locked
Uninstall script RRS feed

  • Question

  • Hi,

    We deployed Forefront to approximately 100 computers using a Forefront management computer.    Install was automated through windows updates.  We now need to uninstall Forefront from all of these machines.  What is the best way to handle this?

    Thanks,
    Russ
    Thursday, April 9, 2009 10:22 PM

Answers

  • Hi Russ,

     

    Thank you for your post.

     

    According to your description, I understand that you want to use script to uninstall the Forefront from the client machines.

     

    Based on my research, you may try to get the hash for the Forefront Client Security agent and use it with MsiExec.exe command to uninstall the agent.

     

    Script to uninstall FCS agent:

    ==============================

    if not exist C:\UninstallFCS md C:\UninstallFCS

     

    rem uninstall Microsoft Forefront Client Security Antimalware Service
    MsiExec.exe /X {D3E31640-DC20-4722-A1CF-604FF6C540B0} /norestart /qn /l*v

    C:\UninstallFCS\UninstallFCSAM.LOG

     

    rem uninstall Microsoft Forefront Client Security State Assessment Service

    MsiExec.exe /X {E8B56B38-A826-11DB-8C83-0011430C73A4} /norestart /qn /l*v

    C:\UninstallFCS\UninstallFCSSSA.LOG

     

    rem uninstall Microsoft Operations Manager 2005 Agent

    MsiExec.exe /X {F692770D-0E27-4D3F-8386-F04C6F434040} /norestart /qn /l*v

    C:\UninstallFCS\UninstallMOM.LOG

     

    Regard,


    Nick Gu - MSFT
    Friday, April 10, 2009 3:58 AM
  • MsiExec.exe /I{67E4DA28-0D51-433E-97E6-3FE0E5FB1194}  might be the one you want for AM actually.. You probably need to check the actual reg key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and look for FCSAM and what that actual Product ID is on your system.


    CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde
    Tuesday, April 21, 2009 7:03 PM

All replies

  • Hi Russ,

     

    Thank you for your post.

     

    According to your description, I understand that you want to use script to uninstall the Forefront from the client machines.

     

    Based on my research, you may try to get the hash for the Forefront Client Security agent and use it with MsiExec.exe command to uninstall the agent.

     

    Script to uninstall FCS agent:

    ==============================

    if not exist C:\UninstallFCS md C:\UninstallFCS

     

    rem uninstall Microsoft Forefront Client Security Antimalware Service
    MsiExec.exe /X {D3E31640-DC20-4722-A1CF-604FF6C540B0} /norestart /qn /l*v

    C:\UninstallFCS\UninstallFCSAM.LOG

     

    rem uninstall Microsoft Forefront Client Security State Assessment Service

    MsiExec.exe /X {E8B56B38-A826-11DB-8C83-0011430C73A4} /norestart /qn /l*v

    C:\UninstallFCS\UninstallFCSSSA.LOG

     

    rem uninstall Microsoft Operations Manager 2005 Agent

    MsiExec.exe /X {F692770D-0E27-4D3F-8386-F04C6F434040} /norestart /qn /l*v

    C:\UninstallFCS\UninstallMOM.LOG

     

    Regard,


    Nick Gu - MSFT
    Friday, April 10, 2009 3:58 AM
  • Make sure that there are no GPO linked to Clients while uninstall the client,
    otherwise client will be distributed again from WSUS

    Sunday, April 12, 2009 1:37 PM
  • MsiExec.exe /I{67E4DA28-0D51-433E-97E6-3FE0E5FB1194}  might be the one you want for AM actually.. You probably need to check the actual reg key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and look for FCSAM and what that actual Product ID is on your system.


    CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde
    Tuesday, April 21, 2009 7:03 PM
  • Are you just looking for an uninstall script?  Then try this:

    http://portal.sivarajan.com/2010/02/forefront-client-security-fcs.html

    http://www.sivarajan.com/scripts.html

     


    Santhosh Sivarajan | MCTS, MCSE (W2K3/W2K/NT4), MCSA (W2K3/W2K/MSG), CCNA, Network+ Houston, TX http://blogs.sivarajan.com/ http://publications.sivarajan.com/ This posting is provided "AS IS" with no warranties, and confers no rights.
    Monday, May 17, 2010 7:33 PM
  • I have tried this and a bunch of other things.  I cannot get forefront antimalware to uninstall.  I am very novice with scripts and may be doing something wrong. 

    Monday, October 25, 2010 12:53 PM
  • Have you tried any of these scripts?

    http://portal.sivarajan.com/2010/02/forefront-client-security-fcs.html

    http://www.sivarajan.com/scripts.html

    Are you getting any error messages?


    Santhosh Sivarajan | MCTS, MCSE (W2K3/W2K/NT4), MCSA (W2K3/W2K/MSG), CCNA, Network+ Houston, TX

    Blogs - http://blogs.sivarajan.com/
    Articles - http://www.sivarajan.com/publications.html
    Twitter: @santhosh_sivara - http://twitter.com/santhosh_sivara

    This posting is provided AS IS with no warranties, and confers no rights.
    Monday, October 25, 2010 5:02 PM
  • Can you add to your script to remove the MOM 2005 Agent?
    Monday, April 4, 2011 8:23 PM
  • Just insert these lines right after "Assesment service" part after end if 

     

    if (sName = "Microsoft Operations Manager 2005 Agent") then
                           SSSProductKey = sKey
                           SSSProductName = sName
            end if

    It worked for me.

    Wednesday, May 18, 2011 12:07 PM
  • Yes.  You can uninstall any software using my script. Update the script with correct service name.  You can get this info for the registry
    Santhosh Sivarajan | MCTS, MCSE (W2K3/W2K/NT4), MCSA (W2K3/W2K/MSG), CCNA, Network+ Houston, TX

    Blogs - http://blogs.sivarajan.com/
    Articles - http://www.sivarajan.com/publications.html
    Twitter: @santhosh_sivara - http://twitter.com/santhosh_sivara
    This posting is provided AS IS with no warranties,and confers no rights.
    Wednesday, May 18, 2011 2:38 PM