sophos install does not remove Symantec

Hello Adrian Nelson1,

I'm neither using Central nor do I have endpoints with Symantec Endpoint Protection on them. AFAIK the installer should run CRT, detect the products in the CRT list linked from this article and either remove them or refuse to proceed. V14 is in the list, up to 14.2.1031.0100. Naturally I can't say what went wrong with your Win10 endpoint.
The mentioned article contains links that should help in further assessment and troubleshooting.

Christian 

OK, resolved it.

I was thinking that the removal would be don no matter what version of Symantec i was running . I was running 14.2.1023.0100, but that version doesn't appear in the CRT list.

I ran a Symantec update to get it to 14.2.1031. I ran the Sophos install again and Symantec was removed during the install.

strange that only specific versions get removed, would have thought all versions up to 14.2.1031 would be recognized and remove.

OK, resolved it.

I was thinking that the removal would be don no matter what version of Symantec i was running . I was running 14.2.1023.0100, but that version doesn't appear in the CRT list.

I ran a Symantec update to get it to 14.2.1031. I ran the Sophos install again and Symantec was removed during the install.

strange that only specific versions get removed, would have thought all versions up to 14.2.1031 would be recognized and remove.

Hello,

 Same issue here.

The CRT https://community.sophos.com/p/latest-crt-list is quite old, March 13, 2019.

Latest SAV version in our environment is 14.2.4814.1101

There are around 500 clients of SAV from 14.0.xxx to 14.2.whatever.is.latest

We are currently testing Intercept X with EDR Endpoint/Server. This automatic removal does not work. If there is no CRT update then this is a dealbreaker in our environment of around 350 PC and 150 servers.

This cannot be done manually.

Kindly advise is there is a simple workaround/fix, or when will this CRT be updated.

Hi Gjergi,

Please can you post, or PM me, the output of the AVRemove.log from one of the endpoints? 

Regards,

Stephen

any updates ? we are in the same situation

Hi Ri,

The team have identified the issue and hope to release an update next week to allow the removal of Symantec.

Depending on your version you can test this by running the MSIEXEC string with 

REBOOTPROMPT=Suppress SYMREBOOT=ReallySuppress as parameters.

Regards,

Stephen

Sadly this issue was deal breaking. Renewal time was coming.

We will remain with Symantec for another year. 

Until next year..

So here is the command to uninstall Symantec:
MsiExec.exe /X {713C5DAE-75BA-4DCA-B328-F96B129DCFD5} /q REBOOT=ReallySuppress PASSWORDVALID=Yes REBOOTPROMPT=Suppress  /lv!* c:\uninstallSEP.txt 

"/lv!* c:\uninstallSEP.txt" logging is optional. The key is that Symantec has to be uninstalled before Sophos client gets deployed. I am using PDQ deployment, so first step is Symantec uninstall, then reboot, install Sophos and reboot again. So far I tested this successfully on two workstations. 

Thanks Ri.

It is worth noting that the uninstall string may differ for some customers (713C5DAE-75BA-4DCA-B328-F96B129DCFD5)

Stephen

Is this for all Symantec installs? We've been having a tough time trying to find a solution on our end to uninstall SEP.Cloud for our clients.

Hi ddasilva 

Thank you for posting your query on the community.

I'd suggest you contact Symantec to get the command-line command to uninstall Symantec product from your machine.

i've sent you a PM, hopefully this will help.

Currently you have to run the removal prior to deploying Sophos, but the team are looking to add Symantec Cloud removal to the Sophos installer so that this will all be done as part of a Sophos deployment.

Regards,

Stephen