How to Uninstall Symantec Endpoint Protection Remotely Using PowerShell

Remove or uninstall SEP using PowerShell

In some cases, you want to remove or uninstall Symantec Endpoint Protection on clients automatically from SEPM. but has no uninstall tool from their console.

In this post, I will use PowerShell to execute a command on a remote machine to remove SEP automatically.

Note Note: You must have the machines on the network configured for PowerShell Remoting, so connecting to them would be not a challenge.

1. The challenge we had was that on several clients it seemed Symantec had a different IdentifyingNumber (IN), which is the GUID used by Windows to identify the product.

For example, we had several client machines. Firstly, we need to find the IdentifyingNumber from each PC.

$computers = "pc001","pc002","pc3"
foreach ($computer in $computers) {
$session = new-pssession $computer
Invoke-Command -Session $session -ScriptBlock { 
    GWMI Win32_Product | where{$_.Caption -like "*Symantec*"} 
}
Get-PsSession | Remove-PsSession
}

2. This will output all of the relevant information regarding Symantec from each PC in turn. You should see something like this:

IdentifyingNumber : {9E188836-2176-4CA3-B823-C37C84E32E88}
Name              : Symantec Endpoint Protection
Vendor            : Broadcom
Version           : 14.3.558.0000
Caption           : Symantec Endpoint Protection
PSComputerName    : pc001

3. Once you have the IdentifyingNumber you can then amend your original command to the following:

$computers = "pc001"
foreach ($computer in $computers) {
$session = new-pssession $computer
Invoke-Command -Session $session -ScriptBlock { 
    msiexec /x “{9E188836-2176-4CA3-B823-C37C84E32E88}” /qb }
Get-PsSession | Remove-PsSession
}

Remove SEP client on all PCs at once

I you had a lot more computers, and found you had a lot more varying IN, you could tweak this command to find the relevant IN and process it immediately by doing something like this.

$computers = "pc001","pc002","pc3"
foreach ($computer in $computers) {
$session = new-pssession $computer
Invoke-Command -Session $session -ScriptBlock { 
    $in = (GWMI Win32_Product | 
    where{$_.Caption -like “*symantec*”}).IdentifyingNumber; msiexec /x “$in” /qb}

Get-PsSession | Remove-PsSession
}

By adding in a semicolon, we can of course add a second line to our ScriptBlock and make the process a little more automated. Anyways, i hope this may help you remove Symantec from your machines a little faster!