The last weeks i was running into a really annoying behavior of Sophos Endpoint Protection on macOS. In most cases i was able to use a simple Terminal command to remove the Sophos Endpoint software, but on some devices the uninstaller failed.
If you want to remove Sophos Anti-Virus for macOS managed by Sophos Central the normal way, you can just use one of the following commands:
Tamper Protection disabled:
cd /Library/Application\ Support/Sophos/saas/Installer.app/Contents/MacOS/tools/ sudo ./InstallationDeployer --remove --ui
Tamper Protection enabled:
cd /Library/Application\ Support/Sophos/saas/Installer.app/Contents/MacOS/tools/ sudo ./InstallationDeployer --remove --ui --tamper_password <password>
In some cases it can help, to use the ‘force_remove’ option. This works also without the ‘tamper_protection’ option. Here is an example for you: