1MethodofProcedureRevisionCUsingtheMcAfeeRemovalToolContentsConfidentialityNoticeIntroductionProcedureTroubleshootingMassdeployments2ConfidentialityNoticeThisdocumentanditscontentsareconfidentialandproprietarytoMcAfee,Inc.
andareintendedonlyfortheindividualorentityspecifiedhereinorotherwiseidentifiedbyMcAfee.
Unauthorizeduse,reproduction,ordistributionofthisdocumentoranyofitscontentsmayresultinlegalandfinancialpenalties.
3IntroductionTheMcAfeeRemoval(MFERemoval100.
exe)toolallowsyoutoremoveePOproductsfromcomputersinyournetwork.
WarningsandliabilityTheMFERemoval100.
exetoolisprovidedasabesteffortbyMcAfeesupport.
Thissoftware:HasnotbeentestedorapprovedbyMcAfee.
Shouldbetestedinyourlocalenvironmentbeforeyouattempttodeployittoyourusers.
Expiresandceasestofunctionafterthedateindicated.
Tofindtheexpirationdate:1.
Extractthestandaloneexecutable.
2.
Right-clicktheexecutablefileandclickProperties|General|Description.
SystemrequirementsThefollowingbasicrequirementsarerequiredoneachmachine:Windows5.
x-10.
xX86orx64AdministrativepermissionsNOTE:Ifrunningsyscore15.
7orhigher,youcanonlyremoveallproducts.
Itwillonlyrunwiththeproductswitch/all.
IfyourunningtheapplicationmanuallywithUACenabled,elevationisalsorequired.
Formoreinformation:http://msdn.
microsoft.
com/en-us/library/windows/desktop/aa511445.
aspxOtherdependencies:VerisignClass3PublicPrimaryCertificationAuthority–G5https://kc.
mcafee.
com/corporate/indexpage=content&id=KB870964ProcedureYoucanruntheMFERemoval100.
exetoolonyourlocalmachinebyrunningitfromthecommandline.
TaskRunMFERemoval100.
exeatthecommandlinewiththeappropriateswitches.
Switchesarenotcasesensitive.
/norebootWillnotcallreboot,overwrites/tand/forcereboot/forcerebootWillcallrebootuponcompletion/txxTimeinminutestodelayifrebootisneededor/forcerebootisused.
Defaultis10minutes.
Forexample,/t10/passHIPsclientUIpassword.
DoesnotworkwithHIPs7.
Forexample,/passabcde12345/qor/quietPreventsstatusmessageboxes.
IfdeployedfromePO,thisisautomaticallyset.
Whenspecified,theprocessexitswhenitcompletessuccessfully.
/customprops[1-4]Onlyonecustompropcanbeused.
Ifmorethanoneisprovided,thelastinthelistwillbetheoneused.
Onlynumbers1-4areallowed.
NospacesareallowedintheprovidedcustompropIf/custompropsissetandMcAfeeAgentisnotbeingremoved,thetoolwillattempttosetcustompropsthatcanbeusedlaterinePO.
Examples:1.
/customprops1AllDone2.
/customprops2mycustomprop3.
/customprops3VSEremoved4.
/customprops4MFERemovalRanOnProductswitches:/MA–McAfeeAgent/DLP–HostDataLossPrevention/HIP–HostIntrusionPrevention/VSE–VirusScanEnterprise/ENS–EndpointSecurity/DXL–McAfeeDataExchangeLayer/EIA–EndpointIntelligenceAgent/TIEM–McAfeeThreatIntelligenceExchangeModuleforVSE/MAR–McAfeeActiveResponse(RebootRequired)Oneormorearerequired.
5/MCP-McAfeeClientProxy/PA-McAfeePolicyAuditorAgent/DATRep–DATReputation/All–AllproductsForexample:Scenario1:Removeallproductsandrebootafter5minutesMFERemoval100.
exe/all/forceboot/t5Scenario2:RemoveVSEandHIP.
IncludetheHIPpassword.
MFERemoval100.
exe/vse/hip/passabcde12345orMFERemoval100.
exe/vse/hip/pass"abc123"Rebootyourcomputer.
Arebootisstronglyrecommendedifyouhaveremovedproductswiththeintentionofreinstallingthem.
RemovingHDLPandMARrequiresareboot.
Removingindividualproductsdoesnotrequireareboot.
Removingallproductsrequiresarebootifyouwanttoreinstallthemlater.
RequiredrebootOccurswhenremovingHDLPusingforceoptionorfiles/registrykeycouldnotberemoved.
MFERemovalperformscleanup.
Normalmode–Rebootoptionappearsinstatusbox.
Quietmode–MFERemoval100callsshutdown.
exewithatimespecified/t(defaultof10minutes).
Validtimefor/tare0-99.
/norebootcanbeusedtopreventanautomaticreboot.
RecommendedrebootOccurswhenservice/driverispendingareboot.
Normalmode–Rebootoptionappearsinstatusbox.
Quietmode–Noaction.
Note:/forcerebootand/norebootcommandlineswitcheswillbeoverwrittenbystatusboxpromptswhenrunlocally.
6TroubleshootingUsethestatusboxandlogfilestotroubleshooterrors.
SuccessanderrordeterminationWhentheapplicationcompletessuccessfully,adialogboxdisplayswiththefollowinginformation:TheresultsThepathtothelogfileRebootrecommendation(ifany)Also,theapplicationwritesagenericregistrykeythatcanbequeried.
Thekeyisdeletedatthestartofeachrun,andthenrewrittenwhentheprocessissuccessful.
Iftheregistrykeyismissing,youknowtherewasanerror.
LogsanddataTheMFERemoval100.
exetoolwritesdatatothefollowinglogs:Runtimelog–generatesto%SYSTEMROOT%\TEMP\McAfeelogs\Applet-YYYY.
MM.
DD–HH.
MM.
SS-[MFERemoval100.
exe].
txtEventlog–afterruntime,createsaWindowsApplicationEventLogentryfromsourceMFERemoval100.
exe.
EventIDs:o666–failureo777–successRegistrykeyTheregistrykeycanbefoundintheselocations,dependingonyourversionofWindows:X64HKEY_LOCAL_MACHINE\Software\Wow6432Node\MFERemovalX86HKEY_LOCAL_MACHINE\Software\MFERemovalRegistrykeyvalues:ValuenameFinishValuenameforeachproductremovedMAVSEHIPDLPENSDATRepTIEMDXLEIAMCPMARPAData17ActivityiconWhentheapplicationruns,theActivityicondisplaysintheWindowsNotificationArea.
ThisiconisawhiteIntellogoonabluebackground.
Thepurposeoftheiconistoindicatethattheapplicationisrunning.
FormoreinformationabouttheWindowsNotificationArea:http://msdn.
microsoft.
com/en-us/library/windows/desktop/aa511448.
aspxToviewtheWindowsNotificationArea:http://windows.
microsoft.
com/en-us/windows7/change-how-icons-appear-in-the-notification-areaReviewthelogfileWhentheprocesscompletessuccessfully,thelogreads:Exit:SuccessIfthismessageismissingfromthelog,youwillneedtocorrecttheerrororcontactyourIntelSecuritySupportrepresentative.
CommonerrorsYoucandiagnoseproblemsusingerrormessagesinthestatusboxorinthelogfile.
InvalidPassword.
Pleaseprovidepasswordasaswitch.
Example:MFERemoval.
exe/passabcde12345/passswitchwasprovidedanditwasincorrectIfthereisaspaceintheHIPpassword,usequotes:/pass"abcde12345"HIPSEnabled.
PleasedisableHIPsIPSandre-run.
OpenHIPclientUI,unlocktheGUI,anddisableIPS.
InePO,disableHostIPSviapolicyandpushdowntoclient.
Providepasswordviacommandlineswitch:/passabcde12345or/pass"abcde12345"VSEAPEnabled.
PleasedisableVSEAPandre-run.
OpenVSEConsoleanddisableAccessProtection.
InePO,disableVSEAPviapolicyandpushdowntoclient.
Failedtoinstallcertificate:4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5MFERemovaldependsonVerisignClass3PublicPrimaryCertificationAuthority–G5towork.
MFERemovalattemptedtoinstallacertificateandfailed.
Formoreinformation:https://kc.
mcafee.
com/corporate/indexpage=content&id=KB87096UnabletodisableprotectionMFERemovalwasunabletoestablishTrustwithMcAfeesoftware.
Otherreasons,includingfailedcertificateinstall.
ContactIntelSecuritysupport.
WorkaroundsTheseoptionsshouldonlybeusedasalastresort.
Youcanusethe/forceand/safemodeswitchestoremoveproductswhenyouencountererrors.
Alwaysusethe/allswitchwiththeseoptions.
Testtheseoptionsbeforeusingtheminamassdeployment/forceUse/forcetobypassallcheckandremoveallproducts.
McAfeerecommendsthisoption.
/force/all8Requiresareboot.
/safemodeUse/safemodetobootacomputerintosafemode,run,andthenrebootbackintonormalmode.
/safemode/allSafemodetroubleshootingDoesnotworkwithprebootauthentication.
RebootwouldleaveatPrebootscreentwice(oncetogointosafemodeandoncetobackintonormalmode)GPOcouldinterfereautologin–rebootwouldleaveatsafemodelog-inscreenhttps://technet.
microsoft.
com/en-us/magazine/ee872306.
aspxhttps://technet.
microsoft.
com/en-us/library/cc978776.
aspxGPOcouldaddbacklegalnoticecaption–wouldleaveatsafemodewaitingonaclickhttps://technet.
microsoft.
com/en-us/library/cc939712.
aspxDoesnotworkproperlyonDomainControllers.
Safemodeprocess1Createatempuserandaddittothelocaladmingroup.
2SettheOStobootintosafemode.
3Rebootafteroneminuteunless/tissettoanothertime.
4Bootintosafemode.
5RunMFERemoval100.
exe,deletetempuser,resetallsettings.
6Reboot.
7InNormalmode,deletetempuserprofile.
9ReinstallationofMcAfeeAgentIfMcAfeeAgentisoneoftheproductsthatisbeingremoved,thefollowingswitchescanbeusedtoreinstallMAaftertheremovaltooliscomplete.
Ifrebootiseitherrequiredorrecommended,theinstallofMAwillhappenontherestartofthesystem.
Note:ThetoolwillsetMAinstalltostart,itdoesnotguaranteethatitwillbesuccessful.
Alllogswillbeavailableinwindows\temp\mcafeelogs.
Useoneofthefollowingformatsandthetoolwillusethedefaultcommandlineof/install=agent/silenttoinstallframepkg.
exe.
Ifframepkg.
execannotbelocated,nothingwillhappen.
Refertothelogformoredetails.
/framepkgIfframepkg.
exeisinthesamedirectoryasthemferemovalbinary.
/framepkg="c:\pathtoframepkg.
exe"Iffilepathspecifiedisvalid.
Single(')ordouble(")quotescanbeusedaroundthepath.
YoucanspecifyacustompropforanewMAinstallation.
Onlyonecustompropcanbeused.
Ifmorethanoneisprovided,thelastinthelistwillbetheoneused.
Onlynumbers1-4areallowed.
Nospacesareallowedintheprovidedcustomprop.
Examples:1.
/customprops1AllDone2.
/customprops2mycustomprop3.
/customprops3MAcleaninstall4.
/customprops4MFERemovalRanOnIfotherframepkg.
execommandlineswitchesbeside/install=agent/silentandcustompropsareneeded,inadditiontothe/framepkgswitch,youcanyouadd:/framepkgcmd='thefullcommandlineparametersyouwouldliketopasstoframepkg'Note1:Singlequotes(')arerequiredatthestartandfinishofthiscommand.
Note2:Doesnotworkwith/custompropsswitch.
SeetheMcAfeeAgentProductGuideformoreinformationonframepkg.
exeinstallationquestions.
10MassdeploymentsYoucanupdatemorethanonecomputeratatime.
Toimplementamassdeploymentprocess,createacustomePOEndpointDeploymentKit(EEDK)packageanddeployitusingePO.
BeforeyoubeginEEDKpackagesarenotsupportedbyIntelSecuritysupport.
However,youcanvisittheMcAfeeCommunitysiteforinformationandsupport:https://community.
mcafee.
com/docs/DOC-3401ThecurrentversionofEEDKis9.
6.
1.
TaskCompletetheinitialsetup.
a.
Extractthezipfile.
b.
CreateanewfoldercalledBuild.
c.
RunEEDK.
exe.
d.
ClickTools|OptionandclickBrowse.
e.
SelectyourBuildfolderandclickSave.
CreatetheEEDKforMFERemoval100.
a.
SelectFile.
BrowsetoMFERemoval100.
exe.
b.
Specifythesoftwarepackageproperties.
11c.
ClickBuildPackage.
Astatusboxnotifiesyouwhenthenewzipiscreated.
ChecktheEEDKpackageintoePO.
a.
InePO,opentheMasterRepository.
b.
ClickCheckinPackage.
c.
Selectthepackagetype:ProductorUpdate(.
ZIP)d.
NexttoFilePath,clickBrowseandlocatetheEEDKpackage.
e.
ClickNext,choosethebranch,clickSave.
CreatetheclienttaskinePO.
a.
InePO,opentheClientTaskCatalog.
b.
SelectMcAfeeAgent.
c.
ClickNewTask.
d.
Selectthetasktype:ProductDeployment.
ClickOK.
e.
IntheTaskNamefield,enteraname.
f.
CompletetheoptionsforProductsandComponents.
Forexample,youcanaddaproductswitch:/vse.
ProductNameTypeaname.
Limitto8alphanumericcharacters.
ProductIDTypea4digitnumber.
ProductVersionTypetheversionnumber.
Use4digitsseparatedbyperiods.
ProductDescriptionEnterthedescriptionyouwanttoappearwhencreatingtheePOtask.
CommandtoRunEnterthenameoftheexecutablefile:MFERemoval100.
exe.
Note:IntelSecurityrecommendsusingcommandlineswitchesintheePOdeploymenttask.
AnyswitchthatyouuseisautomaticallyhardcodedandalwaysusedwhendeployedthroughePO.
Thismethodmakesiteasytoidentifytheproductsthatarebeingremovedbythetask.
ProductDetectionKeySpecifytheregistrylocationthatcontainstheProductDetectionKeyValue.
IntheEEDK,abbreviatethetop-levelkeylocations.
Forexample,HKEY_LOCAL_MACHINEisabbreviatedHKLM.
ProductDetectionKeyValueSpecifytheregistrykeyvalue.
Ifthiskeyvalueexistsonamachinethedeploymenttaskwillnotrun.
Thefieldcannotbeblank.
Scenario1:UsetheproductdetectionkeyMFERemovalandthenon-existentkeyvalueNew.
Because,thekeyvaluedoesnotexist,allcomputersareupdated.
Scenario2:UsetheproductdetectionkeyMFERemovalandthenon-existentkeyvalueFinish.
Because,thekeyvalueisalreadypresentoncomputersthathaveupdatedsuccessfully,onlycomputersthataremissingthekeyareupdated.
OSSupportSelectalloftheWindowsoperatingsystemsthatyousupport.
12Assignclienttasks.
CautionIncorrectlyassignedtaskscancausetheremovaltooltomakechangestoyourentirenetwork.
IfMcAfeeAgentisremoved,itmeansthatyourcomputersarenotprotectedbyePO.
IntelSecurityrecommendsassigningthetasktojustthenodesthatneedtoruntheremovalprocessorusingtag-basedclienttaskassignments.
CreateEEDKwithFramePkgYoucanalsocreatetheEEDKusingFramePkg.
exe.
Mostofthestepsarethesame.
UsingFramePkgallowsyoutoreinstallMcAfeeAgentaftersuccessfullyrunningamassdeployment.
BeforeyoubeginEachcustomerrequiresauniquecopyofframepkg.
exeYoumustuseoneofthefollowingMFERemoval100.
exeswitches:/MA,/ALL,or/SAFEMODETaskCompletetheinitialsetup.
a.
Createanewfolder.
b.
CopyMFERemoval100.
exeandFramepkg.
exetothenewfolder.
SetupEEDK.
a.
InEEDK,selectFolder.
b.
ClickBrowseandlocateyournewfolder.
c.
Specifythesoftwarepackageproperties.
ProductNameTypeaname.
Limitto8alphanumericcharacters.
ProductIDTypea4digitnumber.
ProductVersionTypetheversionnumber.
Use4digitsseparatedbyperiods.
ProductDescriptionEnterthedescriptionyouwanttoappearwhencreatingtheePOtask.
Forexample,MFERemovalwithMAinstall5.
03CommandtoRunEnterthenameoftheexecutablefile:MFERemoval100.
exe.
UsetheFramePkgswitches:/framepkg/framepkgcmd='cmdlineswitches'/customprops1MFERemovalRanOnForexample:MFERemoval.
exe/framepkg/customprops113MFERemovalRanOnProductDetectionKeySpecifytheregistrylocationthatcontainstheProductDetectionKeyValue.
IntheEEDK,abbreviatethetop-levelkeylocations.
Forexample,HKEY_LOCAL_MACHINEisabbreviatedHKLM.
ProductDetectionKeyValueSpecifytheregistrykeyvalue.
Ifthiskeyvalueexistsonamachinethedeploymenttaskwillnotrun.
Thefieldcannotbeblank.
Scenario1:UsetheproductdetectionkeyMFERemovalandthenon-existentkeyvalueNew.
Because,thekeyvaluedoesnotexist,allcomputersareupdated.
Scenario2:UsetheproductdetectionkeyMFERemovalandthenon-existentkeyvalueFinish.
Because,thekeyvalueisalreadypresentoncomputersthathaveupdatedsuccessfully,onlycomputersthataremissingthekeyareupdated.
OSSupportSelectalloftheWindowsoperatingsystemsthatyousupport.
d.
ClickBuildPackage.
Astatusboxnotifiesyouwhenthenewzipiscreated.
CheckinEEDKpackage.
CreatetheclienttaskinePO.
Assignclienttasks.
Afterthetaskrunssuccessfully,thecomputerrebootsandFramePkgattemptstoreinstallMA.
Ifthereisnoreboot,FramePkgwillrunautomatically.
NoteMFERemoval100cannotguaranteethereinstallationofMA.
Forallissues,contacttheappropriateMcAfeesupportteam.
Copyright2017McAfee,Inc.
www.
mcafee.
comMcAfeeandtheMcAfeelogoaretrademarks/registeredtrademarksofMcAfee,Inc.
Othernamesandbrandsmaybeclaimedasthepropertyofothers.
00-B
今天CloudCone发布了最新的消息,推送了几款特价独立服务器/杜甫产品,美国洛杉矶MC机房,分配100Mbps带宽不限流量,可以选择G口限制流量计划方案,存储分配的比较大,选择HDD硬盘的话2TB起,MC机房到大陆地区线路还不错,有需要美国特价独立服务器的朋友可以关注一下。CloudCone怎么样?CloudCone服务器好不好?CloudCone值不值得购买?CloudCone是一家成立于2...
物语云计算怎么样?物语云计算(MonogatariCloud)是一家成立于2016年的老牌国人商家,主营国内游戏高防独服业务,拥有多家机房资源,产品质量过硬,颇有一定口碑。本次带来的是特惠活动为美国洛杉矶Cera机房的不限流量大带宽VPS,去程直连回程4837,支持免费安装Windows系统。值得注意的是,物语云采用的虚拟化技术为Hyper-v,因此并不会超售超开。一、物语云官网点击此处进入物语云...
搬瓦工最新优惠码优惠码:BWH3HYATVBJW,节约6.58%,全场通用!搬瓦工关闭香港 PCCW 机房通知下面提炼一下邮件的关键信息,原文在最后面。香港 CN2 GIA 机房自从 2020 年上线以来,网络性能大幅提升,所有新订单都默认部署在香港 CN2 GIA 机房;目前可以免费迁移到香港 CN2 GIA 机房,在 KiwiVM 控制面板选择 HKHK_8 机房进行迁移即可,迁移会改变 IP...
legalnoticecaption为你推荐
支持ipadthinkphpthinkphp框架有什么功能及使用方法internalservererrorError 500--Internal Server Error 求教这个问题怎么解决?flashfxp用Flashfxp上传网站的具体步骤搜狗360没有登录过搜狗浏览器,只是用搜狗高速浏览器等QQ淘宝会有事情么360搜狗奇虎360到底是做什么的?波音737起飞爆胎一般的客机的起飞速度是多少?支付宝注册网站支付宝申请流程是怎么样的??加多宝与王老吉加多宝王老吉有什么区别吗?爱买网超谁有http://www.25j58.com爱网购吧网站简介?
com域名空间 如何申请域名 动态ip的vps 中国域名网 希网动态域名 securitycenter 香港服务器99idc inmotionhosting 256m内存 webhostingpad 10t等于多少g suspended godaddy 100x100头像 linux空间 世界测速 t云 免费私人服务器 双线机房 最漂亮的qq空间 更多