1 Reply Latest reply on Aug 23, 2011 1:38 PM by landmissle

    How to manually uninstall Policy Auditor Agent

        Hi all,


        I'm having some problems removing the Policy Auditory (PA) agent remotely on a few systems. Is there a way to manually remove the agent from the client.   I'm thinking some command line execuable with the appropriate switches....The obvious removal method via Add/Remove Programs does not work.


         Thanks for any insight.


      Message was edited by: landmissle on 8/19/11 3:43:50 PM CDT
        • 1. Re: How to manually uninstall Policy Auditor Agent

            Hi all,


            I've see that there have been a few views of this post, so, in case there's an interest, I'll post the reply I received from McAfee support;



          . Stop the following services under windows services:


            mcafee audit manager service

            mcafee framework service



          . Stop the following processes in windows task manager:




          . Delete the following registry entries:


          Hklm\software\network associates\epolicyorchestrator\application plugins\policyau5X00  (where X=some number)


          Hklm\software\networkassociates\epolicy orchestrator\application plugins\auengine5X00 (where X=some number)


          Hklm\system\current controlset\services\mcafeeauditmanager



          . Delete the following directories:


          Program files\mcafee\audit manager

          Program files\mcafee\audit content update

          Program files\mcafee\policy auditor agent

          Document and settings\all users\applicationdata\mcafee\common framework\current\policyau5X00


          Hklm\software\microsoft\windows\currentversion\uninstall\[48804885.....CCD04}\   <<<<  this should be the correct uninstall entryfor mcafee policy auditor agent 

          Hklm\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\58840 8847.......5DC40\    <<<  this should be the correct installer entryfor mcafee policy auditor agent





          My notes:  Some of they registry entries may be hard to find depending on which version of Windows you're using (Windows XP vs. Windows 7 for example.) and may not be in the exact location as listed. Navigate to a parent location you can find and then search on the strings givien (viz. 48804885 & 588408847).


          In addition, the directories to be removed will vary slighty between Windows XP and Windows 7.



          Hope this proves useful.