Manually uninstall Endpoint Protection managers on Windows
search cancel

Manually uninstall Endpoint Protection managers on Windows

book

Article ID: 170039

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

You need to manually uninstall or remove the Symantec Endpoint Protection (SEP) manager from a Windows computer.

Note: To manually uninstall the client, see Manually uninstall the Endpoint Protection client.

Resolution

This document describes how to manually uninstall Symantec Endpoint Protection Manager 14.

NOTE: Upon completion of this manual uninstall, THE MACHINE MUST BE REBOOTED one final time in addition to any steps which require a reboot.

READ THIS DOCUMENT VERY CAREFULLY AND FULLY PRIOR TO ATTEMPTING THE MANUAL UNINSTALL STEPS.

WARNING: The manual removal steps outlined below can disable any other Symantec products that are installed on the computer, and as such these manual removal steps are NOT RECOMMENDED and NOT SUPPORTED. It is STRONGLY recommended that all Symantec products be uninstalled by using Add or Remove Programs before starting this process. Manual uninstall via file removal and registry manipulation should only be attempted as a last resort after first running traditional removal via Add Remove Programs and then via CleanWipe.

IT IS STRONGLY ADVISED THAT UNINSTALL VIA THE ADD/REMOVE PROGRAMS, THEN VIA THE CLEANWIPE UTILITY, BE PERFORMED PRIOR TO ANY MANUAL STEPS BELOW.

Not all registry keys, values, hives as well as entries, files, directories, etc. may be present. If an entry does not exist, move on to the next one.

To stop the Symantec Endpoint Protection Manager Services

  1. Click Start > Run.
  2. Type services.msc and click OK. 
  3. Find and stop the following services. To stop the service, right click on the service and select Stop (not all may be present):
    · Symantec Embedded Database 
    · Symantec Endpoint Protection Manager 
    · World Wide Web Publishing Service
    · Symantec Event Manager 
    · Symantec Settings Manager 
    · LiveUpdate 
    · Symantec Management Client 
    · Symantec Network Access Control 
    · Symantec Endpoint Protection 
    · Symantec Endpoint Protection Launcher
    · Symantec Endpoint Protection Manager API Service
    · Symantec Endpoint Protection Manager Webserver


 

Remove the ODBC DSN

Click Start > Settings > Control Panel > Administrative Tools > Data Sources (ODBC) for 32bit System

Click Start > Settings > Control Panel > Administrative Tools > ODBC Data Sources (32-bit) for 64bit System.

On the System DSN tab, delete the SQL Anywhere 11 data source.

 

WARNING: In the next steps you will edit the Windows registry. Back up the registry before you make any changes to it, because incorrect changes to the registry can result in permanent data loss or corrupted files. Modify or delete only the registry keys that are specified. 

Note: You must have administrator permissions (read and write) to edit the registry.

  1. In Windows Control Panel, use Add Remove Programs (or Programs and Features) to uninstall Symantec Endpoint Protection Manager, then run CleanWipe.
     
  2. Click Start > Run.
     
  3. Type regedit and click OK. 
     
  4. In the Windows registry editor, in the left pane, delete the following keys. If an entry is not present, skip to the next one. 
    · HKEY_CLASSES_ROOT\ASAEnum 
    · HKEY_CLASSES_ROOT\ASAEnum.90 
    · HKEY_CLASSES_ROOT\ASAErrorLookup 
    · HKEY_CLASSES_ROOT\ASAErrorLookup.90 
    · HKEY_CLASSES_ROOT\ASAProv 
    · HKEY_CLASSES_ROOT\ASAProv.90 
    · HKEY_CLASSES_ROOT\pmem2.MachineInfo2 
    · HKEY_CLASSES_ROOT\pmem2.MachineInfo2.1 
    · HKEY_CLASSES_ROOT\SesmLu.SesmLu 
    · HKEY_CLASSES_ROOT\SesmLu.SesmLu.1 
    · HKEY_CLASSES_ROOT\AppID\{8865322D-9384-44DA-ABEA-496D7268D42D} 
    · HKEY_CLASSES_ROOT\AppID\pmem2.DLL 
    · HKEY_CLASSES_ROOT\CLSID\{41DFE9EB-DB91-11D2-8C43-006008D26A6F} 
    · HKEY_CLASSES_ROOT\CLSID\{41DFE9EC-DB91-11D2-8C43-006008D26A6F} 
    · HKEY_CLASSES_ROOT\CLSID\{41DFE9ED-DB91-11D2-8C43-006008D26A6F} 
    · HKEY_CLASSES_ROOT\CLSID\{530DF3AD-6936-3214-A83B-27B63C7997C4} 
    · HKEY_CLASSES_ROOT\CLSID\{58CC9977-FED2-4D80-AD07-878E5B5CB783} 
    · HKEY_CLASSES_ROOT\CLSID\{EEA83A9F-D390-4D4E-8796-464E79337FE1} 
    · HKEY_CLASSES_ROOT\Installer\Features\66FEC14977D4DC44689F98CFA64C2B99 
    · HKEY_CLASSES_ROOT\Installer\Products\66FEC14977D4DC44689F98CFA64C2B99 
    · HKEY_CLASSES_ROOT\Installer\UpgradeCodes\BF9DACEA0693B5347B6760F9F875BF10 
    · HKEY_CLASSES_ROOT\Interface\{58CC9977-FED2-4D80-AD07-878E5B5CB783} 
    · HKEY_CLASSES_ROOT\TypeLib\{24F77A0F-F72E-440F-A8F8-CC2B975D1EF5} 
    · HKEY_CLASSES_ROOT\TypeLib\{F63F561C-EB82-4E54-B81C-BE1757406EF9} 
    · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{941CEF66-4D77-44CD-86F9-89FC6AC4B299} 
    · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\BF9DACEA0693B5347B6760F9F875BF10 
    · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\66FEC14977D4DC44689F98CFA64C2B99 
    · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{941CEF66-4D77-44CD-86F9-89FC6AC4B299} 
    · HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs\SymcData-sesmvirdef32 
    · HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs\SymcData-sesmvirdef64 
    · HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs\SymcData-sesmips32 
    · HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs\SymcData-sesmips64 
    · HKEY_LOCAL_MACHINE\Software\Symantec\Symantec Endpoint Protection\SEPM
     
  5. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
     
  6. Select Uninstall. 
     
  7. Select Edit.
     
  8. Click Find.
     
  9. Type symantec
     
  10. Click Find Next.
    Check for any values appearing in the right pane that include the word Symantec, in a key that is still in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall. If the key that is selected is still in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, delete the key (in the left pane) this key will be in the form of a 24 character alphanumeric GUID surrounded by {} brackets. Then repeat the search. If the key that is selected is not in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, continue to the next step. 
     
  11. Remove any values with "Symantec" in the path from the following key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
     
  12. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\
     
  13. Select Products
     
  14. Select Edit
  15. Click Find
     
  16. Type Symantec Endpoint Protection Manager
     
  17. Click Find Next.
    A value appears in the right pane that includes the words Symantec Endpoint Protection Manager, in a key named "InstallProperties". The "InstallProperties" key resides within another key whose name is a hexadecimal string. Use this hexadecimal string as the value for {PRODUCT.EN_US} for the remainder of this tutorial. [Example: {PRODUCT.EN_US}= B5F96BC646091CA4B9FC8F731AD47FA5 for build 12.1.598.4692] 
     
  18. In the Windows registry editor, in the left pane, delete the following key
    · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\{PRODUCT.EN_US}
     
  19. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders 
     
  20. Click the Folders key to select it. 
     
  21. Remove any values with "Symantec Endpoint Protection Manager" in the path. 
     
  22. Still in the Folders key, in the right pane find and delete the entry C:\WINDOWS\Installer\{941CEF66-4D77-44CD-86F9-89FC6AC4B299} C:\Windows\Installer\{988F6D7E-8A8B-53AC-A79D-35E1232E2FCA} C:\Windows\Installer\{AECAD9FB-3960-435B-B776-069F8F57FB01}
     
  23. Navigate to the following key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SharedDLLs 
     
  24. Click the SharedDLLs to select it. 
     
  25. Remove any values with "C:\Program Files\Symantec\Symantec Endpoint Protection Manager" in the path. 
     
  26. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps\ 
     
  27. Delete the following under this key: 
    · Reporting 
    · SesmContent 
    · SymcData-sesmvirdef32 
    · SymcData-sesmvirdef64 
    · SymcData-sesmips32 
    · SymcData-sesmips64
     
  28. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services 
     
  29. Delete the following under this key: 
    · Adaptive_Server_Anywhere_9 
    · ASANYs_sem5 
    · semsrv
     
  30. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application 
     
  31. Delete the following under this key: 
    · ASANYs_sem5 
    · Secars 
    · SemSrv
     
  32. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services 
     
  33. Delete the following under this key: 
    · Adaptive_Server_Anywhere_9 
    · ASANYs_sem5 
    · semsrv
     
  34. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application 
     
  35. Delete the following under this key: 
    · ASANYs_sem5 
    · Secars 
    · SemSrv
     
  36. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
     
  37. Delete the following under this key: 
    · Adaptive_Server_Anywhere_9 
    · ASANYs_sem5 
    · semsrv
     
  38. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application 
     
  39. Delete the following under this key: 
    · ASANYs_sem5 
    · Secars 
    · SemSrv


To remove Symantec Endpoint Protection files and folders:
 

Delete the following files and folders. If a file or folder is not present, move on to the next one. 
· C:\Windows\Installer\{941CEF66-4D77-44CD-86F9-89FC6AC4B299} (Note: "Installer" is a hidden system folder.)
· C:\Windows\Installer\{988F6D7E-8A8B-53AC-A79D-35E1232E2FCA} (Note: "Installer" is a hidden system folder.) 
· C:\Windows\Installer\{AECAD9FB-3960-435B-B776-069F8F57FB01} (Note: "Installer" is a hidden system folder.)
· C:\Program Files\Symantec\Symantec Endpoint Protection Manager\
· C:\Program Files\Symantec\Symantec Endpoint Protection\
· C:\ProgramData\Symantec\Symantec Endpoint Protection Manager\ 
· C:\ProgramData\Symantec\Symantec Endpoint Protection\ 
· C:\Documents and Settings\All Users\Start Menu\Programs\Symantec Endpoint Protection Manager
· C:\Documents and Settings\All Users\Start Menu\Programs\Symantec Endpoint Protection

If Symantec Endpoint Protection was installed on a 64-bit computer, delete the following folder: 
· C:\Program Files(x86)\Symantec\Symantec Endpoint Protection Manager

Browse to C:\Program Files\Common Files\Symantec Shared\SymcData 
· Delete any folder that starts with SESM (IE sesmvirdef32)
 

To start the World Wide Web Publishing Service 
 

  1. Click Start > Run.
     
  2. Type services.msc and click OK. 
     
  3. Right click World Wide Web Publishing Service, and select Start World Wide Web Publishing Service.
     

Restart the machine.

Powered by Wolken Software