I find that when building scripts, PowerShell ISE is irreplaceable, because we can walk through each step and test separate statements in individual tabs. If things go wrong or a script makes a temporary change, we can easily revert to a clean sample. You must open the application, manually authenticate the tamper-protection user, and then disable tamper protection altogether.īefore writing code, either build a virtual machine (VM) and take a snapshot, or use something like Clonezilla to take an image of the test system’s hard drive.You must add the currently logged-in administrator to the local “SophosAdministrator” security group.You must replace the hashed tamper-protection password stored in the machine.xml file with a known-good password hash.There are a number of prerequisites to complete the removal, so we’ll break them down into individual steps. To make things a little less painful, we can script those processes.

However, if you are not the administrator who installed it and who has the password, you will need to obtain the password before you can carry out the procedure.

The instructions for this are given below. Normally you would only disable tamper protection if you wanted to make a change to the local Sophos configuration or uninstall an existing Sophos product.

Can39t uninstall sophos