Removing a Corrupt SEP Client via PowerShell Script

Products

Endpoint Protection

Issue/Introduction

When attempting to remove Symantec Endpoint Protection (SEP) using a PowerShell script, you may encounter an error indicating that the system cannot locate the product. This typically occurs because the client installation has become corrupted, causing the registry keys to disappear and rendering the product "invisible" to management scripts.

Attempting to execute an automated removal command on a corrupted client results in a failure because the script cannot resolve the target object:

PowerShell Scirpt: 
(Get-WmiObject -Class Win32_Product -Filter "Name='Symantec Endpoint Protection'" -ComputerName ComputerNameHere).Uninstall()

Error Output:

You cannot call a method on a null-valued expression.
+ CategoryInfo          : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

Environment

14.3 RU6 +

Cause

This issue can correlate with an application upgrade or a Windows OS update, which occurs simultaneously. These events can corrupt the client installation, causing the necessary registry keys to drop. When these keys are missing, the WMI cannot identify the product displayname, causing the script to return a null value.

To check for SEP client corruption, execute the following commands. If the expected product information is missing from the output, the installation is considered corrupted.

C:\Users\Admin> Get-WmiObject -Class Win32_Product -Filter "Name='Symantec Endpoint Protection'" -ComputerName WIN-Server

IdentifyingNumber : {XXXXXXXXXXXXXXXXXXXXXXXXXXXX}
Name : Symantec Endpoint Protection
Vendor : Broadcom
Version : 14.3.12189.10000
Caption : Symantec Endpoint Protection

PS C:\Users\Admin> Get-WmiObject -Class Win32_Product -ComputerName WIN-Server | Where-Object {$_.Name -match "Symantec"}

IdentifyingNumber : {XXXXXXXXXXXXXXXXXXXXXXXXXXXX}
Name : Symantec Diagnostic Tool Viewer v2.1
Vendor : Symantec Corporation
Version : 2.1.11291
Caption : Symantec Diagnostic Tool Viewer v2.1

IdentifyingNumber : {XXXXXXXXXXXXXXXXXXXXXXXXXXXX}
Name : Symantec Endpoint Protection
Vendor : Broadcom
Version : 14.3.12189.10000
Caption : Symantec Endpoint Protection

If the product is correctly identified in these outputs, the registry keys are intact, and you may proceed with standard uninstallation procedures or Repair the SEP client. More information on how to repair a SEP client can be found here.

Resolution

If the client is missing from the output above, you must repair the installation to restore the registry infrastructure.

Repair/Over-install: Run the same version SEP installation package directly over the existing corrupt installation. Ensure the 'no restart' option is selected to prevent an immediate system reboot, if neccesary. This process repairs the corrupted files and restores the registry keys.
After the Install, re-run the verification commands above to confirming the results a visible.
With the registry keys restored, execute your original PowerShell uninstallation script to remove the client successfully.
Fallback (optional): If the over-install fails to resolve the corruption, utilize the 'Remove existing Symantec Endpoint Protection client software that cannot be uninstalled' feature to force a removal, then perform a clean installation followed by the powershell script.