/ / How to uninstall mcafee agent via command line

How to uninstall mcafee agent via command line?


Mcafee VirusScan Enterprise or Intel Enterprise End Point protection command line reference.

Some common tasks we are frequently asked about are command line options for several Intel and McAfee security products so we have complied a small list of some of the most often used commands for viewing or controlling these products.

Red text = command Blue text = output displayed after running command.

Viewing Virus Definition, Engine or date Status via command line:

reg query “HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMcAfeeAVEngine” /v “AVDatVersion”

AVDatVersion REG_DWORD 0x2343

(Only displays in hex and not decimal format, if you would like to get a report of the actual Dat version in the display gui version try this none admin required PowerShell command,

Get-ItemProperty -Path HKLM:SOFTWAREWOW6432NodeMcAfeeAVEngine

DAT : c:Program Files (x86)Common FilesMcAfeeEngine
szInstallDir64 : c:Program Files (x86)Common FilesMcAfeeEnginex64
szInstallDir32 : c:Program Files (x86)Common FilesMcAfeeEngine
EngineVersionMajor : 5900
EngineVersionMinor : 7806
AVDatVersion : 9028
AVDatDate : 2018/09/26
TrjDatDate :
PUPDatDate :
EngineVersion32Major : 5900
EngineVersion32Minor : 7806
AVDatVersionMinor : 0
AVDatDateSys : <226, 7, 9, 0…>
TrjDatVersion : 0 PUPDatVersion : 0
EngineVersion64Major : 5900
EngineVersion64Minor : 7806

If you are looking for a smaller report you can add the specific subkey name, here is an example,

Get-ItemProperty -Path HKLM:SOFTWAREWOW6432NodeMcAfeeAVEngine -name AVDatVersion

Viewing Agent Status via command line:

These list possible paths to the cmdagent.exe file and if ran with the /p switch it tells the agent to checkin to ePO server right away
if you read the response after running the command it will also state if it is in managed or unmanaged mode.

“c:program filesmcafeeagentcmdagent.exe” /p
“C:Program Files (x86)McAfeeCommon Frameworkcmdagent.exe” /p
“C:Program FilesNetwork AssociatesCommon FrameworkCmdAgent.exe” /P

2018-09-26 14:02:07.294 cmdagent(4988.7936) cmdagent.Info: Agent is running in unmanaged mode.

Deploying or installing via command line:

c:VSinstallsetupvse.exe /passive
c:VSinstallePOFramePkg.exe /install=agent /silent

McAfee Interceptor installer
msiexec /i c:VSinstallInterceptor_x64.msi /passive

Removing or uninstalling via command line:

Occationally things are not as they should be and normal uninstall tactics do not work but here is one command often used they might be ran first before any other removal can be successful

“C:Program Files McAfeeAgentmaconfig.exe” -provision -unmanaged (Then uninstall normally, this issue is most often related to ePO based agents. This command places the install in un- managed mode)

Normal removal command examples follow,

McAfee product improvement:
MsiExec.exe /x /passive /norestart

McAfee 8.8 agent included with virusscan:
MsiExec.exe /X /QN

McAfee 8.8, p2 and up:
MsiExec.exe /X /passive /norestart

McAfee Interceptor removal
msiexec /x c:VSinstallInterceptor_x64.msi /passive

Agent removal via command line:

Comment on
reload, if the code cannot be seen