After silently uninstalling MSE using /x /s strings, Kaseya still displays it as conflicting software although it is not running and gone from the workstations. Any idea on how to fix this?
Did you run an audit after uninstalling MSE?
Run Latest Audit
Yes, I did.
ok run this below VBS file to affected machine manually ..it will show the result current list of AV product installed you can see if any conflict found ..if you found conflict you need run clean up
' to test on a remote system, set strComp = TheComputerNameOfTheRemoteSystem
' script will fail if you don't have permission to query the system
Dim strComp, iAVCount, iFWCount, iASCount, sAV, sFW, sAS, bXP
Dim objFSO, objFolder, objShell, objTextFile, objFile
Dim strDirectory, strFile, strText
strDirectory = "c:\logs3"
strFile = "\Summer.txt"
strText = "Book Another Holiday"
strComp = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComp & "\root\cimv2")
Set colOperatingSystems = objWMIService.ExecQuery ("Select * from Win32_OperatingSystem")
For Each objOperatingSystem in colOperatingSystems
if instr(objOperatingSystem.Caption, "XP") <> 0 then
call XPSub
bXP = True
else
call VistaSub
bXP = False
end if
Next
select case iAVCount
case 0
sAVMsg = "WARNING - No AntiVirus Product Detected!" & vbnewline & vbnewline
case 1
sAVMsg = "AntiVirus Product: " & sAV & vbnewline & vbnewline
case else
sAVMsg = "WARNING - " & iAVCount & " AntiVirus Products Detected:" & vbnewline & vbtab & sAV & vbnewline & vbnewline
end select
if bXP = False then
select case iASCount
sASMsg = "WARNING - No AntiSpyware Product Detected!" & vbnewline & vbnewline
sASMsg = "AntiSpyware Product: " & sAS & vbnewline & vbnewline
sASMsg = "WARNING - " & iASCount & " AntiSpyware Products Detected:" & vbnewline & vbtab & sAS & vbnewline & vbnewline
select case iFWCount
sFWMsg = "No 3rd Party Firewall Detected." & vbnewline & vbnewline
sFWMsg = "Firewall Product: " & sFW & vbnewline & vbnewline
sFWMsg = "WARNING - " & iFWCount & " Firewall Products Detected:" & vbnewline & vbtab & sFW & vbnewline & vbnewline
Msgbox sAVMsg & sASMsg & sFWMsg, , "Security Product Detection VBS by KITS"
Sub VistaSub
Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComp & "\root\SecurityCenter2")
Set colAVItems = oWMI.ExecQuery("Select * from AntiVirusProduct")
For Each objAntiVirusProduct In colAVItems
If LenB(objAntiVirusProduct.DisplayName) > 1 Then
sAVState = right(hex(objAntiVirusProduct.productstate), 4)
if left(sAVState, 1) = "1" then
sAVActive = "Enabled"
sAVActive = "Disabled"
if mid(sAVState, 3, 1) = "0" then
sAVCurrent = "Up to Date"
sAVCurrent = "Outdated!"
if lenb(sAV) < 1 then
' only one here
sAV = objAntiVirusProduct.DisplayName & " (" & sAVActive & ", " & sAVCurrent & ")"
iAVCount = 1
' multiple products end up here
sAV = sAV & vbnewline & vbtab & objAntiVirusProduct.DisplayName & " (" & sAVActive & ", " & sAVCurrent & ")"
iAVCount = iAVCount + 1
End if
Set colASItems = oWMI.ExecQuery("Select * from AntiSpywareProduct")
For Each objAntiSpywareProduct In colASItems
If LenB(objAntiSpywareProduct.DisplayName) > 1 Then
sASState = right(hex(objAntiSpywareProduct.productstate), 4)
if left(sASState, 1) = "1" then
sASActive = "Enabled"
sASActive = "Disabled"
if mid(sASState, 3, 1) = "0" then
sASCurrent = "Up to Date"
sASCurrent = "Outdated!"
if lenb(sAS) < 1 then
sAS = objAntiSpywareProduct.DisplayName & " (" & sASActive & ", " & sASCurrent & ")"
iASCount = 1
sAS = sAS & vbnewline & vbtab & objAntiSpywareProduct.DisplayName & " (" & sASActive & ", " & sASCurrent & ")"
iASCount = iASCount + 1
Set colFWItems = oWMI.ExecQuery("Select * from FirewallProduct")
For Each objFirewallProduct In colFWItems
If LenB(objFirewallProduct.DisplayName) > 1 Then
sFWState = right(hex(objFirewallProduct.productstate), 4)
if left(sFWState, 1) = "1" then
sFWActive = "Enabled"
sFWActive = "Disabled"
if lenb(sFW) < 1 then
sFW = objFirewallProduct.DisplayName & " (" & sFWActive & ")"
iFWCount = 1
sFW = sFW & vbnewline & vbtab & objFirewallProduct.DisplayName & " (" & sFWActive & ")"
iFWCount = iFWCount + 1
end sub
sub XPSub
Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComp & "\root\SecurityCenter")
if objAntiVirusProduct.onAccessScanningEnabled = True then
if objAntiVirusProduct.productUpToDate = true then
' only one antivirus here
iCount = 1
' multiple antivirus ends up here
sAV = sAV & vbnewline & objAntiVirusProduct.DisplayName & " (" & sAVActive & ", " & sAVCurrent & ")"
iCount = iCount + 1
if objFirewallProduct.enabled = True then
' multiple PRODUCTS end up here
Check Microsoft Security Center and see if MSE is still listed. If it's not then run a new baseline audit (warning you will lose the old baseline). Make sure you give it about 10 minutes to update the data. If you're still seeing a conflict then you can either a) enter a support ticket or b) ignore it since it's not there.
Need to run a baseline audit.
Looks like that was it, it needs a new baseline audit and not a latest audit. Thanks
I spoke too fast. It did clear for one test computer, but since, it hasn't cleared for others.
Looks like a baseline and then a latest does the trick.
The baseline should do it (I've also had success with only running a latest). Typically, you just have to wait long enough for the audit to complete and send the XML files to the KServer for processing. Regardless, glad it worked.