Uninstall McAfee LiveSafe silently from the commandline #WhatILearnedToday

03.11.2020

Do you know that feeling when you use your favorite search engine with “this should be easy, someone will already have figured out how to do this” in mind?

This is how my work on the topic I´m describing in this post started. And because this blogpost exists, you might assume correctly that this was not the case for the challenge I was facing:

Silently uninstalling the McAfee LiveSafe bloatware trial version on a fresh installed Windows 10 PC. (Seriously Microsoft – You should make Windows less expensive to the OEMs so they “don´t have to” sell space for crapware on their customers computers. How great would it be to have a clean Windows installed from the start for everyone? Customer Experience anyone? )

While doing this manually might be (and probably is) the best solution for a single device, uninstalling this software from “Add/Remove Programs” is not an option if you have to get rid of it on many PCs.

Unfortunately McAfee seems to think that uninstalling their software should be really hard – they even put a captcha in the manual uninstall process!. They don´t provide any command line parameters or uninstall information besides “Use Add/Remove programs” or “use the McAfee Consumer Products Removal Tool” with a Gui. Uninstalling via PowerShell did not work either.

(For the Enterprise part of their software they provide a different tool called “Endpoint Product Removal Tool” , which seems to accept command line parameters.)

So a little digging was needed to find out how to achieve the goal: A silent uninstall of McAfee LiveSafe (and all other McAfee Products)

Here´s is how to do it (please note that the solution is working today 03.11.2020 with McAfee LiveSafe Version 16.0R24)

a) Download the McAfee Consumer Product Removal Tool (http://us.mcafee.com/apps/supporttools/mcpr/mcpr.asp )

b) Open an elevated PowerShell window

c) Navigate to the folder you saved the MCPR.exe to.

d) Start MCPR.exe and do not close the window, click next or click cancel. We just need the installer to extract the files we want to use.

e) Navigate to your local appdata folder cd $Env:LocalAppdata\Temp 

f) Copy the folder “MCPR” to any other folder on your Harddrive (e.g. c:\temp\KillMcAfee)

Because of the -Force Parameter, the folder will be created even if it does not exist.

copy-item -Path .\MCPR\ -Destination c:\temp\KillMcAfee -Recurse -Force

g) Navigate to the folder where you copied the data to.

h) Close the still open Uninstall User Interface by clicking cancel

i) Now that the Gui is closed, it´s time to uninstall McAfee LiveSafe without any Gui with PowerShell:

.\Mccleanup.exe -p StopServices,MFSY,PEF,MXD,CSP,Sustainability,MOCP,MFP,APPSTATS,Auth,EMproxy,FWdiver,HW,MAS,MAT,MBK,MCPR,McProxy,McSvcHost,VUL,MHN,MNA,MOBK,MPFP,MPFPCU,MPS,SHRED,MPSCU,MQC,MQCCU,MSAD,MSHR,MSK,MSKCU,MWL,NMC,RedirSvc,VS,REMEDIATION,MSC,YAP,TRUEKEY,LAM,PCB,Symlink,SafeConnect,MGS,WMIRemover,RESIDUE -v -s

The uninstallation will take a while. I did not have to reboot but this might change in your environment.

I assume you could specify single packages if you wanted to keep some McAfee products on your computer by removing them from the command (hence I don´t know why you would want this…)

j) Delete the folder if you don´t need it any more.

Using this method, you can easily deploy the uninstallation to any number of PCs using your favorite software distribution tools (like Intune or Configuration Manager 😉 ). Just make sure to include the complete content of the MCPR-folder in your uninstall package.

UPDATE 06.11.2020

One way of deploying this via Intune:

a) create a batch file (e.g. Silent_uninstall.bat) in your MCPR-Folder

b) pack the MCPR-folder as *.intunewin file with the Intune Content Prep Tool (GitHub – microsoft/Microsoft-Win32-Content-Prep-Tool: A tool to wrap Win32 App and then it can be uploaded to Intune)

c) create a new application in Intune and assign it to a group of users or devices.

on the requirements page, create a requirement that checks if the McAfeee Registry key exists. This is one easy way to check if any McAfee software is installed. Please make sure the requirement fit´s for your environment.

In the detection rules section we use the same registry key to check if it is gone. If yes, we assume the software is uninstalled. Again, check if that is a good solution for your environment.

Finally assign it to a group of devices or users to get rid of McAfee LiveSafe.

 

11 thoughts on “Uninstall McAfee LiveSafe silently from the commandline #WhatILearnedToday

  1. Hey, first of all this is incredible, thank you for posting it.
    I spent such time trying to find an automatic way to get Mcafee off 200+ laptops. Eventually we just had the team remove them manually over several days. Unreal.
    Any tips on deploying this through Intune?

  2. Hey there! I wanted to reach out and thank you a ton for posting this. We are in the process of getting ready to use Autopilot on 1300+ devices that are coming with this cr@pware built-in. We spent a couple of days on this and to no avail could either find or build a solution. We were able to get to the point where we were taking the files from the %temp% folder but could never get the batch file to quite do what we wanted. You seriously shaved hours upon hours off our techs hands out in the field from having to run their removal tool manually per machine. Your solution works flawlessly and you laid it out precisely. Thanks again 🙂

  3. Thank you so much! I rolled out 200+ Lenovo laptops with autopilot after the summer and could not find a way to automate this. Now i finally can! Thanks thanks thanks!

  4. My man, you’ve saved my ass at work, I’ve been trying to sus this for months with the HP laptops and I was getting tired of unboxing them just to re-install Windows, thank you so much for this guide you are a god damn legend!

  5. man, you really rock. i just went down the same route as you almost going to givie up, when i found this post of yours, which saved me hours.
    thank you.

Leave a Reply

Your email address will not be published. Required fields are marked *