Endpoint Protection

Hi Symantec Followers, Contributors, Experts & SME's.

 I am administrating 10000+ clients with 4 SEPM Servers & 2 SQL Database. The SEP Clients are installed in 10 different 2 MBPS remote locations.  I am using this product since last 1.5 Years & product has fixed a lot of issue but one thing i am not able to understand is why Uninstallation of  Client option is not in Console. As other Products like TrendMicro, Mcafee has.

As SEP license will expire soon we are going to switch to other product. I am find it very difficult to Uninstall the Clients. How i will go further. I am not able to Sleep at night.

Let me know different ways to Uninstall the Client.


Regards...
Ramji Iyyer
SEP Administrator

First of all if SEP has fixed so many issues they why you are moving to other product . SEP is best in the Corporate AV Now.
May I know which antivirus you want to move to because I want to know which is more better than SEP and can you say why.

He probably means "'we've been using SEP for 1.5 years and >I'VE HAD TO FIX MANY ISSUES<"

Who says it's the best? Symantec? of course they do! Peter Norton? Just because Symantec is the first company you've heard of as an anti-virus provider doesn't mean they're the best. Look at Norton 360, what an awesome product that is eh? sweet mother of god

He probably wants to ditch it because his harddrive on his server is full of AV defs and he can't get rid of them.

We are evaluating Officescan Suite. If if know the ways let me know ?


 

  Have you evaluated that product

In SEP we have an option to remove other antivirus and install SEP.
So I am not sure about how they work..

You can try it on their forum ( if it has one ) and check what solution they can provide..

Officescan may be able to uninstall SEP for you. This exerpt is from the OfficeScan admin guide found here... http://www.trendmicro.com/ftp/documentation/guides/OSCE8+SP1_IDG.pdf ..Page 78.

Automatic Client Migration

Automatic client migration refers to replacing existing client antivirus software with the
OfficeScan client. The client Setup program automatically uninstalls the existing
software and replaces it with the OfficeScan client.

Note: OfficeScan only uninstalls clients, not servers.

To check the applications that OfficeScan automatically uninstalls, open the following
files in \Trend Micro\OfficeScan\PCCSRV\Admin: tmuninst.ptn, tmuninst_as.ptn.

why we are talking about office scan here?
I have seen what problems are there in Officescan .
light weight on system and on virus also.

I really don't understand why are you planning to shift to a diffrent antivirus.
Symantec Support has been helping you 24/7.Just for your company immideate patches were made to fix your issue and even product was working great in your environment.

I would suggest you to stay with SEP.I know you have seen many issues but I beleive all of them have been fixed as well.
In coming days..due to popularity of the forum ..where Developers and Users interacting with each other.
SEP is going to become the best Antivirus with no competitors around.If you look at the Idea section you will understand.MR5 is due in few months..which will include too many features that will be user friendly for all the users.
Every Product has problems when it is launched to the market but it stabilizes after few years and SEP has become almost stable as SAV now.

So I would suggest before moving away from SEP...just make sure whatever you are getting from Symantec / SEP are you getting better than that in the other product.
Do not just go by the Sales Reps.

 Hello,

There is a possibility to uninstall the SEP clients from the SEPM, but it's quite difficult, you will have to modify an installation package, which will be able to uninstall the clients. (not recommended. 10 000 clients = 10 000 x Install_package_size in the network)

The second way more easier is a login script or remote execution of a script which allows to uninstall software using the MSI commands. I will provide the script at the end of the message. Generally if you really want to change the product it's better to contact our competitor.

In my opinion it's not worth to change the SEP to some other product. If you really have it in the recent version and well configured, and you are using all components you don't need any other product. New product = New problems, believe me.

Script:


' Script START
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."


Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

Dim path
Dim command

Dim clear
clear="SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

For Each subkey In arrSubKeys

strKeyPath=strKeyPath + "\" + subkey +"\"

strValueName = "DisplayName"

oReg.GetExpandedStringValue HKEY_LOCAL_MACHINE,strKeyPath,_
strValueName,strValue

if strvalue="Symantec Endpoint Protection" then

strValueName = "UninstallString"

oReg.GetExpandedStringValue HKEY_LOCAL_MACHINE,strKeyPath,_
strValueName,strValue

command=strValue

End if

strKeyPath=clear

Next

command=Replace(command,"MsiExec.exe /I","MsiExec.exe /X")
command=command + " " + "/passive"


Dim WshShell
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.Run command

' Script END

Regards,

Witold

I do not bring any debate to this forum as this is not the forum designed for.
If anyone wish to leave Symantec and go for another vendor, I will say I will them go, Symantec always have new customers join from other vendors anyways. but one thing I want to point out is Symantec must provide good product with high quality and better support, as well as Symantec should know other vendor is doing in the market.

Please do not misunderstand me, I am not selling Trenmacro product here, but just want to remind Symantec should keep a close eye on Trendmicro now is moving. Not sure everone have seen Trendmicro Endpoint Security recently? Trendmicro is now hand in hand with BigFix, their Endpoint Security can deploy 60,000 clients globally in 4 hours and push defintion to those clients in less than 40 minutes in close 100% success, as well as you can full report with each change in less than 1 hour about 60,000 clients, and this is only need to be done from one server.

I am NOT coming here to degrade Symantec, honestly speaking, I like the product a lot and could get fustrated with some bugs sometimes, but I am very pretty happy to continue to use the product. Symantec needs to pick a better product than Sygate to success Endpoint Protection product. I think Symantec Endpoint will use Altiras in its new version, Personally I think this is a good move, I am waiting to see

Vikram,

I think u never faced the issue what we faced.

New Clients which are installed are pointing to wrong groups & they are also in User mode. We have not done AD integration with SEPM.

The Client packages are created in Computer mode. & installed thru Clientremote tool & Manual installation.

Is a pain task to Swich Client to Computer mode & move to appropriate groups using Script.

This has become daily task.

Our Version is MR4.MP2

 

There is solution for everything in SEP..if its a bug then Backline can come up with a workaround or a patch in a given point of time....
But seeing the complexity of your network it might be difficult to resolve on forums...but I think the ADV and RL2's will definitely solve your problem..
I remember your network is a very complex one and SEP is a environmental product..any product will beahve in a diffrent manner in a diffrent environment.
So its not just the product but sometimes it our configuration also that conflicts with the product making it work in a diffrent manner..

If there's no competitive uninstall, add a Startup Script that issues the MSIEXEC command to uninstall the product. Restart the machines and SEP is gone.

If you install the new AV by Group Policy Software Installation, however, Startup Scripts run after Software Installation. So 2 restarts and correct sequencing will be required. You'll probably want to use a WMI Filter to scope the new AV installer GPO against machines on which SEP is not installed. On the 1st reboot, SEP will go away, which will cause another reboot. On the 2nd reboot, SEP will not be installed, so the new AV will install. When SEP is gone from your system, you can delete the WMI Filter.

Uninstall can also be handled remotely via WMI scripting through VBS, PowerShell, etc. if that's a better answer for you:

http://www.microsoft.com/technet/scriptcenter/scripts/apps/user/usapvb01.mspx

Modify to accept input from a text file containing a list of computers from which you want to uninstall and let 'er rip.

HTH

@Ramji

I agree with some things you say, but I believe your company migrated to SEP from Trend Micro simply coz they were not able to catch the viruses and threats on the network.

I remember talking with you regarding this aspect a few months back, and you were pretty pleased to see the results. What may have happened later on is something I'm not aware about, but I do believe that apt use of the Platinum Support Contract that you have wold have helped you to resolve a lot of issues. Your company is among the biggest Industrial houses in India for crying out loud.

Do you remember what happened when the DownAdUp outbreak happened at your end? SEP was catching the threat, but the systems were not patched.....

Need I say more? If you have already decided to go ahead with another product, do so by all means, but also take into account what kind of migration hassles you're going to face once you decide to switch. My advice, impartial as always would be to give SEP some more time and help Symantec help you to resolve the issues.

HTH

May I ask if you are using an active directory? if so, I agreed to those comented to this thread, you must create a batch file to uninstall SEP 11.

I remember that Downadup Outbreak and also i want to share with youone of the top rated Antivirus Company  was also got infected & support was not available for few hours.  No one has taken the windows patching seriously.

I am awaiting for this feature in Endpoint protection ASAP. I love this product very much but it should administrator friendly.

THis Windows Patching feature is present in SNAC. 

Yeah. One of the top rated AV companies was indeed affected, but it wasn't Symantec. I know coz I was working in symantec that time. We were inundated with DownAdup outbreak cases and our SLA was actually shooting thru the roof.

And SEP is indeed administrator friendly, but yes, I agree more needs to be done, and you as an Administrator / User can help by giving Symantec more inouts on what changes / features are required in SEP. Simply moving away froma product that has stabilized is not going to help.

And I agree with Vikram, the mandatory Windows Patching feature is there in SNAC. I believe you also have a license for the Software version of SNAC.

How many people use this ID Symantec Follower
At some places I see Ramji Iyer and at some places I see

Regards,
M.R.

Are both of these poeple the same or is it a common ID used by your company to ask questions..

How about to run cleanswipe on all of the workstations and run it silently?

@Symantec_Follower: Well yeah......It's possible to uninstall the 10,000 or maybe more clients at a go if you got them ........I have developed a tool for that...........PM me if you want a copy.....................

@Paul

When you use cleanwipe you might having a trouble because running this tool have an effect to your lan it will disable it, so it is not advisable to use the tool in uninstalling a bulk of clients.

@Symantec_follower
I suggest you should develop a logon script just to uninstall a bulk of SEP client

You are Right !!! Cleanwipe removes the LAN drivers also. No NAV tool also helps in removing SEP.

We are developping a uninstall script
 .

Guys ... any idea on how to automatically include password in msiexec to uninstall SEP?

Thanks.

 Are we "salesmen" or "IT" people here?

I am also looking to remove a mass quantity of Sym Endpoint clients here but cannot find help with it. Only Symantec moderators that are trying to protect the brand and close a sale to someone who wants to migrate to another product!

Sometimes our clients simply can not afford to pay the price for Symantec/Norton products. It is just bad business to force customers into a corner. When they want out, you should graciously let them go. By doing so, they might possibly come back if they find out for themselves that your product truly is superior. Are your customers coming back?

All I wanted was a little help removing Symantec Endpoint Protection from a clients network. In the search I expected to find the answer in the knowledge base or forum of a respected industry player. Not squabbling and high pressure sales tactics.

Is there a resource that will help us remove Endpoint Protection from the customers network or not?

This is why we many of us at the University don't deploy any program using its own deployment methods, but use group policy software deployment or SCCM.  This way, you always have an easy uninstall path should something go horribly wrong.

Also, many companies and virtualy all government enterprises must put software out for bid.  Every time the support contract ends, it could end up going to a different company should the other software meet the required specifications and come out cheaper.

In your situation, I'd look for the MSI product code used by your SEP install and then script "msiexec /x {product code} /qn" via whatever method you prefer.

I agree, lets not act like "Symantec Fanboys", I mean it's not like the guy wants to un-install all his Windows machines and go to Mac :)

Seriously, this is a legitimate question and Symantec needs to have a solution for this. If a day comes that I want to remove all traces of Symantec, there better be a way to do it without an act of God!

I would prefer a built-in solution to uninstalling clients as well. I don't feel we should have to write a script when everything else is already managed through the management server.

There are times in which I would like to uninstall one or two clients for troubleshooting purposes and Symantec does not offer a solution to do this remotely and silently. I would like to see this feature added.

SNEKUL is right that the MSIEXEC /X {product code} will work.

Problem with pushing/uninstalling from an existing MSI package, is the MSI package needs to be present and the reboots that it requires. 
Rebooting 10,000+ machines over X number of locations simultaneously will likely choke the heck out of the bandwidth unless explicitly defined on different servers in said remote locations. 
If the "logon server" is on the other side of a 2MB pipe and you have 100+ clients accessing the same 75 - 80 MB file (msi package) to uninstall, insta-death to the LAN.  If other servers or ressources require some bandwidth to function, more loss to possible necessary infrastructure. 
After the rebooting is done, possibly other clients will be trying to access the same said logon servers and they will be unabel to communicate with it due to the bandwidth being choked up. 

If for some reason, not all clients are the same version, then you also face the problem of multiple {product code} for uninstallation.  More good times in trying to locate them all.  

Basically a rock and a hard place.

Also, as an administrator and avid user of these forums and others, I DO NOT believe moderators should allow "bullying" on these boards by end users telling other users  how great product A is and what a mistake it is to go to another product.  We are supposed to be a community of IT trying to help one another and address issues.  
He was asked what product he was considering using and than the 'flaming' started.  As others have stated, there are sometimes internal reassons why a company chooses to go from one vendor to another- be it Hardware or Software.