Wednesday, February 9, 2011

Remote uninstall of SEP 11

 

http://www.symantec.com/business/support/index?page=content&id=TECH105827&locale=en_USWhile Logged into an account that has domain admin rights, you can run this command after downloading psexec.exe from Microsoft.

psexec @c:\computers.txt MsiExec.exe /norestart /q/x{2EFCC193-D915-4CCB-9201-31773A27BC06} REMOVE=ALL

Where @c:\computers.txt is a txt file that I pulled from the AD computers OU and chopped it up in excel so that it lists all the computers, one line at a time.

Example:

XPPC001
XPPC002
XPPC003

{2EFCC193-D915-4CCB-9201-31773A27BC06} is the uninstall string from the local systems registry. This can be found by going to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

http://www.symantec.com/business/support/index?page=content&id=TECH105827&locale=en_US

If there is a password set on the clients you can:

A) disable it from the SEP Manager

B) Edit the registry to zero out the password Value.

I will post how to do this soon.