Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need a way to remove MSFT Security Essentials so that I can install Forefront on the clients. I would prefer a login script that would pass administrator credentials to remove the program. If that's not possible, then a script that I can run at boot time is acceptable.

I have the following PS script that someone else supplied from the webs, but I get an error when running it.

$UninstallString = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | ?{$_.GetValue("DisplayName") -like "Microsoft Security Essentials" } | ForEach-Object -Process {$_.GetValue("UninstallString") }
$uninstallParam='/' + $UninstallString.split('/')[1].Trim()
& $uninstallCmd $uninstallParam $uninstallParamSilent

When run as is (even though I know it looks wrong) I get the following error:

Method invocation failed because [System.Object[]] doesn't contain a method named 'split'.
At C:\Users\administrator\Desktop\remove Security essentials.ps1:2 char:37
+ $uninstallCmd=$UninstallString.split <<<< ('/')[0].Trim()
    + CategoryInfo          : InvalidOperation: (split:String) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

Method invocation failed because [System.Object[]] doesn't contain a method named 'split'.
At C:\Users\administrator\Desktop\remove Security essentials.ps1:3 char:45
+ $uninstallParam='/' + $UninstallString.split <<<< ('/')[1].Trim()
    + CategoryInfo          : InvalidOperation: (split:String) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

The expression after '&' in a pipeline element produced an invalid object. It must result in a command name, script blo
ck or CommandInfo object.
At C:\Users\administrator\Desktop\remove Security essentials.ps1:5 char:2
+ & <<<<  $uninstallCmd $uninstallParam $uninstallParamSilent
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException

Moving the last line into the preceding one also nets an error:

Unexpected token '&' in expression or statement.
At C:\Users\administrator\Desktop\remove Security essentials.ps1:4 char:29
+ $uninstallParamSilent="/s" & <<<<  $uninstallCmd $uninstallParam $uninstallParamSilent
    + CategoryInfo          : ParserError: (&:String) [], ParseException
    + FullyQualifiedErrorId : UnexpectedToken

I don't know enough about PS to see where the code is wrong, but any help would be appreciated.

Also, if someone has something that would work on this on both XP and Win7 without having to install PS on the XP machines that would be great too.

share|improve this question
up vote 2 down vote accepted

It looks to me like you've got more than one product being returned by the Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | ?{$_.GetValue("DisplayName") -like "Microsoft Security Essentials" } cmdlet, and your script it falling over because it only expects one.

Try this modified script which loops over each returned object and executes the uninstall command for the product. I've also changed the /s switch on msiexec to /quiet as that looks to be compatible with more versions of Windows.

$UninstallString = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | ?{$_.GetValue("DisplayName") -like "Microsoft Security Essentials" } | ForEach-Object -Process {$_.GetValue("UninstallString") }

foreach($ThisProduct in $UninstallString)
    $UninstallCmd = $ThisProduct.split('/')[0].Trim() 
    $UninstallParam = '/' + $ThisProduct.split('/')[1].Trim()
    $UninstallParamQuiet = "/quiet"

    & $UninstallCmd $UninstallParam $UninstallParamQuiet

Disclaimer: This answer comes after an awful lot of back and forth in chat to determine the real problem that more than one item was being returned by one of the PowerShell commands.

share|improve this answer
I'll do some testing on this tomorrow and get back with final results – Holocryptic Apr 6 '11 at 1:34
Okay. The script works on both XP and 7 with the /s switch. /quiet doesn't seem to suppress the gui popup like we thought (it just barfs on it). Now my only problem is getting it to run as either a startup script (which, after more thought is preferrable) or a login script. Neither of which is working for me. le sigh Hit me up in chat or something if you have some ideas. – Holocryptic Apr 6 '11 at 15:38

Is $UninstallString indeed a string? If not, you may need to cast it to be a string. Also, I don't think that it's null, but you may want to verify that it contains what you think it does after that first step.

share|improve this answer
You're on the right track... I think Ben and I have narrowed the problem down. – Holocryptic Apr 6 '11 at 1:06




CD Program Files\Microsoft Security Client

setup.exe /x /s


This works on XP clients, haven't tested on Win7 but as it's just a batch script it should be fine. Obligatory "So easy a $BRAINDEADBIPED could do it!" here.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.