Uninstall the Endpoint Protection client using the command prompt

Products

• Endpoint Protection

Issue/Introduction

This article describes how to uninstall Symantec Endpoint Protection (SEP) using Microsoft Installer (MSI) commands at the command line interface. This is useful if SEP is not listed in Add or Remove Programs.

This is also useful if a command-line is needed to uninstall the SEP Client using a third party tool such as SCCM, Altiris, Clarity or other 3rd party software management application.

Resolution

PowerShell

Note: These PowerShell steps only work on 14.3 RU9 and earlier. 

1. Open a PowerShell Window as Administrator.
2. Run the following command: (Get-WmiObject -Class Win32_Product -Filter "Name='Symantec Endpoint Protection'" -ComputerName ComputerNameHere).Uninstall()
3. A successful uninstall will return a message that ends with "ReturnValue: 0".

Note 1: If a client is password protected, you need to disable it first and then run the script. Password protection needs to be disabled from SEPM:

     Password-protecting the Symantec Endpoint Protection client

Note 2: If Tamper Protection is enabled, you need to disable it first and then run the script. Tamper Protection can be disabled on a single client, or multiple via SEPM policy:

     Disable Tamper Protection

 

 

DOS Command Prompt

Method 1 

1. Log on to the computer with administrator rights.
2. Find the Symantec Endpoint Protection uninstallation product key:
   1. Click Start > Run.
   2. Type regedit to open the Windows Registry Editor.
   3. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
   4. Browse the Uninstall subkeys in the left-hand pane, and check the values in the right-hand pane to find a value for the DisplayName that equals Symantec Endpoint Protection.
   5. Copy the uninstallation key. For example, the key for Symantec Endpoint Protection 12.1.671.4971 is A3AEEA68-AC93-4F6F-8D2D-78BBF7E422B8.
   6. Close the Windows Registry Editor.
3. Click Start > Run.
4. Type cmd to open the Windows command prompt.
5. At the Windows command prompt, type:
   
       msiexec /X {product uninstall key}
   
   The product uninstall key / identifier may be obtained using:
   
      wmic product where name="Symantec Endpoint Protection" get IdentifyingNumber
   
   Example: msiexec.exe /x {A3AEEA68-AC93-4F6F-8D2D-78BBF7E422B8} /passive
   
   To generate a detailed uninstall log, type:
   
   msiexec /X {product uninstall key} /l*v! log file path

• Example: msiexec /x {A3AEEA68-AC93-4F6F-8D2D-78BBF7E422B8} /lv!* c:\uninstallSEP.txt

THE ABOVE COMMAND line examples are the ones to use for a third-party tool for uninstall, for example what command-line to pass via SCCM

Note: If the MSI uninstall has stopped responding, follow these steps:

1. Click Start > Run.
2. Type taskmgr.
3. Click the Processes tab.
4. Click End Process for all of the running Windows Installer processes by right-clicking on msiexec.exe, and then clicking End Process.
5. Repeat this for each instance of msiexec.exe listed.

 

Sample log file:

The uninstaller is trying to find some keys which are present in a 64-bit operating system, but they do not exist on a 32-bit operating system:

Action ended 13:37:50: InstallFinalize. Return value 1.
MSI (s) (0C:20) [13:37:50:312]: Doing action: SxsUninstallCA
Action start 13:37:50: SxsUninstallCA.
MSI (s) (0C:34) [13:37:50:375]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI14D.tmp, Entrypoint: CustomAction_SxsMsmCleanup
1: sxsdelca tried opening key w/o wow64key 2: Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents 3: 672 4: 0
1: sxsdelca tried opening wow64key 2: Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents 3: 680 4: 0
1: sxsdelca 2: traceop 3: 1158 4: 0
1: sxsdelca 2: traceop 3: 1186 4: 0

Method 2 

If you wish to uninstall through another cmdlet the below can be followed. The MSI string changes with every new SEP release, in this method you don't have to mention MSI string.

1. Open elevated command prompt window.
2. Run the below command.

wmic product where "name like 'Symantec Endpoint Protection%'" call uninstall /nointeractive

CleanWipe

For difficulty with uninstalling Endpoint Protection, also see: Download the CleanWipe removal tool to uninstall Endpoint Protection.

References

For a list of available MSI command line switches, type msiexec /? at the command prompt.