With Tamper Protection disabled from the Sophos Central admin console, Dan0's script: Sophos support told us that they do not have a batch uninstall feature but I have to believe it's possible with Jamf. If anyone here has successfully removed Sophos Endpoint Protection with a Jamf policy, or if you have any other ideas in general, your feedback would be most appreciated. Created a Policy with the Files & Processes payload, using the Execute Command feature to call up the Sophos uninstaller app directly on the endpoint (/Applications/Remove Sophos Endpoint.app).

Packaged the Sophos uninstaller (Remove Sophos Endpoint.app) with Composer and added it to a Policy with the Packages payload (specifically, we installed Sophos on the test machine, started Composer and took a before snapshot, uninstalled Sophos, then took an after snapshot, saved and uploaded the resulting.So far, we've tried the following approaches, both of these scoped to a test machine with Sophos Endpoint Protection installed and with Tamper Protection disabled: This particular enterprise version of Sophos employs Tamper Protection, which was easy enough for us to disable by creating a policy that deletes the SophosSecure.keychain file that Tamper Protection creates on all the endpoints, but even with Tamper Protection disabled we can't figure out how to remotely uninstall the client itself. Hi all, we're having a difficult time uninstalling Sophos Endpoint Protection from our Mac endpoints with Jamf.

Why cant sophos antivirus mac be opened