If you have this folder present C:\ProgramFiles\Sophos\Endpoint Defense, and you have the tamper protection password:
- open a command prompt as admin
- navigate to C:\ProgramFiles\Sophos\Endpoint Defense
- run the command sedcli -Tpoff Password(xxxxxxxx)

 If this is not working then the below steps should be done:



  1. Boot the endpoint or server in Safe Mode.
  2. Click Start followed by Run then type services.msc
  3. Right-click the Sophos Anti-Virus service then Properties.
  4. Set the Startup type to Disabled then click the OK button.
  5. In Run, type regedit.exe then click the OK button.
  6. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos MCS Agent  and set the Value data of Start to 0x00000004
  7. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\TamperProtection\Config and set the Value data of SAVEnabled and SEDEnabled to 0.
  8. Set the Value data of Enabled to 0 in the following: 
    • 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SAVService\TamperProtection
    • 64bit: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection
  9. Enhanced Tamper Protection will now be disabled after you boot the endpoint or server in normal mode.