Monday, January 9, 2017

<< >>
> Start > Apps > Secure > LES

How I uninstalled Lumension Endpoint Security

I call this method directory based cause the programm will search folders like:
{DB824FCE-B760-4133-9AB3-B9454DC53939}
{E6DBE830-303F-47BB-8499-79662DDBF6FA}
And then compare every folder to keys under:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
If the key has been found then look for source files in that directory:

Full directory structure is:
└───msikeys
    │   silent-uninstall.cmd
    │   sleep.exe
    │   ticket.smt
    │
    ├───{DB824FCE-B760-4133-9AB3-B9454DC53939}
    │   ├───x64
    │   │       certif.opt
    │   │       Deploy.opt
    │   │       Deploy.txt
    │   │       LESClient64.msi
    │   │       LESClient64.mst
    │   │       setup.exe
    │   │       Setup.ini
    │   │       sigExt_4.6.0.428.xml
    │   │       sx-public.key
    │   │
    │   └───x86
    │           Deploy.opt
    │           Deploy.txt
    │           LESClient.msi
    │           LESClient.mst
    │           setup.exe
    │           Setup.ini
    │           sigExt_4.6.0.428.xml
    │           sx-public.key
    │
    └───{E6DBE830-303F-47BB-8499-79662DDBF6FA}
        ├───x64
        │       certif.opt
        │       Deploy.opt
        │       Deploy.txt
        │       LESClient64.msi
        │       LESClient64.mst
        │       sx-public.key
        │
        └───x86
                certif.opt
                Deploy.opt
                Deploy.txt
                LESClient.msi
                LESClient.mst
                sx-public.key
silent-uninstall.cmd
@echo off
setlocal EnableDelayedExpansion
set sw=HKLM\SOFTWARE
set u=Microsoft\Windows\CurrentVersion\Uninstall
for /f %%a in ('dir /b "\\pathto\msikeys" ^| find "{"') do (
reg query "%sw%\%u%\%%a" > nul 2>&1
if !errorlevel!==0 (
echo lumension detected under %%a
reg query "%sw%\%u%\%%a" /v DisplayVersion | find "DisplayVersion"
if exist "C:\Program Files\Lumension\Endpoint Security\Ticket" xcopy "%~dp0ticket.smt" "C:\Program Files\Lumension\Endpoint Security\Ticket" /Y
"%~dp0sleep.exe" 5
if not exist "C:\Program Files\Lumension\Endpoint Security\Ticket\ticket.smt" echo ticket has been eaten
if not "%ProgramFiles(x86)%"=="" %systemroot%\system32\msiexec.exe /X "%~dp0%%a\x64\LESClient64.msi" /qn /norestart
echo !errorlevel!
if "%ProgramFiles(x86)%"=="" %systemroot%\system32\msiexec.exe /X "%~dp0%%a\x86\LESClient.msi" /qn /norestart
echo !errorlevel!
goto restartRequired
)
)

:installNewVersionHere


:restartRequired

endlocal

0 comments:

Post a Comment