Cannot Uninstall SESC From Endpoints (using MsiExec)

Question

I've referenced the following KB on removing SEC from endpoints using MsiExec.exe after running a Reg Query. When using the syntax in the KB (only the GUID between curly braces), it only results in a Windows Installer popup (i.e. it doesn't do anything). If I include the full Reg Key path returned from the Reg Query, I am able to get an uninstall prompt, however, it results in the following error "This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package". SophosZap was successful in removing all products, however, I need to be able to run these commands to perform a silent/remote mass uninstall from 300+ endpoints. 
 I have run all commands with domain admin privilege, and have run all commands after running as administrator. 
 I have stopped all services using the below commands: 
 net stop "Sophos Agent"
net stop "Sophos Anti-Virus"
net stop "Sophos Anti-Virus status reporter"
net stop "Sophos AutoUpdate Service"
net stop "Sophos Client Firewall"
net stop "Sophos Client Firewall Manager"
net stop "Sophos Device Control Service"
net stop "Sophos Endpoint Defense Service"
net stop "Sophos Message Router"
net stop "Sophos Network Threat Protection"
net stop "Sophos Patch Agent"
net stop "Sophos System Protection Service"
net stop "Sophos Web Control Service"
net stop "Sophos Web Filter"
net stop "Sophos Web Intelligence Service" 
 Reg Query example: 
 
 MsiExec command using full path: 
 
 Error after selecting "OK" via the uninstall window:

QC · Accepted Answer

Hello Eric Meinders , 
 msiexec.exe /x { GUID } is the correct format. That you get the Windows Installer popup suggests a syntax error, specifically a missing /option (e.g. the /x). Did you indeed use msiexec.exe /x"{FED1005D-CBC8-45D5-A288-FFC7BB304121}" ? Even with a non-existing product code you should get the Are you sure ... prompt. The full path is interpreted as path to a Product.msi , i.e. an installer package in the file system, not to the meta-information in the registry. That's why you get the could not be opened error.. 
 @Sophos User930: This is the on-premise SESC, there is no Sophos Endpoint Agent and hence no uninstallcli.exe . 
 Christian

Eric Meinders · Answer

I think your reply just highlighted the issue -- the quotes are required. Per the KB, the syntax is msiexec.exe /X{GUID} but it looks like this needs to be changed to msiexec.exe /X"{GUID}". I haven't tested with /qn or reboot suppression yet, but it would appear the local/manual msiexec.exe commands work now with the quotes.

GlennSen · Answer

Hi Eric, 
 With regards to this query, I would suggest you reach your TAM and discussed this as Profisional Services might be required to archive this script removal on your environment. If you don't know your TAM, you can drop an DM to me and I'll provide it to you.

Cannot Uninstall SESC From Endpoints (using MsiExec)

Top Replies