Remotely Uninstall Symantec Antivirus

Chris — Wed, 27 Aug 2008 03:09:56 +0000

I’m not going into the reasons here, but I recently needed to uninstall Symantec Antivirus from all client computers on our network (~25 computers) in order to install a new antivirus client. Since it was so few computers, I really could have just sat down at each one and uninstalled the program through Control Panel. But what fun is that when you can do it remotely?

After reading an article on the subject, I did some more investigating and this is the process I came up with:

Download PSTools and unzip into C:\Windows\System32
Get the Symantec Antivirus uninstall registry ID from regedit by way of HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall. Go through the subkeys and search for the one that has Symantec in the Value Name. For example, I had Symantec Corporate Antivirus v10.x and the ID was {78D891EF-9E2D-4FC8-A71F-E6F897BA1B21}
Remotely connect to Symantec System Center server using domain administrator account
(Optional: if you require a password to uninstall) Using regedit, remotely connect to each computer to edit registry. What we’re looking for is under HKEY_LOCAL_MACHINE \ SOFTWARE \ INTEL \ LANDesk \ VirusProtect6 \ CurrentVersion \ AdministratorOnly \ Security. Make sure the two values, “LockUnloadServices” and “UseVPUninstallPassword,” are zero.
Logged in as a domain admininistrator, using PsExec, run MsiExec to uninstall. Example,
C:\>psexec \\COMPUTER_NAME MsiExec.exe /norestart /q /x {78D891EF-9E2D-4FC8-A71F-E6F897BA1B21} REMOVE=ALL

Assuming all went well, you should get an error code of zero, which means everything went successfully. Should you get any other error code, look it up.

Chris J Mears » sysadmin

Remotely Uninstall Symantec Antivirus