Can’t remove System Center 2012 Endpoint Protection client (it just keeps reinstalling)

Even after removing all traces of System Center 2012 from our AD network, when I uninstalled the client software from each user system, within a few hours (or post a reboot) the software would mysterious regenerate and come back. Simply uninstalling the client is not enough. Here’s what you need to do.

Working on the assumption you are using Windows 7, go in to control panel and select Programs and Features. Uninstall:

System Center 2012 Endpoint Protection Client.
Windows Firewall Configuration Provider

Having done this, load up the command line (cmd) with administrative priviledges (search for and right click to get this option). Then type in the following commands at the prompt:

cd c:\windows\ccmsetup
ccmsetup /uninstall

The cursor will just return without any confirmation of completion. I found it took up to 10 minutes for the uninstall to release a lock on the setup files (and presumably possibly this long to actually carry out the uninstall). So after 10 mins, close the command line window, and do a search for %windir%. In that very folder, you should find two folders CCM and ccmsetup. Highlight and delete them. You should be prompted for admin authorisation, and then (if the uninstall is truly complete) you should see them delete. Otherwise, try to repeat deletion after a few more mins. If you see a folder called ccmcache the uninstallation is definitely still running.

After this, reboot your PC, and you should finally be free of the System Center 2012 Endpoint Protection client (assuming you haven’t set it up to reinstall by Group Policy or an Active System Center server).

12 thoughts on “Can’t remove System Center 2012 Endpoint Protection client (it just keeps reinstalling)”

  1. Are you crazy? You recommend to UNINSTALL SCCM CLIENT from user’s workstations.. EXCELENT..

    Please don’t run:
    ccmsetup /uninstall

    1. No I am not crazy. There are legitimate reasons for why you might need to remove this software (as is the case with any application). In this instance, I was trialling the System Center Endpoint Protection system, and decided it wasn’t the best fit for us. It took a massive amount of effort to stop it regenerating and installing on client workstations despite conventional removal attempts, and even after removal of traces of it within AD. FYI I rolled out Avast in its place the moment I was truly successful in its removal (which was also in the middle of the night).

      Having dealt with such a challenge, I did the decent thing and shared it on my blog. I can scarcely remember the project now. Please don’t come to conclusions without considering the facts!

      1. The reason it kept re-installing is because a SCEP enabled custom client settings is being deployed to a collection that has that system in it and you simply need to stop deploying that client setting to that collection.

        1. Thanks, Ron. I can’t verify that being the case (haven’t run even a trial of SCCM in 4 years), but have approved your comment anyway in case it helps out someone else. Cheers for sharing!

        2. Thinking about it, it’s a super vague memory, but I think I did attempt what you’ve outlined. I wonder whether there was something corrupted in our specific given setup that required a more extreme resolution. I remember trying to use every method I could possibly find and people suggested on at the time, and nothing worked. After 2 weeks, I had to find a way… Hopefully what you’ve suggested will work for others though. Cheers!

      2. Thanks, mutterances. We also ended up changing anti-virus options in midstream like you and had issues with it reinstalling.

        1. No worries – glad to help. And thanks for the positive feedback – it seems there is a lot of hate / trollers for me on this post! It’s such a vague memory now dealing with this issue, and I just recall the SCCM client, only installed on a trial basis, being extremely problematic removing from our setup. Glad to have helped :-)

      3. Just because you’re looking to remove the software doesn’t mean you’re looking to remove it permanently, I’m a case example of temporarily wanting to remove it to debug something.

        I’m grateful this information is shared. Thank you

      4. To be clear to anyone reading this post, I did state:

        “Even after removing all traces of System Center 2012 from our AD network”

        at the beginning of my article. I thought this made it clear enough that I was completely binning all elements of System Centre in its utter completeness from our network, not just one part of it. I would not advocate you remove the SCCM client if you are using any other element of System Centre on your network that you want to retain.

        I’ve had some fairly curt / unpleasent comments regarding this post (most of which I haven’t posted) – so felt it best to reassert the above, and remind everyone that our context was a trial of System Centre for one specific purpose, that didn’t work for us. After using every method I could possibly find to remove whatever had been implemented that we no longer needed, this was the only thing that worked. It was 4 years ago, and if there was a better way to have handled it (quite probably was), I could not find that information anywhere at the time, back in 2012. I barely remember the project now! Cheers all, hope that straightens the record for some of the haters, and some of the nice people too who think I could have done better :-)

    2. I needed this and it worked, the local install was corrupted and was fighting Symantec EndPoint Protection.

Comments are closed.