System Center Endpoint Protection 2012 Removal

[DBrowning]

Does anyone have a script that can be run to remove SCEP from a System?

[curlyryan]

Inside the SCEP DMG there should be an Uninstaller.app. I've used it plenty of times when switching to another AV product and it has worked as it should as long as you reboot after using it.

[DBrowning]

@curlyryan I have seen that, but I want to do this silently with no interaction from the Users or my self. I've got about 1300 machines I need to switch over.

[curlyryan]

I never found a way to do that during our transition. Because SCEP I'm pretty sure installs some kext's, I don't know if there is a way around the reboot. We also went to another product that required a reboot as well so I was able to get both done without much concern from users.

[DBrowning]

The reboot I know I'm going to have to deal with but how are you running the .app without user interaction?

[donmontalvo]

Microsoft has a KB showing what process to kill and what folder to delete..

Wouldn't this do the trick?

#!/bin/bash

PROCESSES=("scep_gui")
APPLICATION="/Applications/System Center 2012 Endpoint Protection.app"

# Kill

for PROC in "${PROCESSES[@]}"; do
    RUNNING_PROCESSES=$(ps axc | grep -i "$PROC" | awk '{print $1}')
    if [[ $RUNNING_PROCESSES ]]; then
        echo "Found running process $PROC with PID: ${RUNNING_PROCESSES}. Killing it..."
        kill $RUNNING_PROCESSES
    else
        echo "$PROC not found running..."
    fi
done

# Remove
/bin/rm -rf "$APPLICATION"

exit 0

Gotta reboot the computer, as per the KB, but that can be put into the policy.

Stole the script from @mm2270 btw. :)

Don

[DBrowning]

modified the script:

#!/bin/sh

pkill scep*

sleep 10

rm -rf "/Applications/System Center 2012 Endpoint Protection.app"

[JustDeWon]

Modified

Disregard... I misread

[rkerce_ksu]

Modified the script again since its now EOL.

more info here: https://techcommunity.microsoft.com/t5/Configuration-Manager-Blog/End-of-Support-for-SCEP-for-Mac-and-SCEP-for-Linux-on-December/ba-p/286257

#!/bin/sh

pkill scep*

sleep 10

rm -rf "/Applications/System Center Endpoint Protection.app"

[ega]

At least for the latest version 4.5.x there is an uninstaller script that also gets the launch agents, launch daemons, and menu item
/Applications/System Center Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/unintall.sh

[SKIN]

@ega

That script needs to be ran elevated, how are you doing that? Sorry for the noob question.

[fishbackn]

@SKIN if it's run via Self Service or a scheduled JSS policy, it will be run as root. That's how I'm using it, and it works great.

[taugust04]

Running this script worked for me:

/Applications/System Center Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh

I received this output out of the Terminal:

System Center Endpoint Protection Version 4.5.32.0 Uninstall Script
This script will uninstall System Center Endpoint Protection 4.5.32.0.

Starting uninstallation procedure using '/Applications/System Center Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh'
Executing uninstaller tool 1...
Executing uninstaller tool 2...
Executing uninstaller tool 3...
Executing uninstaller tool 4...
Executing uninstaller tool 5...
Executing uninstaller tool 6...
Executing uninstaller tool 7...

Uninstallation finished successfully!

Enjoy! And thanks to JAMF Nation for bringing this topic up. I would have never known SCEP was end-of-life! I had checked the Microsoft support pages in September and there was no mention of this.

[davidhiggs]

You might have two versions in the wild (different app naming) so this should cover both

#!/bin/sh

#Look for SCEP 2012
if [ -e /Applications/System Center 2012 Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh ]; then
    echo "SCEP 2012 found, attempting removal"
    sudo sh /Applications/System Center 2012 Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh
else
    echo  "SCEP 2012 not found"
fi

#Look for SCEP
if [ -e /Applications/System Center Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh ]; then
    echo "SCEP found, attempting removal"
    sudo sh /Applications/System Center Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh
else
    echo  "SCEP not found"
fi

[senright]

Hey,

I went with a similar script to uninstall SCEP, however on about half of the ~30 machines I pushed it to showed a popup, any advice on how to make it silent? (this is on a mix of 10.13 and 10.14 machines, but I couldn't reproduce it on a few test machines)

The script I ran was:

#!/bin/bash
pkill scep*
sleep 10
/Applications/System Center Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh

Update: Just wanted to post a quick update in case other people run into this, you can temporarily disable the x32 notification, here is the script I am using now, I'm sure it could be improved, but seems to work okay [also thanks davidhiggs for the two version thing]:

#!/bin/bash

#Look for SCEP 2012
if [ -e /Applications/System Center 2012 Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh ]; then
    echo "SCEP 2012 found, attempting removal"
    #turning off 32bit warning
    sudo defaults write -g CSUIDisable32BitWarning -boolean TRUE
    #run uninstall script
    sudo sh /Applications/System Center 2012 Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh
    #turn 32 bit warning back on
    sudo defaults write -g CSUIDisable32BitWarning -boolean FALSE 

else
    echo  "SCEP 2012 not found"
fi

#Look for SCEP
if [ -e /Applications/System Center Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh ]; then
    echo "SCEP found, attempting removal"
    #turning off 32bit warning
    sudo defaults write -g CSUIDisable32BitWarning -boolean TRUE
    #run uninstall script    
    sudo sh /Applications/System Center Endpoint Protection.app/Contents/Helpers/Uninstaller.app/Contents/Scripts/uninstall.sh
    #turn 32 bit warning back on
    sudo defaults write -g CSUIDisable32BitWarning -boolean FALSE 

else
    echo  "SCEP not found"
fi