McAfee Removal

DetectMcAfee.ps1

# Check if McAfee is installed
$mcAfeeInstalled = Get-WmiObject -Query "SELECT * FROM Win32_Product WHERE Name LIKE '%McAfee%'" | Select-Object -ExpandProperty Name

if ($mcAfeeInstalled) {
    Write-Output "McAfee found: $mcAfeeInstalled"
    exit 1  # Non-zero exit code means remediation is needed
} else {
    Write-Output "McAfee not found"
    exit 0  # Zero exit code means compliance
}

RemoveMcAfee.ps1

# Define paths
$mcprPath = "$env:Temp\MCPR.exe"
$mcprDownloadURL = "https://download.mcafee.com/molbin/iss-loc/mcafee-removal-tool/MCPR.exe"

# Check if McAfee is installed
$mcAfeeInstalled = Get-WmiObject -Query "SELECT * FROM Win32_Product WHERE Name LIKE '%McAfee%'" | Select-Object -ExpandProperty Name

if ($mcAfeeInstalled) {
    Write-Output "McAfee found: $mcAfeeInstalled. Proceeding with removal."

    # Download MCPR tool
    try {
        Invoke-WebRequest -Uri $mcprDownloadURL -OutFile $mcprPath -ErrorAction Stop
    } catch {
        Write-Output "Failed to download MCPR.exe"
        exit 1
    }

    # Run the McAfee Removal Tool
    Start-Process -FilePath $mcprPath -ArgumentList "/silent" -Wait -NoNewWindow

    # Give it some time to remove everything
    Start-Sleep -Seconds 60

    # Cleanup registry leftovers
    $mcAfeeRegKeys = @(
        "HKLM:\Software\McAfee",
        "HKLM:\Software\WOW6432Node\McAfee"
    )
    foreach ($key in $mcAfeeRegKeys) {
        if (Test-Path $key) {
            Remove-Item -Path $key -Recurse -Force -ErrorAction SilentlyContinue
            Write-Output "Removed registry key: $key"
        }
    }

    # Remove McAfee Services
    $mcAfeeServices = Get-Service | Where-Object { $_.DisplayName -like "*McAfee*" }
    foreach ($service in $mcAfeeServices) {
        Stop-Service -Name $service.Name -Force -ErrorAction SilentlyContinue
        sc.exe delete $service.Name
        Write-Output "Removed service: $service.Name"
    }

    # Verify removal
    $mcAfeeCheck = Get-WmiObject -Query "SELECT * FROM Win32_Product WHERE Name LIKE '%McAfee%'"
    if (-not $mcAfeeCheck) {
        Write-Output "McAfee successfully removed."
        exit 0
    } else {
        Write-Output "McAfee removal failed or partially complete."
        exit 1
    }
} else {
    Write-Output "McAfee not found, no action needed."
    exit 0
}