Issue/Introduction

This article describes how to uninstall Symantec Endpoint Protection (SEP) using Microsoft Installer (MSI) commands at the command line interface. This is useful if SEP is not listed in Add or Remove Programs.

This is also useful if a command-line is needed to uninstall the SEP Client using a third party tool such as SCCM, Altiris, Clarity, etc.

Resolution

PowerShell

  1. Open a PowerShell Window as Administrator
  2. Run the following command: (Get-WmiObject -Class Win32_Product -Filter "Name='Symantec Endpoint Protection'" -ComputerName . ).Uninstall()
  3. A successful uninstall will return a message that ends with "ReturnValue: 0"

Note: If you have password protected client uninstallation, you should disable it first and then run the script. You can disable password protection from SEPM:

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/managing-groups-clients-and-administrators/managing-client-computers-v55115300-d19e131/password-protecting-the-client-v9722139-d19e3958.html

DOS Command Prompt

  1. Log on to the computer with administrator rights.
  2. Find the Symantec Endpoint Protection uninstallation product key:
    1. Click Start > Run.
    2. Type regedit to open the Windows Registry Editor.
    3. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
    4. Browse the Uninstall subkeys in the left-hand pane, and check the values in the right-hand pane to find a value for the DisplayName that equals Symantec Endpoint Protection.
    5. Copy the uninstallation key. For example, the key for Symantec Endpoint Protection 12.1.671.4971 is A3AEEA68-AC93-4F6F-8D2D-78BBF7E422B8.
    6. Close the Windows Registry Editor.
  3. Click Start > Run.
  4. Type cmd to open the Windows command prompt.
  5. At the Windows command prompt, type:

    msiexec /X {product uninstall key}

    Example: msiexec.exe /x {A3AEEA68-AC93-4F6F-8D2D-78BBF7E422B8} /passive

    To generate a detailed uninstall log, type:

    msiexec /X {product uninstall key} /l*v! log file path
  • Example: msiexec /x {A3AEEA68-AC93-4F6F-8D2D-78BBF7E422B8} /lv!* c:\uninstallSEP.txt

THE ABOVE COMMAND line examples are the ones to use for a third-party tool for uninstall, for example what command-line to pass via SCCM


Note: If the MSI uninstall has stopped responding, follow these steps:

  1. Click Start > Run.
  2. Type taskmgr.
  3. Click the Processes tab.
  4. Click End Process for all of the running Windows Installer processes by right-clicking on msiexec.exe, and then clicking End Process.
  5. Repeat this for each instance of msiexec.exe listed.

Sample log file:

The uninstaller is trying to find some keys which are present in a 64-bit operating system, but they do not exist on a 32-bit operating system:

-------------------------------
Action ended 13:37:50: InstallFinalize. Return value 1.
MSI (s) (0C:20) [13:37:50:312]: Doing action: SxsUninstallCA
Action start 13:37:50: SxsUninstallCA.
MSI (s) (0C:34) [13:37:50:375]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI14D.tmp, Entrypoint: CustomAction_SxsMsmCleanup
1: sxsdelca tried opening key w/o wow64key 2: Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents 3: 672 4: 0
1: sxsdelca tried opening wow64key 2: Software\Microsoft\Windows\CurrentVersion\SideBySide\PatchedComponents 3: 680 4: 0
1: sxsdelca 2: traceop 3: 1158 4: 0
1: sxsdelca 2: traceop 3: 1186 4: 0
-------------------------------

CleanWipe

For difficulty with uninstalling Endpoint Protection, see also: Uninstalling Symantec Endpoint Protection with the CleanWipe utility.