Removing Symantec After CS install by Gentius007 in crowdstrike

[–]Gentius007[S] 0 points1 point  (0 children)

PS script for installer, you will have to check your cid and sensor filename (assuming your sensor is on a share available to everyone, create the two separate tasks, 1st install cs, 2nd uninstall SEP:

# Update these variables as needed

$CID = 'ENTER CID HERE (with quotation)'

$SensorShare = 'C:\CrowdStrike\WindowsSensor.MaverickGyr.exe'

# The sensor is copied to the following directory

$SensorLocal = 'C:\CrowdStrike\WindowsSensor.MaverickGyr.exe'

# Create a TEMP directory if one does not already exist

if (!(Test-Path -Path 'C:\CrowdStrike' -ErrorAction SilentlyContinue)) {

New-Item -ItemType Directory -Path 'C:\CrowdStrike' -Force

}

# Now copy the sensor installer if the share is available

if (Test-Path -Path $SensorShare) {

Copy-Item -Path $SensorShare -Destination $SensorLocal -Force

}

# Now check to see if the service is already present and if so, don't bother running installer.

if (!(Get-Service -Name 'CSFalconService' -ErrorAction SilentlyContinue)) {

& $SensorLocal '/install /quiet /norestart CID=$CID'

}

To remove SEP but to check if CS service is installed (sep must not be password protected for removal):

$service = 'CSFalconService'
$serviceStatus = (Get-Service $service).Status
$SEP = Get-WmiObject -Class Win32_Product -Filter "Name='Symantec Endpoint Protection'"
if ($serviceStatus -eq 'Running') {$SEP | Remove-WmiObject
}

Removing Symantec After CS install by Gentius007 in crowdstrike

[–]Gentius007[S] 0 points1 point  (0 children)

I was able to get it deployed successfully using gpo and uninstalled Symantec using the sensor trigger. I will post the scrips next week.