Solidcore uninstall

[Maros]

Hi Guys,

Any idea if I can find more detailed logs why uninstallation of Solidcore using Client task is failing. 

I was able to find this in masvc.log:

2019-10-15 10:36:39.736 masvc(2632.2884) scheduler.Info: The task SC uninstall becomes active
2019-10-15 10:36:39.798 masvc(2632.2884) Updater.Info: Received updater request initiator_type=4 request_type=0 taskid=148.
2019-10-15 10:36:39.798 masvc(2632.2884) Updater.Info: Creating scheduled task updater request, task id = 148.
2019-10-15 10:36:39.798 masvc(2632.2884) Updater.Info: Adding the updater request taskid <148> in the queue.
2019-10-15 10:36:40.800 masvc(2632.2884) Updater.Info: Invoking mue as, [C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe -script C:\ProgramData\McAfee\Agent\update\InstallMain.McS -id 28120 -localeid 0409 -logfile C:\ProgramData\McAfee\Agent\logs\McScript_deploy -parent FRAMEWORK -initiator 4 -installdir C:\Program Files\McAfee\Agent\\x86\ -taskid 148 (null) ].
2019-10-15 10:36:40.988 masvc(2632.2884) Updater.Info: Updater engine is spawned successfully.
2019-10-15 10:36:40.988 masvc(2632.2884) Updater.Info: Creating mue event handler.
2019-10-15 10:36:40.988 masvc(2632.2884) Updater.Info: Created mue event handler.
2019-10-15 10:36:40.988 masvc(2632.2884) Updater.Info: Launched updater engine successfully.
2019-10-15 10:36:40.988 masvc(2632.2884) Updater.Info: Updater session started for initiator type=4, task id = <148>.
2019-10-15 10:36:44.023 masvc(2632.2884) msgbus.Info: QueryFullProcessImageName C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe
2019-10-15 10:36:44.070 masvc(2632.2884) msgbus.Info: verify code signature returns <0>, GetLastError <0>.
2019-10-15 10:36:44.086 masvc(2632.2884) msgbus.Info: Adding <C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe>:<7992> auth info reference
2019-10-15 10:36:44.101 masvc(2632.2884) msgbus.Info: executable <C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe> is trusted via authenticode. Signer: <McAfee, Inc.> Issuer: <GlobalSign CodeSigning CA - G3>
2019-10-15 10:36:44.101 masvc(2632.2884) msgbus.Info: Allowing <7992> onto msgbus
2019-10-15 10:36:44.164 masvc(2632.2884) compatservice.Info: Received notifications for changes on backcompat watcher
2019-10-15 10:36:44.164 masvc(2632.2884) compatservice.Info: is_compat_running: 1, is_compat_required: 1
2019-10-15 10:36:45.087 masvc(2632.2884) compatservice.Info: Received notifications for changes on backcompat watcher
2019-10-15 10:36:45.087 masvc(2632.2884) compatservice.Info: is_compat_running: 1, is_compat_required: 1
2019-10-15 10:36:50.170 masvc(2632.2884) Updater.Info: Script Event : EID:0, Sev:4, ProductId:SOLIDCOR5000_WIN, Locale:0409, Type:Uninstall, State:9, Error:-1, NewVersion:, Date:, Message:
2019-10-15 10:36:50.170 masvc(2632.2884) Updater.Info: Script Event msg iEventId "0" iSeverity "4" iProductId "SOLIDCOR5000_WIN" iLocale "0409" iUpdateType "Uninstall" iUpdateState "9" iUpdateError "-1" iNewVersion "" iDateTime "" iCustomMessage ""
2019-10-15 10:36:50.201 masvc(2632.2884) Updater.Info: Script Event : EID:0, Sev:0, ProductId:EPOAGENT3000, Locale:0409, Type:N/A, State:1, Error:0, NewVersion:N/A, Date:N/A, Message:
2019-10-15 10:36:50.201 masvc(2632.2884) Updater.Info: Script Event msg iEventId "0" iSeverity "0" iProductId "EPOAGENT3000" iLocale "0409" iUpdateType "N/A" iUpdateState "1" iUpdateError "0" iNewVersion "N/A" iDateTime "N/A" iCustomMessage ""
2019-10-15 10:36:50.358 masvc(2632.2884) compatservice.Info: Received notifications for changes on backcompat watcher
2019-10-15 10:36:50.358 masvc(2632.2884) compatservice.Info: is_compat_running: 1, is_compat_required: 1
2019-10-15 10:36:56.532 masvc(2632.2884) msgbus.Error: Failed to write data on pipe name <\\.\pipe\ma_5bd9fa52-9d71-e8fd-20b0-306ab91d3db1_2632.0000000001E6E070_1518438826_0000000002591F20>
2019-10-15 10:36:56.547 masvc(2632.2884) msgbus.Error: UV write failed - uv error <36> <broken pipe>
2019-10-15 10:36:56.813 masvc(2632.2884) Updater.Info: Updater engine exited with exit status as 0 and term signal 0.
2019-10-15 10:37:03.745 masvc(2632.2884) scheduler.Info: The task SC uninstall has failed

Or any idea how could I resolve this and uninstall SC successfully?

Thanks

[BenEllis]

This alone doesnt tell me why it failed.

Can you run uninstall from add/remove programs? Does it fail also? 

Is solidcore disabled? 

[BenEllis]

Have you checked the solidcore client task log?

[Maros]

Solidcore is in observation mode, do I have to disable it totally ?

Here's the 'log' from client task when run from ePO.

Sent Run Now task "SC uninstall" to "RELAY02"

Run now task SC uninstall received.

Run now task started.

Run now task SC uninstall failed.<br/>Details: Product "SOLIDCOR5000_WIN" uninstallation failed, reason "Unknown error"..

Task Completed

I would like to avoid uninstalling manually so I would like to not to try this option for now.

[BenEllis]

You need to send a sc:disable client task and reboot the client.

You cannot even uninstall manually till you disable the product.

[Maros]

Ok, I tried to send SC Disable task to the server but it's not changing it's state. Is it possible to go from Observation mode straight to disabled ? Task acts as successfully finished but the status of Solidcore is not changing

[AdithyanT]

Hi @Maros 

Have you performed reboot on the endpoint? What does sadmin status output show? Disabling Solidcore does not happen until you reboot the machine.

[BenEllis]

Yes you can go from Observation to disabled

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

[Maros]

yes i tried to reboot several times, I even tried to run SC Disable task with force reboot feature on and no reboot happened. I ran the sadmin command, here's the result.

C:\Windows\system32>sadmin status
McAfee Solidifier: Observe
McAfee Solidifier on reboot: Observe

ePO Managed: Yes
Local CLI access: Lockdown

[fstype] [status] [driver status] [volume]
* NTFS Solidified Attached C:\
NTFS Solidified Attached D:\

[BenEllis]

Look at your solidcore client task log to understand why the task is failing from epo.

Short answer is: To end observe you need to send the SC: Observe client task and select end observe with reboot. 

Another way is 

But you could recover the cli:

sadmin recover

Put your password.

Then run "sadmin eo -d"