Home / server / Questions / 256077
Accepted
Holocryptic
Asked: 2011-04-06 13:14:26 +0800 CST

Programmatically remove MSFT Security Essentials Anti-Virus from XP and Win7 machines

  • 772

I need a way to remove MSFT Security Essentials so that I can install Forefront on the clients. I would prefer a login script that would pass administrator credentials to remove the program. If that's not possible, then a script that I can run at boot time is acceptable.

I have the following PS script that someone else supplied from the webs, but I get an error when running it.

$UninstallString = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | ?{$_.GetValue("DisplayName") -like "Microsoft Security Essentials" } | ForEach-Object -Process {$_.GetValue("UninstallString") }
$uninstallCmd=$UninstallString.split('/')[0].Trim() 
$uninstallParam='/' + $UninstallString.split('/')[1].Trim()
$uninstallParamSilent="/s"
& $uninstallCmd $uninstallParam $uninstallParamSilent

When run as is (even though I know it looks wrong) I get the following error:

Method invocation failed because [System.Object[]] doesn't contain a method named 'split'.
At C:\Users\administrator\Desktop\remove Security essentials.ps1:2 char:37
+ $uninstallCmd=$UninstallString.split <<<< ('/')[0].Trim()
    + CategoryInfo          : InvalidOperation: (split:String) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

Method invocation failed because [System.Object[]] doesn't contain a method named 'split'.
At C:\Users\administrator\Desktop\remove Security essentials.ps1:3 char:45
+ $uninstallParam='/' + $UninstallString.split <<<< ('/')[1].Trim()
    + CategoryInfo          : InvalidOperation: (split:String) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

The expression after '&' in a pipeline element produced an invalid object. It must result in a command name, script blo
ck or CommandInfo object.
At C:\Users\administrator\Desktop\remove Security essentials.ps1:5 char:2
+ & <<<<  $uninstallCmd $uninstallParam $uninstallParamSilent
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException

Moving the last line into the preceding one also nets an error:

Unexpected token '&' in expression or statement.
At C:\Users\administrator\Desktop\remove Security essentials.ps1:4 char:29
+ $uninstallParamSilent="/s" & <<<<  $uninstallCmd $uninstallParam $uninstallParamSilent
    + CategoryInfo          : ParserError: (&:String) [], ParseException
    + FullyQualifiedErrorId : UnexpectedToken

I don't know enough about PS to see where the code is wrong, but any help would be appreciated.

Also, if someone has something that would work on this on both XP and Win7 without having to install PS on the XP machines that would be great too.

scripting powershell

3 Answers

  1. Best Answer

    It looks to me like you've got more than one product being returned by the Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | ?{$_.GetValue("DisplayName") -like "Microsoft Security Essentials" } cmdlet, and your script it falling over because it only expects one.

    Try this modified script which loops over each returned object and executes the uninstall command for the product. I've also changed the /s switch on msiexec to /quiet as that looks to be compatible with more versions of Windows.

    $UninstallString = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | ?{$_.GetValue("DisplayName") -like "Microsoft Security Essentials" } | ForEach-Object -Process {$_.GetValue("UninstallString") }

foreach($ThisProduct in $UninstallString)
{
    $UninstallCmd = $ThisProduct.split('/')[0].Trim() 
    $UninstallParam = '/' + $ThisProduct.split('/')[1].Trim()
    $UninstallParamQuiet = "/quiet"

    & $UninstallCmd $UninstallParam $UninstallParamQuiet
}

    Disclaimer: This answer comes after an awful lot of back and forth in chat to determine the real problem that more than one item was being returned by one of the PowerShell commands.

    • 2

  2. Is $UninstallString indeed a string? If not, you may need to cast it to be a string. Also, I don't think that it's null, but you may want to verify that it contains what you think it does after that first step.

    • 1 
  3. @ECHO OFF

CLS

C:

CD\

CD Program Files\Microsoft Security Client

setup.exe /x /s



EXIT

    This works on XP clients, haven't tested on Win7 but as it's just a batch script it should be fine. Obligatory "So easy a $BRAINDEADBIPED could do it!" here.

    • 1