Manually uninstall DE / EPO has DE software version as "Unknown"

[markgarza]

Hi, I am trying to migrate our systems away from McAfee to Bitlocker since our contract was not renewed with McAfee (or Trellix now I guess). I have one system who I am having trouble removing McAfee completely from, it is unencrypted but my tasks to remove the software keep failing, and I noticed the software version just says "Unknown" in EPO as opposed to being blank after the uninstall.

I have tried a few times to uninstall or re-install then uninstall the DE software, different versions, none have worked and all fail when trying to interact with DE software, version still says "Unknown" in EPO. I have also tried to uninstall using the MSI command as described here: https://docs.trellix.com/bundle/drive-encryption-7.2.0-installation-guide-epolicy-orchestrator/page/... but it doesn't do anything, msiexec acts as if the software is already uninstalled.

Furthermore, I am unable to get the latest version of the Endpoint Product Removal Tool because of our expired license/grant number. 

Is there a documented way to manually uninstall DE software? Maybe one that details all the files and folders to delete? Or how can I resolve this other than reimaging the system?

[cross]

When you are running the uninstall commands, you can remove the /q so that you get some level of progress on the screen and you can also include logging information on the uninstall attempts with the logging switch added, something like:

/l*v path\logfile.txt

but referencing an actual path and I would recommend naming the log for the applicable component being removed.

That may give you some kind of an idea of its reason for failure

[markgarza]

I have done this, I get a pop up that says the product is already uninstalled and no log file. But I still have remnants in the registry of Drive Encryption stuff left behind that do not go away on restart. 

[cross]

It may be of value to do a repair installation of MDE of the same version that is/was there or even re-install and then attempt the removal with logging.  If successful, great but if not then the logging may give some indication of any impedance to complete removal.  Of course, as always, I'd recommend a backup of data before any testing as a general good practice.

[markgarza]

Is a repair installation a specific type of installation? Or do you just mean installing the reported version again? If so, I have done that with no luck. I might just need to re-image the device...