Endpoint Protection

Hello,

Can any one please help to create the same for SEP 12.1 and above versions?

I'm in need of this script since i can't use Latest Cleanwipe because it is not silent supported. But we need to remove corrupted SEP on more than 200 machines.

Even tried with SEPprep tool but doesn't work.

Thanks in advance.

I get the Recursive Warning when it deletes Registry keys.

If I wanted to automate this could I just add -Recursive after each Remove-Item -Path statement?

first thx henrycharles for this awesome script.

But i found in SymantecSEPRemoval_Part1.TXT in Line 275 Remove-Item -Path hklm:\SOFTWARE\Symantec\"Symantec Endpoint Protection -Force this sign " is missing and throws the error.

So change to Remove-Item -Path hklm:\SOFTWARE\Symantec\"Symantec Endpoint Protection" -Force

and all works fine!

Do not kill lines, just check the code. ;-)

I attached changed script.

thank you .. however I get below error when i try to excute part 1 of the script...please advise.

The string starting:
At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:303 char:78
+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\"Symantec AntiVirus <<<< " -Force
is missing the terminator: ".
At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:309 char:75
+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\WpsHelper -Force <<<<
    + CategoryInfo          : ParserError: ( -Force
Remove...psHelper -Force:String) [], ParseException
    + FullyQualifiedErrorId : TerminatorExpectedAtEndOfString

Removed the below lines from 303 & 309 "Symantec AntiVirus”  and the last line (309)

Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\"Symantec AntiVirus" -Force

Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\WpsHelper -Force

However we get  the same error again with line which has last "Symantec AntiVirus”  (292)and the last line(307)

The string starting:

At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:292 char:99

+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\Eventlog\Application\"Symantec AntiVirus <<<< " -Force

is missing the terminator: ".

At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:307 char:69

+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\WPS -Force <<<<

    + CategoryInfo          : ParserError: ( -Force

Remove...ices\WPS -Force:String) [], ParseException

    + FullyQualifiedErrorId : TerminatorExpectedAtEndOfString

I've used CleanWipe [its a great tool] but, there are times even the cleanwipe tool doesn't work. These script rip it out by brute force so that you can re-install it.

A GUI tool that does the same is called CleanWipe. The current version is v12.1.671.4971 and seem to be available only via Symantec Support. No direct download available.

About CleanWipe
===============

CleanWipe is a tool that you can use to prepare or clean any supported Windows computer before you install Symantec Endpoint Protection. It is a self-extracting executable that unzips its batch files, utility programs, and data files to the Windows\Temp folder by default. The password for this self-extracting executable is "symantec" (no quotes, all lower case).

Use CleanWipe with caution. You should use CleanWipe as a last resort after all other means to prepare or clean a computer for Symantec Endpoint Protection installation have failed. 

an update for SEP12.1 would be lovely =)

Make sure you have Powershell installed on the affected system(s)

You have to run the script from Powershell prompt "not the DOS command prompt"

You will most likely receive an error about running an unsigned script. The get around that issue you'll need to type the following command in the Powershell prompt "Set-ExecutionPolicy Unrestricted"

Note: don't forget to run this command in the Powershell prompt when you're done to set back the security:
"Set-ExecutionPolicy restricted"

Hope this helps!

Henry

after changing the extension from .txt to .PS1 its going in unknow format..is this extension correct ?

HenryCharles Thanks much :)