Can you use your new vendors AVsoftware to remove vse itself? most of the big ones should allow this.
If so then I would just turn off access protection rules in policy and make sure this goes to agents then switch of deployment and updates tasks and roll in new AV software that removes vse
For the agents I would just script "c:\Program Files\McAfee\Common Framework\frminst.exe" /forceuninstall /silent (paths may vary)
I use psexec to do this sometimes against large lists of workstations as I like the ability to specify credentials to use, you could also add it as an AD script or login script or kix script or .....
I haven't had to do this, but I think this is what you would do.
I have ePO 4.5, so if you have a different version, the steps might be different.
In ePO, check the system tree to make sure there aren't any deployment tasks running at every policy enforcement interval. If there are, remove them.
Then, add a new Product Deployment task for your organization, choose VirusScan for the product, and choose "Remove" for the action.
After you are sure VirusScan is gone from all the systems, go to each group in the tree, select all systems, and choose "Delete" from the Actions->Directory Management menu.
Check the box to "Remove agent" when the confirmation dialog pops up.
You may have to fill in the domain/user/password info for some of the steps.
The problem with doing it that way is you are not then covered by an AV solution, thats why I recommend using your new point product to do the removal if it can do this. You can always clean up with a removal task once you have a new product in place and before you remove the agents.
Thanks for the replies, We have tried using the new AV but unfortunately it doesn't support the removal of McAfee Epolicy!! So I am trying this route, but our server is going so slow it is a painful task!!
We are happy to do the removal and deploy with a slight gap of AV cover - we will only be doing a handful at a time I think anyway!!
thats dissapointing whats the new point product?
I am trying to get my head around this!! I have created a Group in the Tree for McAfee called Remove McAfee - I have added two systems in the folder and created a task to remove 8.5 and 8.7 to run immediately. Is this the correct way of doing it? I am not very together on using the Epolicy Server - more thrown myway to remove it from everyone!!!!
The new product is Kaspersky
OK, I shall have another go with that as well then!! Do you know if we need to do anything on the Epolicy Server first of all to allow the removal to work? I am guessing there is some setting to prevent the removal of AV within McAfee?
Many thanks for all your help
Turn off any access protection rules in vse policy that stop the alteration or stopping of mcafee services.
I see you issue, as Kaspersky state that their actual AV install will not remove other vendors products ( nlike a lot of others which do) but with the Kaspersky admin kit you should be able to remove VSE.
EDIT: just checked again and Kaspersky Anti-Virus version 6.0 MP4 detects and allows automatic uninstallation of the following third-party antivirus software if installed "on top" of it:
McAfee VirusScan Enterprise 8.0.0
McAfee VirusScan Enterprise 8.7.0i
McAfee VirusScan Enterprise 8.5.0
I need to read things better
Ive been doing the reverse with Mcafee and Norton this week, dropping mcafee agents onto norton machines in preperation for running vse 8.7 installs to remove norton AV.
It all comes down to testing and choosing the easiest course to fit your systems. If you only have a few hundred machines you may be able to live with having them uncovered especially if you can do this out of hours. IN which case just:
Alter access protection policies and make sure they have propogated
Turn off all the tasks in epo but deployment
(Out of hours preferrably with all machines on) Set deployment to remove VSE but leave agent, run immediate with repeat at every policy enforcement interval.
Wake up all agents and ask for full properties
Use agents to monitor removal of VSE
Install alternate AV solution
Verify with agents
To remove agents either delete them in EPO choosing to uninstall/remove agent (dont like this as has never really worked for me) or run a batch file or script against them using the /forceuninstall /silent switches, yet again you can monitor this in epo and see how many you left and if any are not removing.
Message was edited by: tonyb99 on 01/04/10 11:00:47 IST