Powershell: Split Pipeline data (Reg Query)

[tri_94]

Hi there

 

i'm looking to create an uninstaller sophos and been told by sophos that each machine will have different reg keys. So they tell you to query the reg and copy and paste the keys into a bat file to make a uninstaller each time.

 

I'd like to use powershell do query and uninstall

 

Using the code below i can see the information i need

 

$data = Get-ItemProperty 'HKLM:\Software\microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { ($_.Publisher -ilike "Sophos Limited") -and $_.PSChildname -notlike "S*" } | Select-Object Displayname , PSChildname

 

Info returned

 

DisplayName PSChildName

----------- -----------

Sophos AMSI Protection {0EA5323F-DE1B-480C-911E-7827E5EAXXXX}

Sophos Endpoint Firewall {2831282D-8519-4910-B339-2302840AXXXX}

Sophos Network Threat Protection {4B1F9009-CD85-43C0-BCBD-D491908DXXXX}

Sophos Endpoint Self Help {4EFCDD15-24A2-4D89-84A4-857D1BF6XXXX}

Sophos Exploit Prevention {866151B2-E14E-40E0-B6D9-64B1D428XXXX}

Sophos Endpoint Agent {8D7BB12C-6854-46DF-A67D-F82D778DXXXX}

Sophos File Scanner {CD39E739-F480-4AC4-B0C9-68CA731DXXXX}

 

 

So now i was going to use (as the uninstall command is basically MsiExec.exe /X {CD39E739-F480-4AC4-B0C9-68CA731DXXXX}

 

foreach ($entry in $data) {

MsiExec.exe /X $data.pschildname }

 

But I think my problem is the info is being seen as a single block of text rather the individual lines

 

 

Many Thanks

[mavhc]

Don't sophos offer an uninstaller/cleanup script? They sent me one a decade ago

[tri_94]

nope there official documentation tell you to run

 

REG QUERY HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s /f SOPHOS > C:\Sophos_Uninstall_Strings.txt

and then tell you to copy and paste to this example

Uninstall string MsiExec.exe /X{01423865-551B-4C59-B44A-CC604BC21AF3}

[Arthur]

With PSADT it would just be a case of running the following functions to do what you need.

 

Remove-MSIApplications -Name 'Sophos AMSI Protection'
Remove-MSIApplications -Name 'Sophos Endpoint Firewall'
Remove-MSIApplications -Name 'Sophos Network Threat Protection'
Remove-MSIApplications -Name 'Sophos Endpoint Self Help'
Remove-MSIApplications -Name 'Sophos Exploit Prevention'
Remove-MSIApplications -Name 'Sophos Endpoint Agent'
Remove-MSIApplications -Name 'Sophos File Scanner'

 

... or if you want to add an additional filter for the Publisher.

 

Remove-MSIApplications -Name 'Sophos AMSI Protection' -FilterApplication @(,,@('Publisher', 'Sophos Limited', 'Contains'))
Remove-MSIApplications -Name 'Sophos Endpoint Firewall' -FilterApplication @(,,@('Publisher', 'Sophos Limited', 'Contains'))
Remove-MSIApplications -Name 'Sophos Network Threat Protection' -FilterApplication @(,,@('Publisher', 'Sophos Limited', 'Contains'))
Remove-MSIApplications -Name 'Sophos Endpoint Self Help' -FilterApplication @(,,@('Publisher', 'Sophos Limited', 'Contains'))
Remove-MSIApplications -Name 'Sophos Exploit Prevention' -FilterApplication @(,,@('Publisher', 'Sophos Limited', 'Contains'))
Remove-MSIApplications -Name 'Sophos Endpoint Agent' -FilterApplication @(,,@('Publisher', 'Sophos Limited', 'Contains'))
Remove-MSIApplications -Name 'Sophos File Scanner' -FilterApplication @(,,@('Publisher', 'Sophos Limited', 'Contains'))

 

You might also find the following post useful...

 

www.edugeek.net/forums/cloud-services/191252-withdraw-google-drive.html#post1634816

Edited June 11, 2020 by Arthur

[MartinByard]

I think you've got the foreach bit wrong ...

i think it should be:

foreach ($entry in $data) {
MsiExec.exe /X $entry.pschildname }

As $data is the array containing all the uninstall items like "Sophos" etc., and $entry is the inidividual item in the array you want to act on at the time.

[tri_94]

I think you've got the foreach bit wrong ...

i think it should be:

foreach ($entry in $data) {
MsiExec.exe /X $entry.pschildname }

As $data is the array containing all the uninstall items like "Sophos" etc., and $entry is the inidividual item in the array you want to act on at the time.

 

Thank you for that. I’m sure that will do it now