Removing ME agent 1

[Eyas]

Hello

I need to know how I remove the old ME agents from the clients in my network. Anyone got any tips? Our network is a mixed enviroment with all the major O/S from Microsoft.

TIA

Eyas

 

[AVDude]

Hi

The easiest way would be to use your ME to remove the agents.

If your ME server is gone you could use this logon script.


These files have not been developed or QAed by Network Associates. These files will not be supported by Network Associates Inc, or any of their subsidiaries.

LOGIN SCRIPT LOGIC FLOW

PART I: Check for Installed Operating System

Rem 1. Determine Operating System
if '%OS%' == 'Windows_NT' goto NTexit
if exist y:\*.* net use y: /del /yes
net use y: \\itc_backup_srvr\pcname /yes
choice /C:0 /N /T:0,3

if %windir%\command.com == %comspec% goto win9x
if %windir%\COMMAND.COM == %comspec% goto win9x
if C:\COMMAND.COM == %comspec% goto win9x
if c:\command.com == %comspec% goto win9x
Y:\reg query hklm\System\CurrentControlSet\control\ComputerName\ComputerName\ComputerName >> Y:\scrptfail.txt
goto OSexit


For Windows NT and Windows 2000 OS, there is an environment variable &quot;OS&quot; which contains the current operating system WINDOWS NT. This can be accessed from the command prompt and typing SET <Enter>

For Win9X OS, there is no available environment variable to get the operating system. As an alternative, the &quot;COMSPEC&quot; variable is used. The COMSPEC shows the command interpreter (COMMAND.COM) launched by the system. Windows NT does not use COMMAND.COM to start itself.

The usual COMSPEC variable is set to &quot;C:\WINDOWS\COMMAND.COM&quot;. In the script we have used %WINDIR%\COMMAND.COM and %WINDIR%\command.com to specify the COMMAND.COM in the windows directory of the PC.

%WINDIR% is a variable that gives the Windows Directory of the PC, usually C:\WINDOWS. The Windows Directory could vary depending on Installation. So at times the variable could be C:\WIN95 or some other directory.

In the script we now compare the %WINDIR%\COMMAND.COM and COMSPEC. If both would match, we could safely assume that the system is a WIN95/WIN98 PC.

Another line was added that compares &quot;C:\COMMAND.COM&quot; and the COMSPEC variable. Some installations of WIN9X (Win95 in particular) use the COMMAND.COM located at the root of the booting disk. This addition tries to capture these PCs, with an unstandard COMSPEC setting.

Hence, If the %OS% matches &quot;WINDOWS NT&quot; the script shows a brief message that the script is only designed to run on WIN9X machines, the terminates the script.

If the %COMPSEC% matches any of the three options, %WINDIR%\COMMAND.COM, %WINDIR%\command.com or C:\COMMAND.COM the script jumps to the second part of the script to check for Management Edition or ePO Agent Installations.

Before checking for ePO and Management Agent installation, it writes the PC name to a file which contains all PCs where the login script has run. The file is named “runscrpt.txt”. The file is found \\ITC_BACKUP_SRVR\PCNAME share mapped to drive Y:


Rem Any machines running this logon script will get written to runscrpt.txt
Y:\reg query hklm\System\CurrentControlSet\control\ComputerName\ComputerName\ComputerName >> Y:\runscrpt.txt

If the PC falls through (fails) all the set logic statements, it writes the PC name to a file &quot;scrptfail.txt&quot; as a measure to see if any additional logic statements have to be considered.

The failscript.txt is located at the \\ITC_BACKUP_SRVR\PCNAME share. A drive map to &quot;Y:&quot; was created prior to checking for WIN95 Operating system using the NET USE command.

PART II: Check if Management Edition Agent is installed on the PC.

Rem Now check to see if NTME directory exists
if exist %windir%\ntme\*.* goto checkagent

If ePO Agent has not yet been installed on the PC, the script now checks if the Management Edition Agent has been installed on the PC. This is done by checking if the %WINDIR%\NTMEdirectory exists on the machine.

If the specified directory exists, the system now has two logic statements that have to be processed. First, is to check if the file &quot;AGENT.RIP&quot; already exists on the %WINDIR%\NTME directory. The other statement, which is processed if the &quot;AGENT.RIP&quot; file does not exist on the computer, removes that Management Edition Agent from the machine's registry.

The AGENT.RIP file is a &quot;FLAG&quot; created by the script to indicate that the Management Edition Agent has already been removed from the registry and is safe to delete the %WINDIR%\NTME Directory.


PART III: Check if ePO Agent is already installed

Rem If NTME directory does not exist check the agent is installed
if exist c:\epoagent\aginst32.exe goto Agexit

Rem If NTME directory does not exist check the agent is installed
if exist c:\epoagent\aginst32.exe goto AGexit


Once the system is determined to be WIN9X, it now checks if the ePO agent is already installed in the machine. This is done by checking is the C:\ePOAgent\aginst32.EXE file is existing on the local drive C:

If the specified file is existing, it routes the logic flow to another section of the script which shows a brief message that ePO was already installed and adds the PC name to a text file containing all PCs where the ePO was already installed.

If the specified file does not exist, it then checks is the Management Edition Agent is installed on the system.


PART IV: Check if AGENT.RIP exist on the computer

:checkagent
Rem 5. If agent.rip exists tidy up NTME dir
if exist %windir%\ntme\agent.rip goto delNTMEdir

:delNTMEdir
Rem 6. Delete the NTME directory
deltree /y %windir%\ntme
Rem Then install the ePO agent
goto instepo

If %WINDIR%\NTME\AGENT.RIP exists on the computer, it now proceeds to delete the %WINDIR%\NTME directory using the DELTREE command.

Once the directory is deleted, it then proceeds to install the ePO Agent.

PART V: Remove Management Edition Agent from Computer

:killme
Rem 7. At this point we assume the agent is active and kill it
Rem and add a flag
echo Removing Management Agent from Registry - please wait
y:\reg.exe delete &quot;hklm\software\microsoft\windows\currentversion\runservices\network associates man agent&quot; /force

Rem Now write a flag file to the NTME directory
echo Agent_Dead >> %windir%\ntme\agent.rip

Rem All machines where the ME agent has been removed are written to agentrm.txt
Y:\reg query hklm\System\CurrentControlSet\control\ComputerName\ComputerName\ComputerName >> Y:\agentrm.txt

goto MEexit

If the %WINDIR%\NTME\AGENT.RIP does not exist on the computer, it checks if the Management Edition Agent is installed on the PC. THis is done by checking if any file on %WINDIR%\NTME exist (IF EXIST %WINDIR%\NTME\*.*). If this exist, it is assumed that the Management Edition is installed.

It then proceeds to uninstall the Management Edition by running the REG.EXE utility.

The REG.EXE utility is found in the NT Resource Kit. This allows you to query, add or delete registry settings from the command line. The REG.EXE is currently installed on the \\ITC_BACKUP_SRVR\PCNAME Share which was previously mapped to drive Y:

The Registry Key that is removed from the computers registry is:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Network Associates Man Agent

This is done by the command:

REG DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Network Associates Man Agent

The AGENT.RIP file is then created by the command:

Rem Now write a flag file to the NTME directory
echo Agent_Dead >> %windir%\ntme\agent.rip

This is to inform the script on its next run, that the Management Edition Agent has already been removed from the registry and %windir%\NTME directory is safe for deletion.

Once the Registry is deleted, the computer is required to do a reboot/restart.

Rem All machines where the ME agent has been removed are written to agentrm.txt
Y:\reg query hklm\System\CurrentControlSet\control\ComputerName\ComputerName\ComputerName >> Y:\agentrm.txt

Prior to exit of the script, the pc name is written to the “agentrm.txt” file which contains all computers where the Management Edition agent has been removed by the script.

The user is then prompted to do a restart.

PART VI: Install ePO Agent

Rem If the NTME directory does not exist
Rem & ePO agent is not installed, run the agent
goto instepo

:instepo
Rem 8. Install the ePO agent
echo Installing epo agent...
y:\mstart.exe /WAIT &quot;y:\poaginst.exe&quot;
y:\mstart.exe /WAIT &quot;z:\instmsi.exe&quot;

Once the NTME Directory is deleted (DELTREE %WINDIR\NTME), The ePO Agent is now installed on the computer.

The ePO Agent Installation program (POAGINST.EXE) is located at the \\ITC_BACLUP_SRVR\PCNAME Share.

A program MSTART.EXE is used to launch the POAGINST.EXE from within the login script. The MSTART program was included to insure that the POAGINST has started to run before it proceeds to the next command in the login script. This was added since previous versions of the script caused KERNEL32 and POAGINST errors since the login script command was already terminated/closed, while the login script command windows was still calling the POAGINST. The MSTART introduces a delay or wait with the /WAIT switch to the program.

After running the POAGINST.EXE (ePO Agent Installation) another program is executed. This program is the latest Microsoft Windows Installer (INSTMSI.EXE). This Installs some updated drivers/dlls into the system required by VirusScan 4.5 prior to installation.

The INSTMSI was included into the script as a solution to some PCs experiencing a BLUE SCREEN error on the Windows VMM.VXD module at memory address 0059AC. This PCs has the ePO agent installed by no Anti-Virus. The inclusion in the login script will try to eliminate or if not minimize the Blue Screens.

The INSTMSI could be downloaded from:

http://download.microsoft.com/download/platformsdk/wininst/1.1/W9X/EN-US/InstMsi.exe

During the INSTMSI installation, there may be cases that the system would prompt that an previous installation was not completed by a user. Just have the user click on continue. The previous installation was initiated by the ePO Management Console.

The POAGINST.EXE does not require the user to reboot the system.
The INSTMSI.EXE normally does not require a reboot, but may require in some cases.

After Installation of the ePO Agent, the script now writes to a file (“aginst.TXT”) on the \\ITC-BACKUP_SRVR\PCNAME Share the computer name as a means of tracking the ePO agent installations.










Script File: dmlogin23032.bat (edited as of 28 March 2001)

@echo off
Rem ************************************************************************************
Rem * *
Rem * Management Agent Removal & ePO Agent Installation Script for Windows 9x *
Rem * *
Rem * Version 3 - Written by Jason Brown, (Jason_Brown@NAI.com) 20 March 2001 *
Rem * *
Rem ************************************************************************************
Rem * *
Rem ************************************************************************************
Rem * *
Rem 1. Determine Operating System
Rem ? = Win95 -> 2 ? = other -> 9
Rem * *
Rem 2. Determine if epo agent directory exists
Rem ? = Yes -> 9 ? = No -> 3
Rem * *
Rem 3. If meupw95 exists then check ME agent already flagged for delete
Rem ? = Yes -> 5 ? = No -> 4
Rem * *
Rem 4. ME Agent not running, so check for NTME dir & install the epo agent
Rem ? = Yes -> 6 ? = No -> 8
Rem * *
Rem 5. If agent.rip exists tidy up NTME dir
Rem ? = Yes -> 6 ? = No -> 7
Rem * *
Rem 6. Delete the NTME directory
Rem -> 8
Rem * *
Rem 7. At this point we assume the agent is active and kill it and add a flag
Rem -> 9
Rem * *
Rem 8. Install the ePO agent
Rem -> 9
Rem * *
Rem 9. Exit the script
Rem * *
Rem ************************************************************************************

Rem 1. Determine Operating System
if '%OS%' == 'Windows_NT' goto NTexit
if exist y:\*.* net use y: /del /yes
net use y: \\itc_backup_srvr\pcname /yes
choice /C:0 /N /T:0,3

if %windir%\command.com == %comspec% goto win9x
if %windir%\COMMAND.COM == %comspec% goto win9x
if C:\COMMAND.COM == %comspec% goto win9x
if c:\command.com == %comspec% goto win9x
Y:\reg query hklm\System\CurrentControlSet\control\ComputerName\ComputerName\ComputerName >> Y:\scrptfail.txt
goto OSexit

Rem 2. Map a drive & write the pc name to a file
:Win9x

Rem Any machines running this logon script will get written to runscrpt.txt
Y:\reg query hklm\System\CurrentControlSet\control\ComputerName\ComputerName\ComputerName >> Y:\runscrpt.txt

Rem Now check to see if NTME directory exists
if exist %windir%\ntme\*.* goto checkagent

Rem If NTME directory does not exist check the agent is installed
if exist c:\epoagent\aginst32.exe goto AGexit

Rem If the NTME directory does not exist
Rem & ePO agent is not installed, run the agent
goto instepo

:checkagent
Rem 5. If agent.rip exists tidy up NTME dir
if exist %windir%\ntme\agent.rip goto delNTMEdir

Rem otherwise kill me agent
goto killme

:delNTMEdir
Rem 6. Delete the NTME directory
deltree /y %windir%\ntme
Rem Then install the ePO agent
goto instepo

:killme
Rem 7. At this point we assume the agent is active and kill it
Rem and add a flag
echo Removing Management Agent from Registry - please wait
y:\reg.exe delete &quot;hklm\software\microsoft\windows\currentversion\runservices\network associates man agent&quot; /force

Rem Now write a flag file to the NTME directory
echo Agent_Dead >> %windir%\ntme\agent.rip

Rem All machines where the ME agent has been removed are written to agentrm.txt
Y:\reg query hklm\System\CurrentControlSet\control\ComputerName\ComputerName\ComputerName >> Y:\agentrm.txt

goto MEexit


:instepo
Rem 8. Install the ePO agent
echo Installing epo agent...
y:\mstart.exe /WAIT &quot;y:\poaginst.exe&quot;
y:\mstart.exe /WAIT &quot;z:\instmsi.exe&quot;

Rem All machines where the ePO agent has been installed are
Rem written to aginst.txt
Y:\reg query hklm\System\CurrentControlSet\control\ComputerName\ComputerName\ComputerName >> Y:\aginst.txt

goto exit_script

:MEexit
echo ****************************************************
echo.
Echo Anti-Virus Update
Echo.
echo This machine now requires a reboot.
echo.
echo Please reboot your machine now.
echo.
echo ****************************************************
pause
goto exit_script

:INexit
echo The ePo agent has just been installed!
goto exit_script

:NTexit
echo The operating system is NT, this script only installs to Win9x machines
goto exit_script

:AGexit
echo The ePO agent is already installed
Rem Any machines already with the ePO agent running will get written to epoagonpc.txt
Y:\reg query hklm\System\CurrentControlSet\control\ComputerName\ComputerName\ComputerName >> Y:\epoagonpc.txt
goto exit_script

:OSexit
echo Could not recognise the operating system
goto exit_script

:exit_script
Rem 9. Exit the script
@if exist y:\*.* net use y: /del /yes
echo exiting script...
exit



Cheers
AVDude