En-mass uninstall.

[boomam]

Hi.

Is there a way i can uninstall McAffee from all workstations/systems on our network without going to every station?

Our licences for NOD32 has just arrived and i want to blast it out asap.

 

Thanks in advance all. .

[mrtechsystems]

Might want to try this out

 

http://www.tucows.com/preview/195895

[boomam]

Now ive just got to work out how this NOD thing works.

3 parts to it, the AV, remote client and server.

 

The latter of which installs but has no icons? And the remote client doesnt detect any of our clients?

[garym2000]

Hi, you can use the msiexec command to unistall software, obviously try this with care on one or two machines before rolling it right out !

 

use:

 

msiexec/x {Package | ProductCode}

 

Parameters

/x

uninstalls a product.

 

Package - Name of the Windows Installer package file.

ProductCode - Globally unique identifier (GUID) of the Windows Installer package.

 

THe GUID can be found for Mcafee (or any other product) in the registry, but can;t quite recall where!

[garym2000]

Eset will provide tools to mass-uninstall, see here http://www.eset.co.uk/download/av-uninstallers.php

 

also see here for a good guide on how to install the http://www.eset.com/training/index.php

[boomam]

This is annoying me.

I was told prior to purchase the the AV business edition did spyware and AV protection. Now their tech support says it doesnt?

 

Plus, whats the difference between startup scanner on the kernel config tree, file system scan and computer scan?

This is really winding me up. Not the best way to start the week.

 

All i want is to set it up so its completely silent to the user! .

 

They've given me a McAfee file called MCPR which is a tool to uninstall our McAfee software. Does anyone know any command line switches for it to make the uninstallation silent?

 

And is there a guide anywhere to what every configuration does?

Edited February 25, 2008 by boomam

[boomam]

And the MCPR thing doesnt work!!!!!!!!!!!!!1

 

Today is not going well at at all.

[cookie_monster]

I've got the NOD bussiness client running here ver 3.0.621.0 and it says Antivirus and Antispyware scanner enabled. We're still on the old version on the network 2.7 but that still has limited spyware scanning built in.

[boomam]

Do you have the XML config file for your setup?

Asuming yours is set to completly silent/invisible from the user?

 

Thanks.

[boomam]

The apps that McAfee provides is rubbish. It just doesnt work. .

[tosh74]

Have look at a machine's registry that has the app on it. Run regedit and connect network registry. Navigate to HKLM\Software\Microsoft\Windows\Current Version\Uninstall\

 

Go through the keys till you find the app that you want to remove. Look for the uninstall value and copy the value data . Paste this string to a machine startup script (or create a new one). The app should be removed on the next reboot. If the app has already been removed then it will be ignored

Edited February 28, 2008 by tosh74

[PEO]

I you contact NOD they will have a script to remove McAfee safely. most antivirus companys do this

[boomam]

Have look at a machine's registry that has the app on it. Run regedit and connect network registry. Navigate to HKLM\Software\Microsoft\Windows\Current Version\Uninstall\

 

Go through the keys till you find the app that you want to remove. Look for the uninstall value and copy the value data . Paste this string to a machine startup script (or create a new one). The app should be removed on the next reboot. If the app has already been removed then it will be ignored

Interesting approach.

Do you have a more in-depth how-to link anywhere?

 

I you contact NOD they will have a script to remove McAfee safely. most antivirus companys do this

They say they dont have one, keep telling me to use MCPR.exe.

[tosh74]

See attached pic.

 

The example I give is for removing Java (Have a look at the DisplayName Value from the right hand side). To find McAfee right click on the Uninstall Key and select Find and enter McAfee. It should open the correct area. Form there you want the unistall string. Double click on the uninstall string and copy the string from the 'Value Data' line.

 

MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}

 

You now have the automatic uninstall string.

 

Now paste this string to notepad. You may have to enter the full path to msiexec - c:\windows\system32\MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} /quiet /norestart

 

(note I have added 2 switches to the end of the string)

Now save this file as a batch file (call if removeMcafee.bat) to a network drive.

 

Now go to a machine that has Active Directory for Users and Computers.

Open the Group Policy object for all your machines. Navigate to Computer Configuration\Windows Settings\Scripts (Startup/Shutdown)

 

Click on startup from the right hand pane and press Show Files (copy your batch file to the new window). Close the window and select Add then browse select your batch file. Click o OK till you're back to looking at your AD structure and exit the AD for User and Comps.

 

Feel free to PM if you would like more help

[boomam]

Very interesting idea.

 

Will the string be the same on every workstation though?

[Gatt]

its the Application GUID which will be identical on all PC's

You'll need the GUID for every application you want to un-install...

[boomam]

Where in the registry is that?

HKLM?

[Gatt]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

 

This brings up a list of GUID's - each one representing a different program

Eg {96C267DA-0926-4C11-B4E7-4D3EF85130D0} is the GUID for Paint.Net

You need the string called UninstallString..

[boomam]

Found them.

 

Theres a MSIEXEC one for the VirusScanner

and a csscan /uninstallmas one for the spyware.

 

Should be alright putting them both in a batch file shouldnt i?

[boomam]

Phew, what an afternoon, knackered!. Anyway:

 

Heres what i have:

 

Virus Scanner Enterprise:

MsiExec.exe /I{5DF3D1BB-894E-4DCD-8275-159AC9829B43}

 

Anti-Spyware Enterprise:

c:\program files\network associates\virusscan\csscan /UninstallMAS

 

 

I need the latter to un-install first, so i take that the batch file would read:

c:\program files\network associates\virusscan\csscan /UninstallMAS

c:\windows\system32\MsiExec.exe /I{5DF3D1BB-894E-4DCD-8275-159AC9829B43} /quiet /norestart

[boomam]

Bump! .

[ZeroHour]

BTW sophos also have a tool to run that will wipe av off your pc.

Give that a try if your having problems.

[boomam]

This is annoying me now.

 

I have three GPOs setup.

One to remove McAfee.

One to install NOD32 + settings.

One to remove NOD32 start menu shortcuts.

 

Ive got them set to a testing OU with my test computer, with McAfee installed on it, yet none of them seems to work? Although RSOP reports them as being detected.

 

Ideas?

Edited March 3, 2008 by boomam

[tosh74]

Have you ran

 

gpupdate /force

 

on your test machine ?

 

Sorry for not replying earlier

 

Have you checked the event logs on your test machine for clues as to why each GPO is not being processed as expected ?

Edited March 3, 2008 by tosh74

[boomam]

Yes.

On every boot.

 

 

Bizzarly, i tryed running the McAfee removal batch file manually and it just errors saying no such thing? .

So maybe thats why NOD isnt installing?