos Anti-Virus) so that you may perform it at a later time:

MsiExec.exe /X{9ACB414D-9347-40B6-A453-5EFB2DB59DFA} /qn REBOOT=SUPPRESS

It is advisable to create a log file (a separate file is needed for each component) as part of this process for each component being removed to help facilitate troubleshooting should an issue arise:

MsiExec.exe /X{9ACB414D-9347-40B6-A453-5EFB2DB59DFA} /qn REBOOT=SUPPRESS /L*v %windir%\Temp\Uninstall_SAV9-10_Log.txt

If you need further information on Windows Installer (MSIEXEC.exe) and associated parameters we recommend you consult up to date Microsoft documentation.

Create a batch file

Prior to uninstalling the endpoint components, you should stop the Sophos AutoUpdate Service to prevent a potential update of the endpoint software during the removal.  A command line such as the following can be used.

net stop "Sophos AutoUpdate Service"

The order in which the endpoint components are removed is important.  Therefore reorder your uninstall strings (that you extracted from the registry editor) as shown below.

  1. Sophos Patch Agent
  2. Sophos Compliance Agent
  3. Sophos Remote Management System
  4. Sophos Client Firewall
  5. Sophos Anti-Virus
  6. Sophos AutoUpdate

Then save the file and change the file extension from .txt to .bat

Si necesita más ayuda, póngase en contacto con soporte técnico.

Valore el artículo

Muy malo Excelente