Friday, July 30, 2010

Remotely remove symantec AV

Need to remove that horrible Symantec antivirus program from several pc's and want to do it remotely and silently. There is some leg work involved. You will need to find the uninstall string from the registry. Look for it here: HKLM>Software>Microsoft>Windows>Current Version>Uninstall. You will need to go through each string until you find the symantec string and look for the uninstall value. Next get PsExec on the server. Lastly run the command like this:
psexec file://pcname/ msiexec.exe /norestart /q /x {product uninstall string} remove=all

Run that and after a few minutes it will remove symantec for you. You may need to reset the unistall password if the software was deployed with it. To do that find the registry key under HKLM>Software>Symantec>Symantec End Point Protection>AV>AdministratorOnly>Security and look for UseVPUninstallPassword and set it to zero (0).