Seger Steele

I'm having trouble finding the directory path for trace.log, where may I find that on a windows workstation?

To elaborate on the above, we have 7 endpoints that when I run a task (software uninstall/install) the task fails immediately without seemingly trying. All 7 devices are checking into the protect server consistently, all 7 have a out of date Endpoint Security version. I tried updating to the newest version but again the task failed immediately. The only other commonality is none of the products are activated with a license - is that a credible solution to my problem is activating the products with a license

After looking through the software-uninstall.log file, we had a policy that was enforcing password protected uninstalls. Removing the policy fixed us up incase anyone comes here wondering the same.

Submitted a ticket, ticket is #00624951.

@Marcos I found it! Disregard above, thanks

@Marcos Thanks for the quick reply, is there a link you could shoot me towards for entering this support ticket?

Happy Monday! I've been having a issue where some users are having the software uninstall task fail within ESET Protect. The software we're uninstalling is ESET Endpoint Security, the fails have happened for both macOS and Windows. While troubleshooting, I found this ESET forum post that mentioned checking the software-uninstall.logs for errors related to the uninstall being password protected, I pulled the software-uninstall.log from the agent logs immediately after a failed attempt, output is below. Any ideas on where to go next? C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs> cat software-uninstall.log === Verbose logging started: 8/14/2023 14:20:23 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\WINDOWS\system32\msiexec.exe MSI (c) (8C:7C) [14:20:23:601]: Resetting cached policy values MSI (c) (8C:7C) [14:20:23:601]: Machine policy value 'Debug' is 0 MSI (c) (8C:7C) [14:20:23:602]: ******* RunEngine: ******* Product: {EF6D6B44-84A1-4455-A81B-91F00E912CD7} ******* Action: ******* CommandLine: ********** MSI (c) (8C:7C) [14:20:23:602]: Client-side and UI is none or basic: Running entire install on the server. MSI (c) (8C:7C) [14:20:23:603]: Grabbed execution mutex. MSI (c) (8C:7C) [14:20:23:691]: Cloaking enabled. MSI (c) (8C:7C) [14:20:23:692]: Attempting to enable all disabled privileges before calling Install on Server MSI (c) (8C:7C) [14:20:23:694]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (E8:74) [14:20:23:702]: Running installation inside multi-package transaction {EF6D6B44-84A1-4455-A81B-91F00E912CD7} MSI (s) (E8:74) [14:20:23:702]: Grabbed execution mutex. MSI (s) (E8:B0) [14:20:23:707]: Resetting cached policy values MSI (s) (E8:B0) [14:20:23:707]: Machine policy value 'Debug' is 0 MSI (s) (E8:B0) [14:20:23:707]: ******* RunEngine: ******* Product: {EF6D6B44-84A1-4455-A81B-91F00E912CD7} ******* Action: ******* CommandLine: ********** MSI (s) (E8:B0) [14:20:23:708]: Machine policy value 'DisableUserInstalls' is 0 MSI (s) (E8:B0) [14:20:23:712]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038 MSI (s) (E8:B0) [14:20:23:718]: SRSetRestorePoint skipped for this transaction. MSI (s) (E8:B0) [14:20:23:720]: MSCOREE not loaded loading copy from system32 MSI (s) (E8:B0) [14:20:23:756]: End dialog not enabled MSI (s) (E8:B0) [14:20:23:757]: Original package ==> C:\Windows\Installer\3d917.msi MSI (s) (E8:B0) [14:20:23:757]: Package we're running from ==> C:\Windows\Installer\3d917.msi MSI (s) (E8:B0) [14:20:23:758]: APPCOMPAT: Uninstall Flags override found. MSI (s) (E8:B0) [14:20:23:759]: APPCOMPAT: Uninstall VersionNT override found. MSI (s) (E8:B0) [14:20:23:759]: APPCOMPAT: Uninstall ServicePackLevel override found. MSI (s) (E8:B0) [14:20:23:760]: APPCOMPAT: looking for appcompat database entry with ProductCode '{EF6D6B44-84A1-4455-A81B-91F00E912CD7}'. MSI (s) (E8:B0) [14:20:23:762]: APPCOMPAT: no matching ProductCode found in database. MSI (s) (E8:B0) [14:20:23:768]: Machine policy value 'DisablePatch' is 0 MSI (s) (E8:B0) [14:20:23:768]: Machine policy value 'AllowLockdownPatch' is 0 MSI (s) (E8:B0) [14:20:23:769]: Machine policy value 'DisableLUAPatching' is 0 MSI (s) (E8:B0) [14:20:23:769]: Machine policy value 'DisableFlyWeightPatching' is 0 MSI (s) (E8:B0) [14:20:23:770]: Looking for file transform: C:\ProgramData\ESET\ESET Security\Installer\fix_norepair.mst MSI (s) (E8:B0) [14:20:23:770]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 MSI (s) (E8:B0) [14:20:23:778]: File will have security applied from OpCode. MSI (s) (E8:B0) [14:20:23:780]: Original transform ==> C:\ProgramData\ESET\ESET Security\Installer\fix_norepair.mst MSI (s) (E8:B0) [14:20:23:781]: Transform we're running from ==> C:\WINDOWS\Installer\eaa219.mst MSI (s) (E8:B0) [14:20:23:781]: SOFTWARE RESTRICTION POLICY: Verifying transform --> 'C:\ProgramData\ESET\ESET Security\Installer\fix_norepair.mst' against software restriction policy MSI (s) (E8:B0) [14:20:23:783]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\ESET\ESET Security\Installer\fix_norepair.mst has a digital signature MSI (s) (E8:B0) [14:20:23:783]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\ESET\ESET Security\Installer\fix_norepair.mst is permitted to run because the user token authorizes execution (system or service token). MSI (s) (E8:B0) [14:20:23:784]: Note: 1: 2205 2: 3: Patch MSI (s) (E8:B0) [14:20:23:784]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (E8:B0) [14:20:23:784]: Note: 1: 2262 2: _Tables 3: -2147287038 MSI (s) (E8:B0) [14:20:23:785]: Note: 1: 2262 2: _Columns 3: -2147287038 MSI (s) (E8:B0) [14:20:23:785]: Note: 1: 2262 2: Media 3: -2147287038 MSI (s) (E8:B0) [14:20:23:785]: Note: 1: 2262 2: File 3: -2147287038 MSI (s) (E8:B0) [14:20:23:786]: TRANSFORM: 'PatchPackage' table is missing or empty. No pre-transform fixup necessary. MSI (s) (E8:B0) [14:20:23:786]: TRANSFORM: Applying regular transform to database. MSI (s) (E8:B0) [14:20:23:786]: Note: 1: 2262 2: _Tables 3: -2147287038 MSI (s) (E8:B0) [14:20:23:787]: Note: 1: 2262 2: _Columns 3: -2147287038 MSI (s) (E8:B0) [14:20:23:787]: Note: 1: 2262 2: _Config 3: -2147287038 MSI (s) (E8:B0) [14:20:23:787]: Note: 1: 2262 2: Binary 3: -2147287038 MSI (s) (E8:B0) [14:20:23:787]: Note: 1: 2262 2: _Validation 3: -2147287038 MSI (s) (E8:B0) [14:20:23:788]: Note: 1: 2262 2: ActionText 3: -2147287038 MSI (s) (E8:B0) [14:20:23:788]: Note: 1:

@Marcos This is correct

Hello! My company is using ESET Protect and Inspect hosted on-prem but our licenses expire on August 2nd. Our plan was to use the console to uninstall the agent from all devices after the 2nd by using the uninstall task via the computers pane in Protect. However we realize we may lose the ability to run tasks once our license expires. The backup plan is to use Intune Scripts and push out a short script to each endpoint to have the agent removed. We have both mac and Windows workstations. I found a way for mac here but have not found a way to use a script to uninstall ESET from Windows. The guidance I'm looking for is: 1. Will we be able to run the uninstall task once the license expires? 2. Is anyone aware of how to uninstall the ESET agent using the CLI for Windows? If I need to provide more information I'm more than happy to, thanks everyone!