Forum Discussion

AB21805's avatar
AB21805
Bronze Contributor
Apr 14, 2021
Solved

Removing McAfee live safe via intune

Hi all, 

 

Was wondering if someone can help! I have enrolled devices and all have mcafee live safe trial on which  I need to remove, as I have given these devices back to users, fresh start isnt possible. I have found this: https://christianlehrer.com/?p=359 if I run the command ".\Mccleanup.exe -p StopServices,MFSY,PEF,MXD,CSP,Sustainability,MOCP,MFP,APPSTATS,Auth,EMproxy,FWdiver,HW,MAS,MAT,MBK,MCPR,McProxy,McSvcHost,VUL,MHN,MNA,MOBK,MPFP,MPFPCU,MPS,SHRED,MPSCU,MQC,MQCCU,MSAD,MSHR,MSK,MSKCU,MWL,NMC,RedirSvc,VS,REMEDIATION,MSC,YAP,TRUEKEY,LAM,PCB,Symlink,SafeConnect,MGS,WMIRemover,RESIDUE -v -s" locally it works but once i follow the intune way of doing it I cant get it to work! 

 

Does anyone know how I can wrap the uninstall exe and a powershell script correctly to remove mcafee live safe or another way I can do this but has to be remote via intune.

 

Thanks in advance!

  • You could "fake" the uninstall command as it is not required, just enter uninstall.cmd

    As detection rule you could add an extra command to the install script to create an additional file something like this:

    New-Item -Path "c:\" -Name "temp" -ItemType "directory" -force
    $path = "c:\temp"
    New-Item -path $path -name "removeav.txt" -ItemType file -force

9 Replies

    • AB21805's avatar
      AB21805
      Bronze Contributor
      Hi,

      in the link i shared the person uses "%~dp0Mccleanup.exe -p StopServices,MFSY,PEF,MXD,CSP,Sustainability,MOCP,MFP,APPSTATS,Auth,EMproxy,FWdiver,HW,MAS,MAT,MBK,MCPR,McProxy,McSvcHost,VUL,MHN,MNA,MOBK,MPFP,MPFPCU,MPS,SHRED,MPSCU,MQC,MQCCU,MSAD,MSHR,MSK,MSKCU,MWL,NMC,RedirSvc,VS,REMEDIATION,MSC,YAP,TRUEKEY,LAM,PCB,Symlink,SafeConnect,MGS,WMIRemover,RESIDUE -v -s" for the .bat why would %~dp0 be needed? I try running this on the device which has mcafee live safe on and this doesnt work so I would assume this wouldnt work once put in intune?

      Would the install/uninstall command be the name of the .bat too? for instance Slient_uninstall.bat

      • If the .exe is inside that folder you could create a simple powershell script with these contents in it:
        .\Mccleanup.exe -p and the other stuff 🙂

        Create a win32app and select the instalscript as setup

        Your install command in intune would be powershell.exe -executionpolicy bypass -command ".\installscripts.ps1"

        Maybe before you create the intunewin file, test it out on a device before you upload it

Resources