Uninstall Sophos Central Endpoint on Windows

A clean Endpoint uninstall consists of two separate tasks. First remove the Sophos software from the Windows device. Only then delete the device record that is no longer needed in Sophos Central.

This order matters. Deleting a device in Central is not a remote uninstall. It removes the record and its alerts but leaves an installed agent on the computer.

Before starting

• local administrator access
• an active maintenance window
• Tamper Protection disabled for this device
• a recovery or rollback plan
• no active cleanup or investigation that still requires the endpoint

Disable Sophos Central Tamper Protection safely explains the local four-hour override and the per-device Central setting.

Do not delete too early: Keep the device in Sophos Central until local removal has succeeded. This preserves access to the password, status and diagnostic information.

Supported uninstall method

Sophos provides a central Windows uninstaller:

C:\\Program Files\\Sophos\\Sophos Endpoint Agent\\SophosUninstall.exe

1. Disable Tamper Protection for the device.
2. Open Command Prompt or PowerShell as an administrator.
3. Run SophosUninstall.exe from the path above.
4. Complete the wizard and restart if requested.
5. Check that Sophos services, the protection interface and installed Sophos applications have been removed.

Alternatively, uninstall Sophos Endpoint Agent under Settings > Apps > Installed apps or Apps & features. Windows starts the same supported uninstaller.

Unattended uninstall

For software distribution or controlled offboarding, the program supports a silent invocation:

& "C:\\Program Files\\Sophos\\Sophos Endpoint Agent\\SophosUninstall.exe" --quiet

--language=<LanguageID> sets the language of the uninstaller. The deployment system must evaluate the exit code, installed applications and any required restart. A finished process alone is not proof of success.

Do not interpret the numerical return values as general Windows codes:

The uninstall log is under C:\Windows\Temp\Sophos Endpoint Agent. For code 8, complete the already pending restart first and then reassess the device state.

Do not confuse this with Manage Software

Under My Environment > Computers & Servers, Manage device software can remove individual protection products or change the agent mode. The Sophos Core Agent remains installed for management and later product changes.

A complete device removal therefore still requires SophosUninstall.exe. Manage Software is for controlled product-scope changes, not complete offboarding.

Verify the uninstall

After the restart, check at least:

• Sophos Endpoint Agent is no longer listed under installed apps.
• The Sophos shield and local Endpoint interface are gone.
• Sophos protection services are no longer running.
• The intended replacement product is active and current.
• Windows Security shows the expected protection provider.
• No Sophos restart or incomplete uninstall process remains.

A remaining folder alone does not prove that Sophos is active. Running services, registered products and the protection provider are more meaningful.

Remove the device from Central afterwards

Only after local validation should the record be cleaned up in Sophos Central:

1. Open My Environment > Computers & Servers.
2. Select the uninstalled device.
3. Confirm Delete.
4. Check that it no longer appears in the active device list.

Deleting a device also deletes its associated alerts. Preserve any required information first. Sophos currently retains deleted devices for 30 days for recovery.

If the device was already deleted or the licence expired

On current Windows versions, the Core Agent can remain in a controlled removal state after deletion or licence expiry. Do not use the old registry and Safe Mode procedure. Follow Uninstall Sophos Endpoint after deletion from Central.

Troubleshooting

SophosUninstall.exe reports active Tamper Protection

Recheck the device password and Tamper Protection status. The local four-hour override is suitable for short maintenance. For a deleted device, use the stored password or restore the device record.

SophosUninstall.exe is missing

Check whether the Sophos Core Agent is still installed correctly. Do not clean up a damaged or partially removed agent with arbitrary individual MSI files or registry deletions. Preserve the Sophos installation logs and use the current Sophos repair or support process.

The device reappears in Central

An active or redeployed management component probably remains. Check software distribution, gold images, RMM jobs and the local Core Agent. Deleting the record again without investigating the cause will not solve the problem.

The uninstall does not finish

Check running Sophos cleanup, Windows Installer, pending restarts and other security software. Preserve the installation and uninstall logs before further intervention.

RemoveSIPSSubmitterUserAccount fails

An error in RemoveSIPSSubmitterUserAccount indicates an already partially removed Network Threat Protection or agent installation. A missing Sophos registry value can block the next step, but further uninstall errors are likely after that value is repaired. First collect complete SDU and uninstall logs. Restore the string value named in the current Sophos KBA only after a registry backup and exactly at the documented key, then run SophosUninstall.exe again.

If removal remains incomplete, do not continue with additional guessed keys. Send the SDU archive and the device status to Sophos Support.

Frequently asked questions