Forum Discussion

Njuguna_Muriithi's avatar
Njuguna_Muriithi
Copper Contributor
Apr 15, 2024

Uninstalling mcafee Trellix agent from Windows Pc's

Hello,   We are currently deploying Microsoft Defender for Endpoint Plan 2 to a client who had Trellix Security formely Mcafee and we are experiencing issues with the uninstallation of the Mcafee a...
rahuljindal's avatar
rahuljindal
Bronze Contributor
Apr 15, 2024
I am just coming off a fresh deployment. What is the error or the issue you are facing?
  • Njuguna_Muriithi's avatar
    Njuguna_Muriithi
    Copper Contributor
    Apr 16, 2024
    The main issue is removing the Trellix agent from the devices currently it is possible to remove the agent and other Trellix products through a McAfee-developed tool "Endpoint Product Removal Tool", but this tool expires quarterly and the tool available now has already expired. We tried using Intune to push a win32 app but that only proved effective in removing McAfee consumer products but not enterprise-grade products that come with agent installation. The machines are domain joined does anyone know a possible way to remove the agents via group policies.
    • DylanInfosec's avatar
      DylanInfosec
      Iron Contributor
      Apr 16, 2024
      Ahh I see. As Rahul mentioned why not use EPO to uninstall.

      If that’s longer an option then an email to the former account manager of the Trellix contract for a new uninstall tool would be your best next bet. Might take them a bit but if the agent had tamper protect on or an uninstall password set it’s your only option.

      These tools have a removal prevention mechanism for a reason and if they don’t work then why are we buying them 😁

      - Dylan
      • question92120's avatar
        question92120
        Copper Contributor
        Aug 16, 2024

        Uninstall the Agent First:
        Although it's typically recommended to uninstall the agent last, you should start by attempting to uninstall the Trellix/McAfee agent first.
        Go to Control Panel > Programs and Features and find the Trellis agent.
        Right-click and select Uninstall.
        Follow the prompts to complete the uninstallation process.

         

        Reboot the System:
        After uninstalling the agent, reboot the system. This step ensures that any remaining components tied to the agent are properly cleared.

         

        Uninstall Other Trellis Software:
        Once the system has rebooted, proceed to uninstall any other Trellis Endpoint Protection software components from Programs and Features.
        Uninstall each component one by one, followed by another reboot if necessary.

         

        This approach allows you to tackle the uninstallation in a more aggressive manner, potentially avoiding complications that might arise from residual files or dependencies tied to the Trellix agent.

    • rahuljindal's avatar
      rahuljindal
      Bronze Contributor
      Apr 16, 2024
      Why not use EPO for the removal tasks?

Resources