removing endpoint protection

Question

_{Tuesday, December 13, 2016 3:22 PM}

Hi,

A while ago our institution was setup with System Center for it's endpoint protection.  We are no longer using End point protection and the server is gone.

when we recently noticed that End point protection keeps re-installing itself on our servers (which makes the other AV product not work quite right).  I figured it was being installed from a group policy, but i cannot see anything in any of the policies under software installation.

Does anyone know how this product is continuing to install itself?  and how do i stop it?

thanks

All replies (5)

_{Tuesday, December 13, 2016 3:38 PM ✅Answered}

> System Center for it's endpoint protection

> End point protection and the server is gone.

If you set up System Center Configuration Manager and deployed it's client, the client will keep enforcing the last policy that it knows about - which may have been to install the SCEP agent.  Check the control panel for a "Configuration Manager" applet. If it's there, then that is likely the thing that is installing the SCEP agent. If the server is gone, you could uninstall the client from an elevated command prompt by running:

C:\windows\ccmsetup\ccmsetup.exe /uninstall

> but where in the group policy is that setting 

If SCCM was used to deploy SCEP, then it is unlikely Group Policy directly would have deployed it. However, sometimes organizations use Group Policy to deploy the SCCM client. Check for a computer startup script or MSI deployment.

I hope that helps,

Nash

Nash Pherson, Senior Systems Consultant
Now Micro - My Blog Posts
If you found a bug or want the product to work differently, share your feedback.
<-- If this post was helpful, please click the up arrow or propose as answer.

_{Tuesday, December 13, 2016 3:27 PM}

Does your client policy for these device have Install Endpoint still enabled?

_{Tuesday, December 13, 2016 3:31 PM}

forgive my ignorance, but where in the group policy is that setting - so i can quickly check?

thanks

_{Tuesday, December 13, 2016 3:46 PM}

removing the config manager seems to have worked - i will see if the software returns mysteriously later today.

thanks!

_{Tuesday, December 13, 2016 3:54 PM}

Are you removing SCCM or simply the Endpoint Protection?  Running the uninstall for the client will remove the SCCM client functionality and depending on your setup this will be installed again.

If you are keeping SCCM check the SCCM Client Policy "Install Endpoint Protection on Client Computers" is set to no and the "Automatically remove previous  antimalware software before Endpoint Protection is installed" is also no.