Drives are Decrypted but EPE is still Active

[bregus]

Hello! We're currently moving away from McAfee and I've been given the arduous task of removing it from the systems. This has mostly been smooth except 1 major hiccup: The users I have on my list have gone through the drive decryption process and it's completed. Unfortunately, They still read "Decryption in Progress". After doing a bit of digging, I discovered that this is because the System State for Drive encryption is still "Active". 

I'm a little hesitant to go forward with removing McAfee while this is the case. Waking the Agent doesn't seem to do much of anything . Is there a way to manually deactivate it (as I've been waiting literal weeks for the status to clear up) or should I be fine to move forward with uninstalling the software?  
Thanks in advance for whoever can help with this!

[cross]

If MDE is still active that indicates that the boot components are still in place.  It should prevent a removal but if for some reason you were able to, there would potentially be boot problems so we certainly don't want to do so while they are not in an inactive state.  In your policy for decryption, on the general tab, what is set in the "enable policy" field at the top? 

[bregus]

Hello! Thanks for the response! I've attached a screen shot of what it looks like. (edited as it didn't seem to attach. If it doesn't go through this time, the option for "Enable Drive Encryption for systems with assigned or local domain users" is Unchecked.) 

Would I still encounter this issue when following this guide to deactivate MDE?   "Error: Machine still ACTIVE" when you manually remove Drive Encryption  Would this be a viable solution to continue with the uninstall or would this cause more problems? 

[cross]

Thank you for that information.  Your policy is correct for the decryption and deactivation.  While that article may be viable, with the information I know at this point, I cannot say for certain until certain other aspects of the system(s) are checked.  What we'd really want to do at this point would be to get a MER file up for review.  That is not something that I'd advise attaching here though and instead would have to recommend an SR be opened and the MER file attached there.  

[bregus]

I'll look into opening a service request but in the meantime, is there anything you can recommend that I can do to push these machines through? I've had some systems stuck on "Deactivation in progress" for nearly 2 months. There must be a simpler way to do this if the registry edit isn't the answer (as I definitely don't want the preboot to still be active) 

[cross]

This state is unexpected so we need to look at the log data to make a determination as to what the reasoning is in order to make a recommendation.  I'd like to give you something quick to go on but any incorrect recommendation could potentially break systems.

[aguevara]

lets move this to the Drive encryption group for proper visibility