Manually uninstall Endpoint Protection managers on Windows


Article ID: 170039


Updated On:


Endpoint Protection


You need to manually uninstall or remove the Symantec Endpoint Protection (SEP) manager from a Windows computer.

Note: To manually uninstall the client, see Manually uninstall the Endpoint Protection client.


This document describes how to manually uninstall Symantec Endpoint Protection Manager 14.

NOTE: Upon completion of this manual uninstall, THE MACHINE MUST BE REBOOTED one final time in addition to any steps which require a reboot.


WARNING: The manual removal steps outlined below can disable any other Symantec products that are installed on the computer, and as such these manual removal steps are NOT RECOMMENDED and NOT SUPPORTED. It is STRONGLY recommended that all Symantec products be uninstalled by using Add or Remove Programs before starting this process. Manual uninstall via file removal and registry manipulation should only be attempted as a last resort after first running traditional removal via Add Remove Programs and then via CleanWipe.


Not all registry keys, values, hives as well as entries, files, directories, etc. may be present. If an entry does not exist, move on to the next one.

To stop the Symantec Endpoint Protection Manager Services

  1. Click Start Run.
  2. Type services.msc and click OK. 
  3. Find and stop the following services. To stop the service, right click on the service and select Stop (not all may be present):
    · Symantec Embedded Database 
    · Symantec Endpoint Protection Manager 
    · World Wide Web Publishing Service
    · Symantec Event Manager 
    · Symantec Settings Manager 
    · LiveUpdate 
    · Symantec Management Client 
    · Symantec Network Access Control 
    · Symantec Endpoint Protection 
    · Symantec Endpoint Protection Launcher
    · Symantec Endpoint Protection Manager API Service
    · Symantec Endpoint Protection Manager Webserver


Remove the ODBC DSN

Click Start Settings Control Panel Administrative Tools Data Sources (ODBC) for 32bit System

Click Start Settings Control Panel Administrative Tools > ODBC Data Sources (32-bit) for 64bit System.

On the System DSN tab, delete the SQL Anywhere 11 data source.


WARNING: In the next steps you will edit the Windows registry. Back up the registry before you make any changes to it, because incorrect changes to the registry can result in permanent data loss or corrupted files. Modify or delete only the registry keys that are specified. 

Note: You must have administrator permissions (read and write) to edit the registry.

  1. In Windows Control Panel, use Add Remove Programs (or Programs and Features) to uninstall Symantec Endpoint Protection Manager, then run CleanWipe.
  2. Click Start Run.
  3. Type regedit and click OK
  4. In the Windows registry editor, in the left pane, delete the following keys. If an entry is not present, skip to the next one. 
    · HKEY_CLASSES_ROOT\ASAErrorLookup.90 
    · HKEY_CLASSES_ROOT\pmem2.MachineInfo2 
    · HKEY_CLASSES_ROOT\pmem2.MachineInfo2.1 
    · HKEY_CLASSES_ROOT\SesmLu.SesmLu 
    · HKEY_CLASSES_ROOT\SesmLu.SesmLu.1 
    · HKEY_CLASSES_ROOT\AppID\{8865322D-9384-44DA-ABEA-496D7268D42D} 
    · HKEY_CLASSES_ROOT\CLSID\{41DFE9EB-DB91-11D2-8C43-006008D26A6F} 
    · HKEY_CLASSES_ROOT\CLSID\{41DFE9EC-DB91-11D2-8C43-006008D26A6F} 
    · HKEY_CLASSES_ROOT\CLSID\{41DFE9ED-DB91-11D2-8C43-006008D26A6F} 
    · HKEY_CLASSES_ROOT\CLSID\{530DF3AD-6936-3214-A83B-27B63C7997C4} 
    · HKEY_CLASSES_ROOT\CLSID\{58CC9977-FED2-4D80-AD07-878E5B5CB783} 
    · HKEY_CLASSES_ROOT\CLSID\{EEA83A9F-D390-4D4E-8796-464E79337FE1} 
    · HKEY_CLASSES_ROOT\Installer\Features\66FEC14977D4DC44689F98CFA64C2B99 
    · HKEY_CLASSES_ROOT\Installer\Products\66FEC14977D4DC44689F98CFA64C2B99 
    · HKEY_CLASSES_ROOT\Installer\UpgradeCodes\BF9DACEA0693B5347B6760F9F875BF10 
    · HKEY_CLASSES_ROOT\Interface\{58CC9977-FED2-4D80-AD07-878E5B5CB783} 
    · HKEY_CLASSES_ROOT\TypeLib\{24F77A0F-F72E-440F-A8F8-CC2B975D1EF5} 
    · HKEY_CLASSES_ROOT\TypeLib\{F63F561C-EB82-4E54-B81C-BE1757406EF9} 
    · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{941CEF66-4D77-44CD-86F9-89FC6AC4B299} 
    · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\BF9DACEA0693B5347B6760F9F875BF10 
    · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\66FEC14977D4DC44689F98CFA64C2B99 
    · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{941CEF66-4D77-44CD-86F9-89FC6AC4B299} 
    · HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs\SymcData-sesmvirdef32 
    · HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs\SymcData-sesmvirdef64 
    · HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs\SymcData-sesmips32 
    · HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs\SymcData-sesmips64 
    · HKEY_LOCAL_MACHINE\Software\Symantec\Symantec Endpoint Protection\SEPM
  5. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  6. Select Uninstall
  7. Select Edit.
  8. Click Find.
  9. Type symantec
  10. Click Find Next.
    Check for any values appearing in the right pane that include the word Symantec, in a key that is still in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall. If the key that is selected is still in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, delete the key (in the left pane) this key will be in the form of a 24 character alphanumeric GUID surrounded by {} brackets. Then repeat the search. If the key that is selected is not in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, continue to the next step. 
  11. Remove any values with "Symantec" in the path from the following key:
  12. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\
  13. Select Products
  14. Select Edit
  15. Click Find
  16. Type Symantec Endpoint Protection Manager
  17. Click Find Next.
    A value appears in the right pane that includes the words Symantec Endpoint Protection Manager, in a key named "InstallProperties". The "InstallProperties" key resides within another key whose name is a hexadecimal string. Use this hexadecimal string as the value for {PRODUCT.EN_US} for the remainder of this tutorial. [Example: {PRODUCT.EN_US}= B5F96BC646091CA4B9FC8F731AD47FA5 for build 12.1.598.4692] 
  18. In the Windows registry editor, in the left pane, delete the following key
    · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\{PRODUCT.EN_US}
  19. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders 
  20. Click the Folders key to select it. 
  21. Remove any values with "Symantec Endpoint Protection Manager" in the path. 
  22. Still in the Folders key, in the right pane find and delete the entry C:\WINDOWS\Installer\{941CEF66-4D77-44CD-86F9-89FC6AC4B299} C:\Windows\Installer\{988F6D7E-8A8B-53AC-A79D-35E1232E2FCA} C:\Windows\Installer\{AECAD9FB-3960-435B-B776-069F8F57FB01}
  23. Navigate to the following key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SharedDLLs 
  24. Click the SharedDLLs to select it. 
  25. Remove any values with "C:\Program Files\Symantec\Symantec Endpoint Protection Manager" in the path. 
  26. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps\ 
  27. Delete the following under this key: 
    · Reporting 
    · SesmContent 
    · SymcData-sesmvirdef32 
    · SymcData-sesmvirdef64 
    · SymcData-sesmips32 
    · SymcData-sesmips64
  28. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services 
  29. Delete the following under this key: 
    · Adaptive_Server_Anywhere_9 
    · ASANYs_sem5 
    · semsrv
  30. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application 
  31. Delete the following under this key: 
    · ASANYs_sem5 
    · Secars 
    · SemSrv
  32. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services 
  33. Delete the following under this key: 
    · Adaptive_Server_Anywhere_9 
    · ASANYs_sem5 
    · semsrv
  34. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application 
  35. Delete the following under this key: 
    · ASANYs_sem5 
    · Secars 
    · SemSrv
  36. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
  37. Delete the following under this key: 
    · Adaptive_Server_Anywhere_9 
    · ASANYs_sem5 
    · semsrv
  38. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application 
  39. Delete the following under this key: 
    · ASANYs_sem5 
    · Secars 
    · SemSrv

To remove Symantec Endpoint Protection files and folders:

Delete the following files and folders. If a file or folder is not present, move on to the next one. 
· C:\Windows\Installer\{941CEF66-4D77-44CD-86F9-89FC6AC4B299} (Note: "Installer" is a hidden system folder.)
· C:\Windows\Installer\{988F6D7E-8A8B-53AC-A79D-35E1232E2FCA} (Note: "Installer" is a hidden system folder.) 
· C:\Windows\Installer\{AECAD9FB-3960-435B-B776-069F8F57FB01} (Note: "Installer" is a hidden system folder.)
· C:\Program Files\Symantec\Symantec Endpoint Protection Manager\
· C:\Program Files\Symantec\Symantec Endpoint Protection\
· C:\ProgramData\Symantec\Symantec Endpoint Protection Manager\ 
· C:\ProgramData\Symantec\Symantec Endpoint Protection\ 
· C:\Documents and Settings\All Users\Start Menu\Programs\Symantec Endpoint Protection Manager
· C:\Documents and Settings\All Users\Start Menu\Programs\Symantec Endpoint Protection

If Symantec Endpoint Protection was installed on a 64-bit computer, delete the following folder: 
· C:\Program Files(x86)\Symantec\Symantec Endpoint Protection Manager

Browse to C:\Program Files\Common Files\Symantec Shared\SymcData 
· Delete any folder that starts with SESM (IE sesmvirdef32)

To start the World Wide Web Publishing Service 

  1. Click Start Run.
  2. Type services.msc and click OK
  3. Right click World Wide Web Publishing Service, and select Start World Wide Web Publishing Service.

Restart the machine.