I had an issue whereas my cloud account would not disable my tamper protection with the password or at the cloud UI level.

After contacting tech support they told me about this method.

It DOES require you to boot into safe mode and it DOES require you to be a system administrator on your system... but it does work.

  1. Boot the system into Safe Mode.
  2. Click Start > Run > services.msc > right-click Sophos Anti-Virus service > properties > set to disabled > OK
  3. Click Start > Run and type regedit and then click OK.
  4. Go to the following location in the registry editor:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent and set the REG_DWORD Start to 0x00000004
  5. Go to the following location in the registry editor:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config and set the following REG_DWORD values SAVEnabled and SEDEnabled to 0
  6. Go to the following location in the registry editor:
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection and set the REG_DWORD Enabled to 0
  7. Reboot the system in normal mode.
  8. Uninstall Sophos AV


At this point we are ready to reinstall the application or alternate application.


Hope this helps!