Today I had to remove an exisint McAfee installatie from a lot computers. These computers were partly managed by McAfee ePolicy Orchestrator.
First try to remove the computers from using ePolicy Orchestrator. When you delete a computer object from the tree an option to uninstall agent will be presented. Make sure to check the checkbox before you continue.
Give it a little bit of time (let’s say 15 minutes) and the agent will be removed from the computer. I have noticed that this is not always the case. So I wrote a little script to force the uninstallation.
Here’s the script. If it does not work, try to run it for a second time.
Echo off
REM copy nvadm.exe from a working machine to a file share
copy \\servernam\sharename\McAfee\mvadm.exe c:\windows\temp /Y
REM The following is dependend of installed version, so some errors will occour. No worries, it wil work. It's done so the mgtsvc service can be stopped and removed
c:\windows\temp\mvadm disable
c:\windows\temp\mvadm config set OASStatus=0
c:\windows\temp\mvadm config set ODSStatus=0
c:\windows\temp\mvadm config set IntegrityEnabled=0
ECHO Stopping services
sc stop mvagtsvc
sc stop mvagtdrv
sc delete mvagtsvc
sc delete mvagtdrv
Echo Stopping McAfee MOVE Service
start /wait "Taskill" taskkill /IM mvagtsvc.exe /f
Echo Uninstalling McAfee MOVE
start /wait "mcafee" MsiExec.exe /X{6256F19B-18EB-4942-8A7C-5A0A9DABFA35} /q
start /wait "ReMOVE" MsiExec.exe /X{291E5CBE-DC09-48AC-B3F6-1997B3113966} /q
if exist "C:\Program Files\Mcafee\Agent\x86\frminst.exe" start /wait "mcafee" "C:\Program Files\Mcafee\Agent\x86\frminst.exe" /forceuninstall /silent
wmic product where name="McAfee Agent" call uninstall /nointeractive
Echo Removing registry keys
reg delete "HKLM\SOFTWARE\Wow6432Node\McAfee\McTray\Plugins\MovePlugin" /f
reg delete "HKLM\SOFTWARE\McAfee" /f
reg delete "HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\DC__AM__4000" /f
reg delete "HKLM\SOFTWARE\Wow6432Node\Network Associates\ePolicy Orchestrator\Application Plugins\DC__AM__4000?" /f
reg delete "HKLM\SOFTWARE\Wow6432Node\Network Associates\ePolicy Orchestrator\Application Plugins\MOVEVOFF2600" /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{291E5CBE-DC09-48AC-B3F6-1997B3113966}" /f
reg delete "HKLM\SOFTWARE\WOW6432Node\McAfee" /f
Echo Removing Directories
rd "C:\Program Files (x86)\McAfee" /s /q
rd "C:\Program Files\McAfee" /s /q
rd "C:\ProgramData\McAfee" /s /q
rd "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee" /s /q
del C:\Windows\Temp\mvadm.exe /q
Seppie's Blog 