Ms Forefront removal

[fdamien]

Hi All,

is it possible to perform the following tasks using McAfee EPO:

• Removing Microsoft ForeFront before pushing the McAfee Agent.
• Creating a policy on EPO for the endpoint to get the updates directly from McAfee in case the EPO server is down.

Thanks in advance.

Message was edited by: fdamien on 5/21/13 4:00:54 AM CDT

[apoling]

Hello,

To answer your second query: normally the fallback update site in the client update (ePO managed) task (repository list in the agent Repository policy) by default for every endpoint is the McAfee FTP or HTTP site so this requirement of yours could be met. Also, please check the AutoUpdate task, which is the factory set update task in Virusscan, this is also set to the McAfee update site by default.

As for your first query: it certainly is not possible since it is the agent that invokes the removal command on the client, so technically the agent must be installed beforehand.

Attila

Message was edited by: apoling on 21/05/13 14:14:49 CEST

[fdamien]

Thank you Attila for your prompt response. Regarding the first query, let's say the McAfee agent is pushed to the client machine, would it be possible to remove Forefront? if yes can you provide supporting documents?

Thank you.

[apoling · Accepted solution]

Hello,

In the case of a third party AV product, such as MS Forefront Client installing VirusScan will do the uninstallation of ForeFront Client. I was wrongly referred to uninstallation by the agent in the case of a Microsoft product, while in the case of a McAfee product the agent does the uninstall. Sorry for that.

So by deploying Virusscan to the host (and for which the agent must be installed/pushed to the same host  beforehand), ForeFront client will be uninstalled by Virusscan installer. See also KB72251.

Attila

[fdamien]

you have to modify the uninst.ini to match the Forefront antivirus. i don't know what should be the content of the file really.

[apoling]

Uninst.ini is part of the VirusScan installation package and do not need to be modified by you (or me).

There is a section for Forefront Client (as Product_181),which details what the uninstaller should look for and where in the registry and which is the uninstallation command for this product.