How to Manually Uninstall Sophos Intercept X from macOS
Step 1: Download the Official Removal Tool
The safest approach is using Sophos's official removal tool:
- Download the Sophos Removal Tool from Sophos's website
- This handles system extensions and kernel components properly
Step 2: Manual Removal Process
If you need to remove it manually:
Stop Sophos Services:
sudo launchctl unload /Library/LaunchDaemons/com.sophos.*
sudo launchctl unload /Library/LaunchAgents/com.sophos.*
Remove Application Files:
- Delete
/Applications/Sophos Endpoint.app
- Remove
/Library/Application Support/Sophos/
- Delete
/Library/Sophos Anti-Virus/ (if present)
Remove System Extensions:
sudo systemextensionsctl uninstall com.sophos.endpoint.scanextension
sudo systemextensionsctl uninstall com.sophos.endpoint.networkextension
Clear Launch Daemons/Agents:
Delete files in:
-
/Library/LaunchDaemons/ (any com.sophos.* files)
-
/Library/LaunchAgents/ (any com.sophos.* files)
Remove Preferences:
~/Library/Preferences/com.sophos.*/Library/Preferences/com.sophos.*
Important Notes:
- Restart after removal to ensure all components are cleared
- System Integrity Protection (SIP) may prevent some manual deletions (How to Disable SIP)
- The official removal tool is recommended as it handles tamper protection properly
- You may need to approve system extension removals in System Preferences > Security & Privacy