Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 12 replies
  • Subscribers 16 subscribers
  • Views 7335 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

sophos install does not remove Symantec

Drensta

I am trialing sophos central

I thought that installing Sophos Endpoint (the install file downloaded from Sophos Central portal) was meant to detect and remove third party security software.

I have a windows 10 desktop with an unmanaged install of Symantec endpoint protection V14.

when I run the sophos installer file, the installer starts with a screen that just has an install button. I click that button and it installs Sophos.

After the desktop restarts I am left with symantec and sophos both installed and running.

Am I mis-understanding this. Is there a way i can get the Sophos installer to remove symantec during the install?

 

thanks



This thread was automatically locked due to age.
Parents
  • 0

    Hello Adrian Nelson1,

    I'm neither using Central nor do I have endpoints with Symantec Endpoint Protection on them. AFAIK the installer should run CRT, detect the products in the CRT list linked from this article and either remove them or refuse to proceed. V14 is in the list, up to 14.2.1031.0100. Naturally I can't say what went wrong with your Win10 endpoint.
    The mentioned article contains links that should help in further assessment and troubleshooting.

    Christian 

  • +1 in reply to QC

    OK, resolved it.

    I was thinking that the removal would be don no matter what version of Symantec i was running . I was running 14.2.1023.0100, but that version doesn't appear in the CRT list.

    I ran a Symantec update to get it to 14.2.1031. I ran the Sophos install again and Symantec was removed during the install.

    strange that only specific versions get removed, would have thought all versions up to 14.2.1031 would be recognized and remove.

  • 0 in reply to Drensta

    Hello,

     Same issue here.

    The CRT https://community.sophos.com/p/latest-crt-list is quite old, March 13, 2019.

    Latest SAV version in our environment is 14.2.4814.1101

    There are around 500 clients of SAV from 14.0.xxx to 14.2.whatever.is.latest

    We are currently testing Intercept X with EDR Endpoint/Server. This automatic removal does not work. If there is no CRT update then this is a dealbreaker in our environment of around 350 PC and 150 servers.

    This cannot be done manually.

     

    Kindly advise is there is a simple workaround/fix, or when will this CRT be updated.

  • 0 in reply to Gjergj Koci

    Hi Gjergi,

    Please can you post, or PM me, the output of the AVRemove.log from one of the endpoints? 

    Regards,

    Stephen

  • 0 in reply to StephenMcKay

    any updates ? we are in the same situation

  • 0 in reply to Ri Ism

    Hi Ri,

    The team have identified the issue and hope to release an update next week to allow the removal of Symantec.

    Depending on your version you can test this by running the MSIEXEC string with 

    REBOOTPROMPT=Suppress SYMREBOOT=ReallySuppress as parameters.

    Regards,

    Stephen

  • 0 in reply to Gjergj Koci

    Sadly this issue was deal breaking. Renewal time was coming.

    We will remain with Symantec for another year. 

    Until next year..

  • +1 in reply to StephenMcKay

    So here is the command to uninstall Symantec:
    MsiExec.exe /X {713C5DAE-75BA-4DCA-B328-F96B129DCFD5} /q REBOOT=ReallySuppress PASSWORDVALID=Yes REBOOTPROMPT=Suppress  /lv!* c:\uninstallSEP.txt 

    "/lv!* c:\uninstallSEP.txt" logging is optional. The key is that Symantec has to be uninstalled before Sophos client gets deployed. I am using PDQ deployment, so first step is Symantec uninstall, then reboot, install Sophos and reboot again. So far I tested this successfully on two workstations. 

  • 0 in reply to Ri Ism

    Thanks Ri.

    It is worth noting that the uninstall string may differ for some customers (713C5DAE-75BA-4DCA-B328-F96B129DCFD5)

    Stephen

Reply Children
No Data
Unfiltered HTML