Uninstall the Endpoint Protection client using the command prompt

Products

• Endpoint Protection

Issue/Introduction

This article describes uninstalling the Symantec Endpoint Protection (SEP) client using Microsoft Installer (MSI) commands at the command line interface. This is useful if "Symantec Endpoint Protection" is not listed in Control Panel > Programs > Programs and Features.

This is also useful when a command-line is needed to uninstall the SEP Client using a third party tool such as SCCM, Altiris, Clarity or other 3rd party software management application.

Resolution

PowerShell

Note: These PowerShell steps only work on SEP client versions 14.3 RU9 and earlier. 

1. Open a PowerShell Window as Administrator.
2. Run the following command: (Get-WmiObject -Class Win32_Product -Filter "Name='Symantec Endpoint Protection'" -ComputerName ComputerNameHere).Uninstall()
3. A successful uninstall will return a message that ends with "ReturnValue: 0".

Note 1: If a client is password protected, you need to disable the SEP client first and then run the Powershell command. Password protection needs to be disabled from SEPM:

     Password-protecting the Symantec Endpoint Protection client

Note 2: If Tamper Protection is enabled, you need to disable it first and then run the Powershell command. Tamper Protection can be disabled on a single client, or multiple via SEPM policy:

     Disable Tamper Protection

 

DOS Command Prompt

Method 1 

1. Log on to the computer with administrator rights.
2. Find the Symantec Endpoint Protection uninstallation product key:
   1. Click Start > Run.
   2. Type regedit to open the Windows Registry Editor.
   3. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
   4. Browse the Uninstall subkeys in the left-hand pane, and check the values in the right-hand pane to find a value for the DisplayName that equals "Symantec Endpoint Protection".
   5. Copy the product uninstallation key. For example, the product uninstall key for Symantec Endpoint Protection 14.3.11213.9000 (SEP 14.3 RU9), is {D9535F90-573C-494B-9508-DE754951C4E2}
   6. Close the Windows Registry Editor.
3. Click Start > Run.
4. Type cmd to open the Windows command prompt.
5. At the Windows command prompt, type:
   
       msiexec /X {product uninstall key}
   
   The product uninstall key / identifier may be obtained using:
   
       wmic product where name="Symantec Endpoint Protection" get IdentifyingNumber
   
   Example: msiexec.exe /x {D9535F90-573C-494B-9508-DE754951C4E2} /passive
   
   To generate a detailed uninstall log, type:
   
       msiexec /X {product uninstall key} /l*v! log file path

• Example: msiexec /x {D9535F90-573C-494B-9508-DE754951C4E2} /lv!* c:\uninstallSEP.txt

THE ABOVE COMMAND line examples are those used with third-party tools for uninstall, for example what command-line to pass via SCCM.

Note: If the MSI uninstall has stopped responding, follow these steps:

1. Click Start > Run.
2. Type taskmgr.
3. Click the Processes tab.
4. Click End Process for all of the running Windows Installer processes by right-clicking on msiexec.exe, and then clicking End Process.
5. Repeat this for each instance of msiexec.exe listed.

 

Sample log file:

The uninstaller is trying to find some keys which are present in a 64-bit operating system, although they do not exist on a 32-bit operating system:

Action ended 13:37:50: InstallFinalize. Return value 1.
MSI (s) (0C:20) [13:37:50:312]: Doing action: SxsUninstallCA
Action start 13:37:50: SxsUninstallCA.
MSI (s) (0C:34) [13:37:50:375]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI14D.tmp, Entrypoint: CustomAction_SxsMsmCleanup
1: sxsdelca tried opening key w/o wow64key 2: Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents 3: 672 4: 0
1: sxsdelca tried opening wow64key 2: Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents 3: 680 4: 0
1: sxsdelca 2: traceop 3: 1158 4: 0
1: sxsdelca 2: traceop 3: 1186 4: 0

Method 2 

If you wish to uninstall through another cmdlet, the below can be followed. The MSI string changes with every new SEP client release, by using this method the MSI string isn't needed.

1. Open elevated command prompt window.
2. Run this command: wmic product where "name like 'Symantec Endpoint Protection%'" call uninstall /nointeractive

 

CleanWipe

For difficulty with uninstalling Endpoint Protection, see: Download the CleanWipe removal tool to uninstall Endpoint Protection.

 

References

For a list of available MSI command line switches, type: msiexec /? at the command prompt.