Uninstall mcafee remotely using ESET remote administration console

Hi:

Does anyone know how to do a mass uninstall of mcafee enterprise antivirus?

My company has 100 computers that all have mcafee installed and I am switching to Nod32. I don't want to have to visit each machine to do an uninstall and thought that maybe there was an msi package that would do this.

thanks

 

Hello,

You would probably want to check with one of ESET's sales engineers for deployment instructions in this particular scenario.

Regards,

Aryeh Goretsky

 

Hello ksherwood,

It sounds like you are in the same situation i was in. We had mcafee deployed but without an EPO server. So there was no way to completely uninstall the software remotely. If you just uninstall the Mcafee program, a part will remain (the Framework service) which you'll have to uninstall via a command line.

The problem however comes when you've installed McAfee 8.5.0 or later. This incudes a function to prevent the McAfee services from being stopped (so you can't run the uninstall command remotely via psexec or whatever). You'd have to log in to the workstation, in the virus scan console, under access protection -> uncheck "prevent mcafee services from being stopped". Then run the command line to uninstall the Framework service, then uninstall McAfee and reboot.

I hope there is an easier way

 

I had Symantec Antivirus Corporate Edition running on my computers. I know, it's a different product. But, you still should be able to do the same as I did.

Get a hold of a Sysinternals utility called psexec. This will let you use the command line on a remote system where you can execute uninstall commands.

What I did for my Symantec products was to connect to the remote computers via Regedit and remove the "Require Password to Uninstall" option. Then, I navigated to the Uninstall section of the registry. There, you can find out what the uninstall path is for your product. Assuming the product is the same on each machine, you can create a batch file to auto-uninstall from the remote computers. For the Symantec product I had, there was a way to do it silently without restarting so that the end users didn't know anything was going on. If you have more than one msi to uninstall, you can program that into your batch file as well.

After that, you can use the RA console to silently deploy NOD32 to your workstations.

The hardest part, for me, was connecting to the registries of the remote computers to change that "Require Password to Uninstall" part (if you even have it setup that way, I don't know if it's an option in Mcafee).

This all assumes you have administrative privileges on the remote workstations.

Hope that helps!

 

McAfee 8.5.0 resists any and all registry changes (both local and remote) and sees them as threads. (And thus block them)