Uninstall specific McAfee Endpoint Security modules

AVmcclint
Honored Contributor

I've got a situation where I need to temporarily uninstall the Stateful Firewall from McAfee Endpoint Security on a Mac for testing. I know the /usr/local/McAfee/uninstall EPM command will uninstall the entire suite, but I need to only remove the StatefulFirewall. I can't seem to find a guide anywhere that tells me what the trigger is for each module /usr/local/McAfee/uninstall xxx I saw a list many moons ago but I can't find it now to save my life. Can anyone point me in the right direction?

1 ACCEPTED SOLUTION

mm2270
Legendary Contributor III

Take a look at this thread. Second post has some options that are claimed to come from the official McAfee guide. I have not tried these myself, but it may work.
https://community.mcafee.com/thread/94272?start=0&tstart=0

If it's accurate, then ironically, the string to use is just "Firewall"

View solution in original post

11 REPLIES 11

mm2270
Legendary Contributor III

Take a look at this thread. Second post has some options that are claimed to come from the official McAfee guide. I have not tried these myself, but it may work.
https://community.mcafee.com/thread/94272?start=0&tstart=0

If it's accurate, then ironically, the string to use is just "Firewall"

AVmcclint
Honored Contributor

The relevant answer from that thread:

To remove... Use this command...

All modules sudo /usr/local/McAfee/uninstall EPM

Threat Prevention module sudo /usr/local/McAfee/uninstall ThreatPrevention
Firewall module sudo /usr/local/McAfee/uninstall Firewall
Web Control module sudo /usr/local/McAfee/uninstall WebControl

I don't know why my searches couldn't find that thread, but thanks @mm2270

donmontalvo
Esteemed Contributor II

a6e55cbc3968463abd04a36ac956a063

EDIT: Scroll down for the two commands needed to clean up McAfee's mess (thanks @mm2270 and @johnmcnair!).

Not surprised.

--
https://donmontalvo.com

mm2270
Legendary Contributor III

@donmontalvo Why aren't you also running the /Library/McAfee/cma/scripts/uninstall.sh script after running the EPM uninstall? That's what we do and it removes all that other cra... erh, cruft.
In fact, if you're brave enough to look at the script, you'll see it's just running a /Library/McAfee/agent/scripts/ma stop command, and then a whole bunch of rm -rf commands to remove all the files/folders. It also deletes the infamous mfe user account, although it's still using dscl commands where it really should be updated to use sysadminctl. But hey, McAfee will get around to updating that by 2026, don't you worry!

johnmcnair
New Contributor III

We ran a test and confirmed running these two commands in order through a policy does a complete uninstall.

/usr/local/McAfee/uninstall EPM
/Library/McAfee/cma/scripts/uninstall.sh

donmontalvo
Esteemed Contributor II

@mm2270 and @johnmcnair awesome, thanks for the heads up...I'll remove the script, since the work was already done and available to us:

/usr/local/McAfee/uninstall EPM
/Library/McAfee/cma/scripts/uninstall.sh
--
https://donmontalvo.com

AVmcclint
Honored Contributor

@donmontalvo aww man, I like that you posted your manual removal because there are MANY times when the uninstall EPM and uninstall.sh commands fail and the only option I have left is to manually seek out all the components. Could you please post your manual script again?

gachowski
Valued Contributor II

@AVmcclint @donmontalvo

Yep 100% please repost !!!

C

Warren
New Contributor II

The script works like a charm. Thanks to all who contributed.

c_archibald
Contributor II

/Library/McAfee/cma/scripts/uninstall.sh

resolves to

/Library/McAfee/agent/scripts/uninstall.sh

for us.

AVmcclint
Honored Contributor

I stumbled upon the original KB article that I found then lost again a long time ago. https://kc.mcafee.com/corporate/index?page=content&id=KB88461

It does list SOME of the components that you can manually remove. Other locations it fails to list are in /var/McAfee/ and /Library/Documentation/Help/ (not that that one really impacts functionality).