Categories
blog howto windows

Uninstall Sophos Antivirus tamper protection lost password

How to uninstall Sophos Antivirus when the Tamper Protection doesn’t let you, and you don’t know the Tamper password.

  1. Stop the Sophos Anti-Virus service if possible. Open services.msc and stop the service.
  2. Open notepad with UAC elevation, run as Administrator.
  3. In notepad open the file “C:\ProgramData\Sophos\Sophos Anti-Virus\Config\machine.xml”
  4. Find the configuration section for TamperProtectionManagement

    <TamperProtectionManagement>
    <settings>
    <password>123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ</password><enabled>true</enabled>
    </settings>
    </TamperProtectionManagement>

  5. Change the password string (123456789ABCD… above is just an example, yours will be different.) to the new value: E8F97FBA9104D1EA5047948E6DFB67FACD9F5B73
  6. Start Sophos Antivirus or restart the computer.
  7. Disable tamper protection using the new password: “password” (without the quotes).
  8. Uninstall Sophos Antivirus.

10 replies on “Uninstall Sophos Antivirus tamper protection lost password”

Is there an instruction for Mac ? Everything I found so far doesn’t work. Tamper password lost.

Does this work to remove events from Sophos? Do I have to uninstall Sophos to remove the events? I forgot the Admin Login.

If you have the password for the admin account on Mac, then you can just go into keychain and delete every reference to Sophos. At that point, you can Uninstall Sophos with the user account’s password instead of the Tamper Protection Password

Can anyone help me with this as well? I have a mac that is brand new and somehow I have sophos on it. I believe this must be from bringing over sophos from my old computer which is 5 years old and I have no clue what the tamper protection password is. Nothing is showing up in keychain. I want to just delete this program.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.