cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Maros
Level 7
Report Inappropriate Content
Message 1 of 13

Solidcore uninstall

Jump to solution

Hi Guys,

 

Any idea if I can find more detailed logs why uninstallation of Solidcore using Client task is failing. 

 

I was able to find this in masvc.log:

 

2019-10-15 10:36:39.736 masvc(2632.2884) scheduler.Info: The task SC uninstall becomes active
2019-10-15 10:36:39.798 masvc(2632.2884) Updater.Info: Received updater request initiator_type=4 request_type=0 taskid=148.
2019-10-15 10:36:39.798 masvc(2632.2884) Updater.Info: Creating scheduled task updater request, task id = 148.
2019-10-15 10:36:39.798 masvc(2632.2884) Updater.Info: Adding the updater request taskid <148> in the queue.
2019-10-15 10:36:40.800 masvc(2632.2884) Updater.Info: Invoking mue as, [C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe -script C:\ProgramData\McAfee\Agent\update\InstallMain.McS -id 28120 -localeid 0409 -logfile C:\ProgramData\McAfee\Agent\logs\McScript_deploy -parent FRAMEWORK -initiator 4 -installdir C:\Program Files\McAfee\Agent\\x86\ -taskid 148 (null) ].
2019-10-15 10:36:40.988 masvc(2632.2884) Updater.Info: Updater engine is spawned successfully.
2019-10-15 10:36:40.988 masvc(2632.2884) Updater.Info: Creating mue event handler.
2019-10-15 10:36:40.988 masvc(2632.2884) Updater.Info: Created mue event handler.
2019-10-15 10:36:40.988 masvc(2632.2884) Updater.Info: Launched updater engine successfully.
2019-10-15 10:36:40.988 masvc(2632.2884) Updater.Info: Updater session started for initiator type=4, task id = <148>.
2019-10-15 10:36:44.023 masvc(2632.2884) msgbus.Info: QueryFullProcessImageName C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe
2019-10-15 10:36:44.070 masvc(2632.2884) msgbus.Info: verify code signature returns <0>, GetLastError <0>.
2019-10-15 10:36:44.086 masvc(2632.2884) msgbus.Info: Adding <C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe>:<7992> auth info reference
2019-10-15 10:36:44.101 masvc(2632.2884) msgbus.Info: executable <C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe> is trusted via authenticode. Signer: <McAfee, Inc.> Issuer: <GlobalSign CodeSigning CA - G3>
2019-10-15 10:36:44.101 masvc(2632.2884) msgbus.Info: Allowing <7992> onto msgbus
2019-10-15 10:36:44.164 masvc(2632.2884) compatservice.Info: Received notifications for changes on backcompat watcher
2019-10-15 10:36:44.164 masvc(2632.2884) compatservice.Info: is_compat_running: 1, is_compat_required: 1
2019-10-15 10:36:45.087 masvc(2632.2884) compatservice.Info: Received notifications for changes on backcompat watcher
2019-10-15 10:36:45.087 masvc(2632.2884) compatservice.Info: is_compat_running: 1, is_compat_required: 1
2019-10-15 10:36:50.170 masvc(2632.2884) Updater.Info: Script Event : EID:0, Sev:4, ProductId:SOLIDCOR5000_WIN, Locale:0409, Type:Uninstall, State:9, Error:-1, NewVersion:, Date:, Message:
2019-10-15 10:36:50.170 masvc(2632.2884) Updater.Info: Script Event msg iEventId "0" iSeverity "4" iProductId "SOLIDCOR5000_WIN" iLocale "0409" iUpdateType "Uninstall" iUpdateState "9" iUpdateError "-1" iNewVersion "" iDateTime "" iCustomMessage ""
2019-10-15 10:36:50.201 masvc(2632.2884) Updater.Info: Script Event : EID:0, Sev:0, ProductId:EPOAGENT3000, Locale:0409, Type:N/A, State:1, Error:0, NewVersion:N/A, Date:N/A, Message:
2019-10-15 10:36:50.201 masvc(2632.2884) Updater.Info: Script Event msg iEventId "0" iSeverity "0" iProductId "EPOAGENT3000" iLocale "0409" iUpdateType "N/A" iUpdateState "1" iUpdateError "0" iNewVersion "N/A" iDateTime "N/A" iCustomMessage ""
2019-10-15 10:36:50.358 masvc(2632.2884) compatservice.Info: Received notifications for changes on backcompat watcher
2019-10-15 10:36:50.358 masvc(2632.2884) compatservice.Info: is_compat_running: 1, is_compat_required: 1
2019-10-15 10:36:56.532 masvc(2632.2884) msgbus.Error: Failed to write data on pipe name <\\.\pipe\ma_5bd9fa52-9d71-e8fd-20b0-306ab91d3db1_2632.0000000001E6E070_1518438826_0000000002591F20>
2019-10-15 10:36:56.547 masvc(2632.2884) msgbus.Error: UV write failed - uv error <36> <broken pipe>
2019-10-15 10:36:56.813 masvc(2632.2884) Updater.Info: Updater engine exited with exit status as 0 and term signal 0.
2019-10-15 10:37:03.745 masvc(2632.2884) scheduler.Info: The task SC uninstall has failed

 

Or any idea how could I resolve this and uninstall SC successfully?

 

Thanks

1 Solution

Accepted Solutions
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 13 of 13

Re: Solidcore uninstall

Jump to solution


@Maros To be clear, you can't use the SC:Disable task if the MACC (McAfee Application and Change Control) client is in Observe mode, nor can you use the "sadmin disable" command locally.

To switch from Observe to Disable mode for the client:

  • Run the SC:Observe Mode client task from ePO; set to End Observe Mode and Disable Solidcore client status in the task settings.
  • On the local client:
    • Run "sadmin eo -d"
      OR
    • Run "sadmin eo" (which ends Observe and switches to Enable), then "sadmin disable".
  • Reboot
12 Replies
McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 2 of 13

Re: Solidcore uninstall

Jump to solution

This alone doesnt tell me why it failed.

Can you run uninstall from add/remove programs? Does it fail also? 

Is solidcore disabled? 

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 3 of 13

Re: Solidcore uninstall

Jump to solution

Have you checked the solidcore client task log?

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Maros
Level 7
Report Inappropriate Content
Message 4 of 13

Re: Solidcore uninstall

Jump to solution

Solidcore is in observation mode, do I have to disable it totally ?

Here's the 'log' from client task when run from ePO.

 

Sent Run Now task "SC uninstall" to "RELAY02"
Run now task SC uninstall received.
Run now task started.
Run now task SC uninstall failed.<br/>Details: Product "SOLIDCOR5000_WIN" uninstallation failed, reason "Unknown error"..
Task Completed

 

I would like to avoid uninstalling manually so I would like to not to try this option for now.

McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 5 of 13

Re: Solidcore uninstall

Jump to solution

You need to send a sc:disable client task and reboot the client.

 

You cannot even uninstall manually till you disable the product.

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Maros
Level 7
Report Inappropriate Content
Message 6 of 13

Re: Solidcore uninstall

Jump to solution

Ok, I tried to send SC Disable task to the server but it's not changing it's state. Is it possible to go from Observation mode straight to disabled ? Task acts as successfully finished but the status of Solidcore is not changing

McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 7 of 13

Re: Solidcore uninstall

Jump to solution

Hi @Maros 

Have you performed reboot on the endpoint? What does sadmin status output show? Disabling Solidcore does not happen until you reboot the machine.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 8 of 13

Re: Solidcore uninstall

Jump to solution

Yes you can go from Observation to disabled

 

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Maros
Level 7
Report Inappropriate Content
Message 9 of 13

Re: Solidcore uninstall

Jump to solution

yes i tried to reboot several times, I even tried to run SC Disable task with force reboot feature on and no reboot happened. I ran the sadmin command, here's the result.

 

C:\Windows\system32>sadmin status
McAfee Solidifier: Observe
McAfee Solidifier on reboot: Observe

ePO Managed: Yes
Local CLI access: Lockdown

[fstype] [status] [driver status] [volume]
* NTFS Solidified Attached C:\
NTFS Solidified Attached D:\

McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 10 of 13

Re: Solidcore uninstall

Jump to solution

Look at your solidcore client task log to understand why the task is failing from epo.

Short answer is: To end observe you need to send the SC: Observe client task and select end observe with reboot. 

Another way is 

But you could recover the cli:

 

sadmin recover

Put your password.

Then run "sadmin eo -d"

 

 

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community