Endpoint Protection

Good morning all,

We have a few machines that have Microsoft Forefront installed. After following responses to a topic I had posted, we have successfully implemented SEPPrep so that we can remove Microsoft Forefront. The issue that we're having is that I'm trying to get it completely silent so that only if the user has to reboot their computer if they need to. 

Right now, an interactive desktop wizard will pop up requiring user permission to uninstall the application as requested. I've gone through our SEPPrep.ini file and all of the settings appear correct. Our settings are:

ShowGUI=N
ShowMessageBox=N
AutoRunAfterUILoads=N
AskBeforeRemoval=N
SilentMSIInstaller=Y

Those appear to be the main settings that would control whether this displays or not. One caveat is that all of our PCs users do not have administrator privileges setup on their PC.

Is there anything that I'm missing to make sure that this is completely silent of an install?

Thanks!

Those are exactly what you need.

Also make sure when you export the package that it's silent as well

Brian, when we export the package and set to run remotely we specify the silent settings are as well.

What can we troubleshoot to figure out why it keeps launching this interactive manager regardless of our settings?

That's odd. So it brings up the install wizard?

I wouldn't say it's quite the install wizard. It brings up a screen saying that Windows is trying to show you a notification, so click to show it. Then it has a weird sort of overlay saying that it is being requested you uninstall Microsoft Forefront. Clicking yes to allow will then uninstall Forefront, then will install Symantec. More interaction than we're looking for. :)

Is UAC off?

We've tried it with UAC both off and on. We get the same result. It isn't even a typical UAC prompt.

Our settings file:

[Settings]
ShowGUI=N
ShowMessageBox=N
MessageBoxText=Prepairing your system for Symantec Endpoint Protection 11.0.  During this process other antivirus products will be removed.\n\nIf you are prompted please fully remove these products.
AutoRunAfterUILoads=N
AskBeforeRemoval=N
SilentMSIInstaller=Y
RemoveSymantec=N
CheckDiskSpace=Y
ResumeAfterReboot=Y
EnableLogging=Y
LogPath=
RunBeforeRemoval=
RunAfterRemoval=SEPsetup.exe

[UninstallPaths]
SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins

[ProductNames]
;Programs that must be removed first
Cisco Security Agent
McAfee Agent
McAfee Anti-Spyware
;The name of antivirus companies
McAfee
Trend Micro
Sophos
Kaspersky
avast!
Webroot
BitDefender
F-Secure
AhnLab
;Key words used in product names
Forefront
AntiVirus
Anti-Virus
Antispyware
Anti-spyware
AntiTrojan
Anti-Trojan
Client Security
Security Agent
Internet Security
Endpoint Protection
Total Security
Total Protection
Personal Firewall
Client Firewall
;Known product names
Norton Internet Security
Norton 360
Norton Antivirus
Norton SystemWorks
McAfee Total Security
McAfee VirusScan Enterprise
McAfee VirusScan
McAfee Antispyware
McAfee Total Protection
McAfee Active Virus
McAfee Internet Security
Trend Micro Internet Security
Trend Micro AntiVirus
Trend Micro SecureSite
Trend Micro Worry-Free
Trend Micro OfficeScan
Trend Micro NeatSuite
Trend Micro InterScan
Trend Micro ServerProtect
PC-Cillin
Sophos Anti-Virus
Sophos Endpoint Security
Sophos Client Firewall
Sophos Computer Security
Panda Administrator
Panda Internet Security
Panda Global Protection
VIPRE® Antivirus
VIPRE Antivirus
VIPRE Enterprise
CounterSpy Antispyware
Windows Defender
Microsoft Forefront Client Security
Forefront Client
BitDefender Antivirus
BitDefender Total Security
BitDefender Internet Security
BitDefender GameSafe
Agnitum Outpost
Outpost Security Suite
Outpost Firewall
Outpost Network Security
AVG Free
AVG Internet Security
AVG Anti-Virus
AVG 2010
AVG 2011
Avira AntiVir
Avira Premium Security
Avira WebProtector
CA eTrust
CA iTechnology
CA Internet Security
CA Anti-Virus
CA Personal Firewall
CA Anti-Spyware
eEye Blink
eEye Iris
eEye Retina
ESET NOD32
ESET Smart Security
ESET Enterprise Security
AntiTrojanVirus
Anti-TrojanVirus
Internet Guardian Angel
Finport Simple Anti-Virus
Fortinet FortiClient
FortiClient
Frisk F-PROT
F-PROT Antivirus
F-Secure Client Security
F-Secure PSB Workstation Security
F-Secure Anti-virus
G DATA AntiVirus
G DATA InternetSecurity
G DATA TotalCare
G DATA NotebookSecurity
G-DATA AntiVirus
G-DATA InternetSecurity
G-DATA TotalCare
G-DATA NotebookSecurity
K7 Total Security
K7 Antivirus
Kingsoft Internet Security
MWTI eScan Internet Security
eScan AntiVirus
eScan Internet Security
eScan Corporate Edition
eScan Enterprise Edition
Nifty Corp. Security
Norman Security
Norman Endpoint Protection
Norman Virus Control
Norman Online Protection
PC Tools AntiVirus
PC Tools Internet Security
PC Tools Spyware Doctor
Quick Heal AntiVirus
Rising Internet Security
Trustport Antivirus
VirusBuster VirusBuste
VirusBuste
TrustPort Antivirus
TrustPort PC Security
TrustPort USB Antivirus
TrustPort U3 Antivirus
ClamWin Free Antivirus
ClamWin
Spybot
ZoneAlarm
Proventia
BlackICE

Does it seem more relate to Forefront / Windows?

I don't think it has to do with a Forefront thing as it is being kicked off on the Windows side. I just don't know if Windows is forcing the interaction (it's a screen I've never seen before) or if it is Symantec. It works, but it forces the user to interact and I would rather do this 100% silent as possible.

Sorry about that Brian. It appears that it is the Interactive Services Detection window. The title program is Microsoft Forefront. Forefront then pops up with the uninstall confirmation.

I guess the next question: How to make SEPPrep silently uninstall Microsoft Forefront?

To be frank, I don't know that SEP can get around this. It may be something built-in to Foreront or required because it is an M$ product.