locked
Remove SCCM Endpoint Protection on client side RRS feed

  • Question

  • I was asked to remove SCCM Endpoint Protection from one of my Windows servers. As Endpoint Protection is part of SCCM client now, is it possible to do that? If it is possible, how can I do it? Please advise and thanks in advance.
    Wednesday, June 24, 2020 9:35 PM

Answers

  • I was asked to remove SCCM Endpoint Protection from one of my Windows servers. As Endpoint Protection is part of SCCM client now

    This is not strictly accurate. First, don't confuse endpoint protection with the endpoint protection management agent. Endpoint Protection was replaced in Win 10 and Windows Server 2016/2019 with the built-in Windows Defender.

    As of ConfigMgr 1610 (I believe, it's been a while at least) the endpoint protection management agent is no longer required to manage Windows Defender as this is the part that is indeed built directly into the ConfigMgr agent now. There's no explicit harm in having it installed though. If you want to remove it, you can do so from ARP just like you remove all other programs; it is simple called "System Center Endpoint Protection". To prevent it from being reinstalled automatically on your Win 10 and Server 2016/2019 systems, make sure you adjust your client settings.


    Jason | https://home.configmgrftw.com | @jasonsandys

    • Marked as answer by swl2011 Thursday, June 25, 2020 6:40 PM
    Thursday, June 25, 2020 12:57 AM
  • Hi,

    Thanks for your reply.

    It's the "Install Endpoint Protection client on client computers" option on the Endpoint Protection tab of client settings.

    If the Endpoint Protection client is already installed, choosing No doesn't uninstall the Endpoint Protection client. To uninstall the Endpoint Protection client, set the Manage Endpoint Protection client on client computers client setting to No. Then, deploy a package and program to uninstall the Endpoint Protection client.

    For more information, please refer to the official article: Client Settings - Endpoint Protection 

    Hope my answer could help you. Thanks for your time.

    Best regards,
    Simon

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Proposed as answer by sju2402 Thursday, June 25, 2020 6:37 PM
    • Marked as answer by swl2011 Thursday, June 25, 2020 6:40 PM
    Thursday, June 25, 2020 9:56 AM
  • You mentioned "adjust your client settings". Are you talking about client policy on SCCM server?

    Yes. These are client settings.

    I'm not quite sure where I should adjust client settings. The server I need to remove are Win2012 and Win2012 R2. Thank you for helping.

    As noted then, removing SCEP here would leave those servers completely *unprotected* as Server 2012 and 2012 R2 do not include any built-in anti-malware or anti-virus protection. 


    Jason | https://home.configmgrftw.com | @jasonsandys

    • Proposed as answer by sju2402 Thursday, June 25, 2020 6:37 PM
    • Marked as answer by swl2011 Thursday, June 25, 2020 6:40 PM
    Thursday, June 25, 2020 2:17 PM

All replies

  • I was asked to remove SCCM Endpoint Protection from one of my Windows servers. As Endpoint Protection is part of SCCM client now

    This is not strictly accurate. First, don't confuse endpoint protection with the endpoint protection management agent. Endpoint Protection was replaced in Win 10 and Windows Server 2016/2019 with the built-in Windows Defender.

    As of ConfigMgr 1610 (I believe, it's been a while at least) the endpoint protection management agent is no longer required to manage Windows Defender as this is the part that is indeed built directly into the ConfigMgr agent now. There's no explicit harm in having it installed though. If you want to remove it, you can do so from ARP just like you remove all other programs; it is simple called "System Center Endpoint Protection". To prevent it from being reinstalled automatically on your Win 10 and Server 2016/2019 systems, make sure you adjust your client settings.


    Jason | https://home.configmgrftw.com | @jasonsandys

    • Marked as answer by swl2011 Thursday, June 25, 2020 6:40 PM
    Thursday, June 25, 2020 12:57 AM
  • Hi Jason,

    You mentioned "adjust your client settings". Are you talking about client policy on SCCM server?

    I'm not quite sure where I should adjust client settings. The server I need to remove are Win2012 and Win2012 R2. Thank you for helping.

    Thursday, June 25, 2020 4:44 AM
  • Hi,

    Thanks for your reply.

    It's the "Install Endpoint Protection client on client computers" option on the Endpoint Protection tab of client settings.

    If the Endpoint Protection client is already installed, choosing No doesn't uninstall the Endpoint Protection client. To uninstall the Endpoint Protection client, set the Manage Endpoint Protection client on client computers client setting to No. Then, deploy a package and program to uninstall the Endpoint Protection client.

    For more information, please refer to the official article: Client Settings - Endpoint Protection 

    Hope my answer could help you. Thanks for your time.

    Best regards,
    Simon

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Proposed as answer by sju2402 Thursday, June 25, 2020 6:37 PM
    • Marked as answer by swl2011 Thursday, June 25, 2020 6:40 PM
    Thursday, June 25, 2020 9:56 AM
  • You mentioned "adjust your client settings". Are you talking about client policy on SCCM server?

    Yes. These are client settings.

    I'm not quite sure where I should adjust client settings. The server I need to remove are Win2012 and Win2012 R2. Thank you for helping.

    As noted then, removing SCEP here would leave those servers completely *unprotected* as Server 2012 and 2012 R2 do not include any built-in anti-malware or anti-virus protection. 


    Jason | https://home.configmgrftw.com | @jasonsandys

    • Proposed as answer by sju2402 Thursday, June 25, 2020 6:37 PM
    • Marked as answer by swl2011 Thursday, June 25, 2020 6:40 PM
    Thursday, June 25, 2020 2:17 PM