Remove ESET
products.

1#Requires -Version 5.12<#3.SYNOPSIS4Remove ESET security products, verify removal, then remove Management Agent.5Version 2.1.0. Windows PowerShell 5.1+, SYSTEM, N-central / NinjaOne.6.DESCRIPTION7Targets Endpoint Security, Endpoint Antivirus, Server Security (including8"for Microsoft Windows Server" / "for Windows Server"), and Management Agent.9Reads both registry views; never queries Win32_Product. Unrelated ESET products10are left installed and block agent removal to preserve their management.11All MSI calls use /qn /norestart REBOOT=ReallySuppress. No restart is scheduled.12A restart may still be required by ESET; 3010 is INCOMPLETE, never full success.13Agent removal requires security registrations and core services / ESET drivers to be absent,14with no pending security uninstall from this run or an earlier run this boot.15A small HKLM SYSTEM marker (shared across 32/64-bit hosts) preserves reboot/interrupted-operation state across runs.16The script does not delete drivers/files or bypass tamper/password protection.1718-UninstallPassword or ESET_UNINSTALL_PASSWORD: security product password.19-AgentUninstallPassword or ESET_AGENT_UNINSTALL_PASSWORD: agent password.20If the agent password is omitted, the security password is reused. Each product21is first tried WITHOUT a password. On MSI 1603, retry once with the supplied22password if present. 1603 is generic: it does not prove password protection.23Unprotected products can therefore succeed regardless of a supplied password.24Missing/wrong passwords on protected products still fail; protection is not bypassed.25Double quotes and control characters in passwords are unsupported.26Passwords are never printed. MSI command lines can be captured by privileged27monitoring or installer logging policy. Use protected RMM inputs, never source.2829Exit 0: verified targeted registrations/core services / ESET drivers absent, or detection only.30Exit 3010: restart required; no reboot performed; rerun after a planned restart.31Exit 1: validation failed, other ESET products present, or interrupted removal.32Exit 1460: MSI wait timeout; it may still be running. Do not launch a duplicate.33Other MSI failures retain their code (e.g. 1603, 1618).34Use a 150-minute RMM timeout for a device containing all four target products;35each password mode has a 15-minute MSI wait plus bounded busy retries;36validation waits up to 30s. Most devices have fewer products and finish sooner.37Pilot required: actual Windows/ESET removal has not been exercised here.38.EXAMPLE39.\Remove-EsetProducts.ps1 -DetectOnly40.EXAMPLE41.\Remove-EsetProducts.ps1 -UninstallPassword 'PRODUCT_PASSWORD' -AgentUninstallPassword 'AGENT_PASSWORD'42#>43[CmdletBinding()]44param(45    [Parameter(Position = 0)][AllowEmptyString()]46    [string]$UninstallPassword = $env:ESET_UNINSTALL_PASSWORD,47    [AllowEmptyString()]48    [string]$AgentUninstallPassword = $env:ESET_AGENT_UNINSTALL_PASSWORD,49    [switch]$DetectOnly50)51$ErrorActionPreference = 'Stop'52$script:StatePath = 'HKLM:\SYSTEM\Smilar\Scripts\EsetRemoval'53function Write-Status([string]$Message) {54    Write-Host ('[{0}] {1}' -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $Message)55}56function Get-EsetKind([string]$DisplayName) {57    switch -Regex ($DisplayName) {58        '^ESET (Endpoint Security|Endpoint Antivirus)$' { return 'Security' }59        '^ESET Server Security(?: for (?:Microsoft )?Windows Server)?$' { return 'Security' }60        '^ESET Management Agent$' { return 'Agent' }61        default { return 'Other' }62    }63}64function Get-EsetInventory {65    $views = @([Microsoft.Win32.RegistryView]::Registry32)66    if ([Environment]::Is64BitOperatingSystem) {67        $views += [Microsoft.Win32.RegistryView]::Registry6468    }69    $seen = @{}70    foreach ($view in $views) {71        $base = $null72        $uninstall = $null73        try {74            $base = [Microsoft.Win32.RegistryKey]::OpenBaseKey(75                [Microsoft.Win32.RegistryHive]::LocalMachine, $view)76            $uninstall = $base.OpenSubKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall')77            if ($null -eq $uninstall) { continue }78            foreach ($name in $uninstall.GetSubKeyNames()) {79                $key = $null80                try {81                    $key = $uninstall.OpenSubKey($name)82                    if ($null -eq $key) { continue }83                    $displayName = [string]$key.GetValue('DisplayName')84                    if ($displayName -notmatch '^ESET(?:\s|$)') { continue }85                    $kind = Get-EsetKind $displayName86                    if ([string]$key.GetValue('Publisher') -notmatch '^ESET(?:\b|,)') {87                        throw 'Unexpected publisher for an ESET entry.'88                    }89                    if ($kind -ne 'Other' -and $name -notmatch '^\{[0-9A-Fa-f]{8}-(?:[0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}\}$') {90                        throw 'ESET registration has no MSI product code. Manual review required.'91                    }92                    if (-not $seen.ContainsKey($name)) {93                        $seen[$name] = $true94                        [pscustomobject]@{95                            Name = $displayName96                            Kind = $kind97                            ProductCode = $name98                            Version = [string]$key.GetValue('DisplayVersion')99                        }100                    }101                } finally { if ($null -ne $key) { $key.Dispose() } }102            }103        } finally {104            if ($null -ne $uninstall) { $uninstall.Dispose() }105            if ($null -ne $base) { $base.Dispose() }106        }107    }108}109110function Test-SystemContext {111    return [Security.Principal.WindowsIdentity]::GetCurrent().IsSystem112}113function Get-CoreServices([string]$Stage) {114    # Query failure is fatal; it is never treated as an empty service list.115    $names = if ($Stage -eq 'Security') { @('ekrn', 'EhttpSrv') } else { @('ERAAgent') }116    @(Get-Service -ErrorAction Stop | Where-Object { $_.Name -in $names })117    if ($Stage -eq 'Security') {118        # Include registered ESET drivers even if stopped; never unload them.119        @(Get-CimInstance -ClassName Win32_SystemDriver -ErrorAction Stop |120            Where-Object { $_.DisplayName -match '^ESET(?:\s|$)' -or $_.PathName -match '\\ESET\\' })121    }122}123function Set-RemovalState([string]$Stage, [string]$Status, [string]$Boot) {124    $null = New-Item -Path $script:StatePath -Force125    # Write Status last; an incomplete marker is handled as an error next run.126    $null = New-ItemProperty -Path $script:StatePath -Name Stage -Value $Stage -PropertyType String -Force127    $null = New-ItemProperty -Path $script:StatePath -Name Boot -Value $Boot -PropertyType String -Force128    $null = New-ItemProperty -Path $script:StatePath -Name Status -Value $Status -PropertyType String -Force129}130function Clear-RemovalState {131    if (Test-Path $script:StatePath) { Remove-Item -Path $script:StatePath -Recurse -Force }132}133function Wait-StageAbsent([string]$Stage) {134    # Verification: exact target registrations plus core service registrations.135    for ($i = 0; $i -le 6; $i++) {136        $remaining = @(Get-EsetInventory | Where-Object { $_.Kind -eq $Stage })137        $services = @(Get-CoreServices $Stage)138        if ($remaining.Count -eq 0 -and $services.Count -eq 0) { return $true }139        if ($i -lt 6) { Start-Sleep -Seconds 5 }140    }141    return $false142}143function Invoke-EsetMsi($Product, [string]$Password) {144    $msiexec = Join-Path $env:WINDIR 'System32\msiexec.exe'145    if ([Environment]::Is64BitOperatingSystem -and -not [Environment]::Is64BitProcess) {146        $msiexec = Join-Path $env:WINDIR 'Sysnative\msiexec.exe'147    }148    $arguments = '/x {0} /qn /norestart REBOOT=ReallySuppress' -f $Product.ProductCode149    try {150        if (-not [string]::IsNullOrEmpty($Password)) {151            $quotedPassword = [regex]::Replace($Password, '(\\+)$', '$1$1')152            $arguments += ' PASSWORD="{0}"' -f $quotedPassword153        }154        for ($attempt = 1; $attempt -le 3; $attempt++) {155            Write-Status ('Uninstalling {0}; attempt {1}; restart suppressed.' -f $Product.Name, $attempt)156            $start = New-Object System.Diagnostics.ProcessStartInfo157            $start.FileName = $msiexec158            $start.Arguments = $arguments159            $start.UseShellExecute = $false160            $start.CreateNoWindow = $true161            # Avoid unnecessarily passing RMM password variables to the child.162            $start.EnvironmentVariables.Remove('ESET_UNINSTALL_PASSWORD')163            $start.EnvironmentVariables.Remove('ESET_AGENT_UNINSTALL_PASSWORD')164            $process = [System.Diagnostics.Process]::Start($start)165            $start.Arguments = ''166            try {167                if (-not $process.WaitForExit(900000)) { return 1460 }168                $code = $process.ExitCode169            } finally { $process.Dispose() }170            if ($code -ne 1618 -or $attempt -eq 3) { return $code }171            Write-Status 'Windows Installer busy (1618); retrying in 30 seconds.'172            Start-Sleep -Seconds 30173        }174    } finally { $Password = $null; $quotedPassword = $null; $arguments = $null }175}176function Invoke-Removal {177    if (-not (Test-SystemContext)) {178        Write-Status 'RESULT=ERROR; Select LocalSystem / SYSTEM as the RMM account.'179        return 1180    }181    # A global mutex prevents concurrent copies of this script on the device.182    $mutex = New-Object System.Threading.Mutex($false, 'Global\SmilarEsetRemoval')183    $locked = $false184    try {185        try { $locked = $mutex.WaitOne(0) }186        catch [System.Threading.AbandonedMutexException] { $locked = $true }187        if (-not $locked) { Write-Status 'RESULT=BUSY; Another copy is running.'; return 1618 }188        $inventory = @(Get-EsetInventory)189        foreach ($product in $inventory) {190            Write-Status ('DETECTED: {0} {1}; category={2}; product={3}' -f $product.Name, $product.Version, $product.Kind, $product.ProductCode)191        }192        $securityServices = @(Get-CoreServices 'Security')193        $agentServices = @(Get-CoreServices 'Agent')194        Write-Status ('CORE_COMPONENTS: security={0}; agent={1}' -f $securityServices.Count, $agentServices.Count)195        $state = if (Test-Path $script:StatePath) { Get-ItemProperty $script:StatePath } else { $null }196        if ($DetectOnly) {197            if ($null -ne $state) { Write-Status ('SAVED_STATE: {0}; stage={1}' -f $state.Status, $state.Stage) }198            Write-Status 'RESULT=DETECTED; Inventory complete. No uninstall or state changes made.'199            return 0200        }201        $boot = (Get-CimInstance -ClassName Win32_OperatingSystem -ErrorAction Stop).LastBootUpTime.ToUniversalTime().ToString('o')202        if ($null -ne $state) {203            if (-not $state.Boot -or $state.Stage -notin @('Security', 'Agent') -or $state.Status -notin @('InProgress', 'RebootRequired')) {204                Write-Status 'RESULT=ERROR; Incomplete saved removal state. Review the previous job before changing its HKLM marker.'205                return 1206            }207            if ($state.Boot -eq $boot) {208                if ($state.Status -eq 'RebootRequired') {209                    Write-Status 'RESULT=REBOOT_REQUIRED; Earlier removal is awaiting a planned restart. No further uninstall attempted.'210                    return 3010211                }212                Write-Status 'RESULT=INTERRUPTED; Earlier MSI may still be running. Review Windows Installer and the previous job before retrying. The HKLM state marker is documented on the script page.'213                return 1214            }215            # A restart has occurred. Re-inventory and verify normally below.216            Clear-RemovalState217        }218        foreach ($stage in @('Security', 'Agent')) {219            $inventory = @(Get-EsetInventory)220            if ($stage -eq 'Agent') {221                if (-not (Wait-StageAbsent 'Security')) {222                    Write-Status 'RESULT=VERIFICATION_FAILED; Security registration or core services / ESET drivers remain. Agent retained.'223                    return 1224                }225                if (@($inventory | Where-Object { $_.Kind -eq 'Other' }).Count -gt 0) {226                    Write-Status 'RESULT=OTHER_ESET_PRESENT; Unsupported ESET software remains. Agent retained; review detected products.'227                    return 1228                }229            }230            foreach ($product in @($inventory | Where-Object { $_.Kind -eq $stage })) {231                Set-RemovalState $stage 'InProgress' $boot232                $password = if ($stage -eq 'Agent') { $AgentUninstallPassword } else { $UninstallPassword }233                # Try without PASSWORD first, even when an RMM password is supplied.234                $code = Invoke-EsetMsi $product ''235                if ($code -eq 1603 -and -not [string]::IsNullOrEmpty($password)) {236                    Write-Status 'MSI_EXIT_CODE=1603 without password. This is a general failure; trying once with the supplied password.'237                    if ($password -match '["\x00-\x1F\x7F]') {238                        Clear-RemovalState239                        Write-Status 'RESULT=ERROR; Supplied password has unsupported characters. No password retry or further uninstall attempted.'240                        return 1241                    }242                    $code = Invoke-EsetMsi $product $password243                }244                $password = $null245                Write-Status ('MSI_EXIT_CODE={0}; product={1}' -f $code, $product.Name)246                if ($code -eq 3010 -or $code -eq 1641) {247                    Set-RemovalState $stage 'RebootRequired' $boot248                    Write-Status ('RESULT=REBOOT_REQUIRED; stage={0}; removal incomplete. No restart requested by this script. Rerun after a planned restart; agent removal is deferred if security is pending.' -f $stage)249                    if ($code -eq 1641) { Write-Status 'WARNING: MSI reported a restart initiated despite suppression. Review installer behaviour.' }250                    return 3010251                }252                if ($code -eq 1460) {253                    Write-Status 'RESULT=TIMEOUT; MSI may still be running. State retained; no installer killed and no further uninstall attempted.'254                    return 1460255                }256                if ($code -notin @(0, 1605, 1614)) {257                    Clear-RemovalState258                    Write-Status 'RESULT=FAILED; Check password/policy and Windows Installer events. No further uninstall attempted.'259                    return $code260                }261                # Recheck this exact product immediately; stage verification follows.262                if (@(Get-EsetInventory | Where-Object { $_.ProductCode -eq $product.ProductCode }).Count -gt 0) {263                    Clear-RemovalState264                    Write-Status 'RESULT=VERIFICATION_FAILED; Product registration remains. No further uninstall attempted.'265                    return 1266                }267                Clear-RemovalState268            }269            if (-not (Wait-StageAbsent $stage)) {270                Write-Status ('RESULT=VERIFICATION_FAILED; {0} registration or core services / ESET drivers remain. No further uninstall attempted.' -f $stage)271                return 1272            }273            Write-Status ('VERIFIED: {0} target registrations and core services / ESET drivers absent.' -f $stage)274        }275        # Catch security software reappearing during agent removal.276        if (@(Get-EsetInventory).Count -gt 0 -or @(Get-CoreServices 'Security').Count -gt 0 -or @(Get-CoreServices 'Agent').Count -gt 0) {277            Write-Status 'RESULT=VERIFICATION_FAILED; ESET software or core services / ESET drivers reappeared. Review deployment policies.'278            return 1279        }280        Write-Status 'RESULT=REMOVED_OR_ABSENT; Target registrations and core services / ESET drivers verified absent. No restart requested. This is not a forensic check for every residual file or driver.'281        return 0282    } finally {283        if ($locked) { $mutex.ReleaseMutex() }284        $mutex.Dispose()285    }286}287288try {289    if (-not $PSBoundParameters.ContainsKey('AgentUninstallPassword') -and $null -eq $env:ESET_AGENT_UNINSTALL_PASSWORD) {290        $AgentUninstallPassword = $UninstallPassword291    }292    $result = Invoke-Removal293    exit $result294} catch {295    # Process exceptions may contain passwords; do not print exception text.296    Write-Status 'RESULT=ERROR; Detection, MSI execution or validation failed. Agent removal was not continued. Review local Windows Installer events and any saved removal state.'297    exit 1298} finally {299    $UninstallPassword = $null; $AgentUninstallPassword = $null; $password = $null300}