Clean Uninstall of GPO SAV10 software?
Years ago we pushed Symantec Antivirus 10 (SAV10) via Active Directory Group Policy (GPO) WITH the flag that it should uninstall if the machine falls out of scope! SAV10 did not support this! So now when the machine falls out of scope we get an error and the managed uninstall attempts at each restart. This can be cleaned using the Microsoft Windows Installer Clean Up Tool (msicuu) but we don't want to run it manually on ALL machines.
Here is what I'm testing that seems to work, I have a script that handled the following; IS THIS THE 'BEST' WAY???
1. Remove the GPO from a group of computers
2. Run the uninstall for SAV10
3. delete the registry entry for the Group Policy Software (SAV10)
HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\{d9b44787-c21d-....}
4. delete the registry entry for the Windows Installer reference to SAV10:
HKEY_CLASSES_ROOT\Installer\Products\89FCFC336D8F94544B96F6245976D638
5. Install new AntiVirus product
Any critique would be appreciated!!! Thanks!
Here is what I'm testing that seems to work, I have a script that handled the following; IS THIS THE 'BEST' WAY???
1. Remove the GPO from a group of computers
2. Run the uninstall for SAV10
3. delete the registry entry for the Group Policy Software (SAV10)
HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\{d9b44787-c21d-....}
4. delete the registry entry for the Windows Installer reference to SAV10:
HKEY_CLASSES_ROOT\Installer\Products\89FCFC336D8F94544B96F6245976D638
5. Install new AntiVirus product
Any critique would be appreciated!!! Thanks!
0 Comments
[ + ] Show comments
Answers (12)
Please log in to answer
Posted by:
anonymous_9363
13 years ago
SAV10 is a joke. At my last client, AV was handled by the server team. They were trying to update to SEP11 and called in a Symantec consultant who gave up after 2 days saying that we'd have to create a bunch of task sequences in SCCM to do the job. Finally, they came to me to ask if it could be done. Well, it can but only after LOTS of pruning.
From memory, the main stumbling blocks are the 2 CAs RemoveExistingProductsEarly and RemoveExistingProductsLate. Start by commenting those out and restoring the normal RemoveExistingProducts which Symantec comment-out.
Try that first.
From memory, the main stumbling blocks are the 2 CAs RemoveExistingProductsEarly and RemoveExistingProductsLate. Start by commenting those out and restoring the normal RemoveExistingProducts which Symantec comment-out.
Try that first.
Posted by:
squeakstar
13 years ago
riverside kid - i would be interested in how you found the registry entry for that particular piece of software distributed thrugh GPO or any links you could provide to help identify registry/policy entries pertaining to GPO software distribution.
I still have nightmares about a java version that got stuck and had to be manually removed and wished i'd known how to extract references to it properly, and want to armed should i ever have a similiar issue. Thanks dude.
I still have nightmares about a java version that got stuck and had to be manually removed and wished i'd known how to extract references to it properly, and want to armed should i ever have a similiar issue. Thanks dude.
Posted by:
anonymous_9363
13 years ago
Why not use MSIZap? That removes the GP junk as well as the uninstall stuff. It's part of the Windows Installer SDK (which I think has been subsumed into the much larger Platform SDK, but don't quote me).
EDIT:
Some notes I made when building an MSIZap clone in VBS (yet another unfinished project...LOL)
EDIT:
Some notes I made when building an MSIZap clone in VBS (yet another unfinished project...LOL)
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\{usersid}\Installer\Features\[Packed GUID]
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\{usersid}\Installer\Products\[Packed GUID]
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\{usersid}\Installer\UpgradeCodes\[Packed GUID], [Packed GUID]
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\{usersid}\Components
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\{usersid}\Products\[Packed GUID]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\{GUID}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\[UserSID]\GroupMembership
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\[UserSID]\History\{25537BA6-77A8-11D2-9B6C-0000F8080861} '// DomainGUID at end?
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\[UserSID]\History\{c6dc5466-785a-11d2-84d0-00c04fb169f7}\0 '// What GUID is this?
Posted by:
squeakstar
13 years ago
Cool thanks vbscab - i'll check that out !!!
...check out and found this post http://www.symantec.com/connect/articles/windows-install-clean-utility-using-msizap
is msiZap the same thing as Windows Install Clean Up utility but a command line version??
i have used Windows Install Clean Up utility before but didn't realise how far it went with regards to clean-up?
anyway i'll try to stop hijacking this thread... [:)]
...check out and found this post http://www.symantec.com/connect/articles/windows-install-clean-utility-using-msizap
is msiZap the same thing as Windows Install Clean Up utility but a command line version??
i have used Windows Install Clean Up utility before but didn't realise how far it went with regards to clean-up?
anyway i'll try to stop hijacking this thread... [:)]
Posted by:
anonymous_9363
13 years ago
s msiZap the same thing as Windows Install Clean Up utility but a command line version??In a word, no. Completely different animal.
Posted by:
squeakstar
13 years ago
ORIGINAL: VBScab
s msiZap the same thing as Windows Install Clean Up utility but a command line version??In a word, no. Completely different animal.
Ta luv!
Posted by:
riversidekid
13 years ago
VBScab: I have always known that SAV10 was a pain, but that explains a lot and opens a new avenue to explore, thanks!
squeakstar: The registry setting for the removal of the GPO setting is just part of the reason for the post; I know that all GPO software is placed there, but I'm not sure that this is the best way to remove the association.
VBScab: I've not used MSIZap in years and had totally forgotten about it!!! I'll try that next!
squeakstar: Thanks for the Symantec article regarding MSIZAP. I think it's funny that they chose to display the removal of Orca rather than _any_ Symantec product, but the concepts are there. :) I don't think it's hijacking the thread since we are on the same topic!!!
Thanks everyone for the input, I'm off to play on some test computers now!!!
squeakstar: The registry setting for the removal of the GPO setting is just part of the reason for the post; I know that all GPO software is placed there, but I'm not sure that this is the best way to remove the association.
VBScab: I've not used MSIZap in years and had totally forgotten about it!!! I'll try that next!
squeakstar: Thanks for the Symantec article regarding MSIZAP. I think it's funny that they chose to display the removal of Orca rather than _any_ Symantec product, but the concepts are there. :) I don't think it's hijacking the thread since we are on the same topic!!!
Thanks everyone for the input, I'm off to play on some test computers now!!!
Posted by:
squeakstar
13 years ago
lol the Symantec post was pure fluke becaue out of the top 3 google searches i opened in tabs this was the clearest and most relevant. [:D]
Posted by:
FunWithApps
13 years ago
You could always use the Symantec written NoNav utility, which is a command line utility that removes all vestiges of all versions of NAV and SAV up to the 10.x, in one fell swoop.
Talk to Symantec support, it may also turn up on google. This worked wonderfully for me when I had stubborn machines.
Talk to Symantec support, it may also turn up on google. This worked wonderfully for me when I had stubborn machines.
Posted by:
anonymous_9363
13 years ago
Following the abject failure of a Symantec representative to get their own software to uninstall a previous version, I would have serious doubts about ANY utility from the same stable. Still, if it worked for you, good job! :)
Posted by:
squeakstar
13 years ago
ha ha ha - I had to fall back on this when i was just cutting my teeth as an IT managing small company newb after a failed upgrade of Symantec AV which wasted a weekend. what a friggin joke - i followed their upgrade instructions to the tee as wwas petrified of mucking up our SBS 2003 system and wasted a whole weekend until I found about that little utility.. i do think it worked in my case though...
Posted by:
FunWithApps
13 years ago
VBScab, I got the utility from an engineer at Symantec I finally got connected with. Then again, this was before Symantec fully implemented its plan of becoming Borg and sucking up every company in its path. :-)
Rating comments in this legacy AppDeploy message board thread won't reorder them,so that the conversation will remain readable.