We have decided not to renew our contract with McAfee this year for what ever reason, we are now going with another AV provider. However we now have the challenge of removing McAfee from the client PCs throughout our domain. Can anyone give me any advice as to how to do this easily? We have a mix of 8.5 and 8.7 all distributed from an Epolicy Server using the Epolicy Agent.
We have been having real issues removing the software from the systems so any help would be great. Ideally we would be able to run a process or script from the server to so this as it is installed on 250 computers spread over a large area!!
Can you use your new vendors AVsoftware to remove vse itself? most of the big ones should allow this.
If so then I would just turn off access protection rules in policy and make sure this goes to agents then switch of deployment and updates tasks and roll in new AV software that removes vse
For the agents I would just script "c:\Program Files\McAfee\Common Framework\frminst.exe" /forceuninstall /silent (paths may vary)
I use psexec to do this sometimes against large lists of workstations as I like the ability to specify credentials to use, you could also add it as an AD script or login script or kix script or .....
I haven't had to do this, but I think this is what you would do.
I have ePO 4.5, so if you have a different version, the steps might be different.
In ePO, check the system tree to make sure there aren't any deployment tasks running at every policy enforcement interval. If there are, remove them.
Then, add a new Product Deployment task for your organization, choose VirusScan for the product, and choose "Remove" for the action.
After you are sure VirusScan is gone from all the systems, go to each group in the tree, select all systems, and choose "Delete" from the Actions->Directory Management menu.
Check the box to "Remove agent" when the confirmation dialog pops up.
You may have to fill in the domain/user/password info for some of the steps.
JayMessage was edited by: jguenrdc on 3/31/10 12:37:09 PM CDT
The problem with doing it that way is you are not then covered by an AV solution, thats why I recommend using your new point product to do the removal if it can do this. You can always clean up with a removal task once you have a new product in place and before you remove the agents.
Thanks for the replies, We have tried using the new AV but unfortunately it doesn't support the removal of McAfee Epolicy!! So I am trying this route, but our server is going so slow it is a painful task!!
We are happy to do the removal and deploy with a slight gap of AV cover - we will only be doing a handful at a time I think anyway!!
I am trying to get my head around this!! I have created a Group in the Tree for McAfee called Remove McAfee - I have added two systems in the folder and created a task to remove 8.5 and 8.7 to run immediately. Is this the correct way of doing it? I am not very together on using the Epolicy Server - more thrown myway to remove it from everyone!!!!
The new product is Kaspersky
Kaspersky admin kit should allow you to remove Mcafee VSE http://support.kaspersky.com/faq/?qid=208280963
We were looking at them last year and they advised me then that this was possible.
OK, I shall have another go with that as well then!! Do you know if we need to do anything on the Epolicy Server first of all to allow the removal to work? I am guessing there is some setting to prevent the removal of AV within McAfee?
Many thanks for all your help
Turn off any access protection rules in vse policy that stop the alteration or stopping of mcafee services.
I see you issue, as Kaspersky state that their actual AV install will not remove other vendors products ( nlike a lot of others which do) but with the Kaspersky admin kit you should be able to remove VSE.
EDIT: just checked again and Kaspersky Anti-Virus version 6.0 MP4 detects and allows automatic uninstallation of the following third-party antivirus software if installed "on top" of it:
McAfee VirusScan Enterprise 8.0.0
McAfee VirusScan Enterprise 8.7.0i
McAfee VirusScan Enterprise 8.5.0
I need to read things better
Ive been doing the reverse with Mcafee and Norton this week, dropping mcafee agents onto norton machines in preperation for running vse 8.7 installs to remove norton AV.
It all comes down to testing and choosing the easiest course to fit your systems. If you only have a few hundred machines you may be able to live with having them uncovered especially if you can do this out of hours. IN which case just:
Alter access protection policies and make sure they have propogated
Turn off all the tasks in epo but deployment
(Out of hours preferrably with all machines on) Set deployment to remove VSE but leave agent, run immediate with repeat at every policy enforcement interval.
Wake up all agents and ask for full properties
Use agents to monitor removal of VSE
Install alternate AV solution
Verify with agents
To remove agents either delete them in EPO choosing to uninstall/remove agent (dont like this as has never really worked for me) or run a batch file or script against them using the /forceuninstall /silent switches, yet again you can monitor this in epo and see how many you left and if any are not removing.
Message was edited by: tonyb99 on 01/04/10 11:00:47 ISTMessage was edited by: tonyb99 on 01/04/10 11:02:07 IST