Uninstall specific McAfee Endpoint Security modules

[AVmcclint]

I've got a situation where I need to temporarily uninstall the Stateful Firewall from McAfee Endpoint Security on a Mac for testing. I know the /usr/local/McAfee/uninstall EPM command will uninstall the entire suite, but I need to only remove the StatefulFirewall. I can't seem to find a guide anywhere that tells me what the trigger is for each module /usr/local/McAfee/uninstall xxx I saw a list many moons ago but I can't find it now to save my life. Can anyone point me in the right direction?

[mm2270 · Accepted solution]

Take a look at this thread. Second post has some options that are claimed to come from the official McAfee guide. I have not tried these myself, but it may work.
https://community.mcafee.com/thread/94272?start=0&tstart=0

If it's accurate, then ironically, the string to use is just "Firewall"

[AVmcclint]

The relevant answer from that thread:

To remove... Use this command...

All modules sudo /usr/local/McAfee/uninstall EPM

Threat Prevention module sudo /usr/local/McAfee/uninstall ThreatPrevention
Firewall module sudo /usr/local/McAfee/uninstall Firewall
Web Control module sudo /usr/local/McAfee/uninstall WebControl

I don't know why my searches couldn't find that thread, but thanks @mm2270

[donmontalvo]

EDIT: Scroll down for the two commands needed to clean up McAfee's mess (thanks @mm2270 and @johnmcnair!).

Not surprised.

[mm2270]

@donmontalvo Why aren't you also running the /Library/McAfee/cma/scripts/uninstall.sh script after running the EPM uninstall? That's what we do and it removes all that other cra... erh, cruft.
In fact, if you're brave enough to look at the script, you'll see it's just running a /Library/McAfee/agent/scripts/ma stop command, and then a whole bunch of rm -rf commands to remove all the files/folders. It also deletes the infamous mfe user account, although it's still using dscl commands where it really should be updated to use sysadminctl. But hey, McAfee will get around to updating that by 2026, don't you worry!

[johnmcnair]

We ran a test and confirmed running these two commands in order through a policy does a complete uninstall.

/usr/local/McAfee/uninstall EPM
/Library/McAfee/cma/scripts/uninstall.sh

[donmontalvo]

@mm2270 and @johnmcnair awesome, thanks for the heads up...I'll remove the script, since the work was already done and available to us:

/usr/local/McAfee/uninstall EPM
/Library/McAfee/cma/scripts/uninstall.sh

[AVmcclint]

@donmontalvo aww man, I like that you posted your manual removal because there are MANY times when the uninstall EPM and uninstall.sh commands fail and the only option I have left is to manually seek out all the components. Could you please post your manual script again?

[gachowski]

@AVmcclint @donmontalvo

Yep 100% please repost !!!

C

[Warren]

The script works like a charm. Thanks to all who contributed.

[c_archibald]

/Library/McAfee/cma/scripts/uninstall.sh

resolves to

/Library/McAfee/agent/scripts/uninstall.sh

for us.

[AVmcclint]

I stumbled upon the original KB article that I found then lost again a long time ago. https://kc.mcafee.com/corporate/index?page=content&id=KB88461

It does list SOME of the components that you can manually remove. Other locations it fails to list are in /var/McAfee/ and /Library/Documentation/Help/ (not that that one really impacts functionality).