How to fully Uninstall/Clean-up Microsoft Defender Endpoint

Dan Beeney 0 Reputation points
2024-06-27T13:23:57.6933333+00:00

Hello,

We are having issues trying to use a migration tool to move our devices to another Microsoft tenant. It seems to be struggling gaining access and deleting a regkey that is link to a service for MDE. The tool is running and using the system account, we are also local admins and unable to delete/remove manually.

We have used the offboarding script but only seems to disconnect the device from the MDE portal. This doesn't uninstall or clean-up MDE from device. All of the software, services or regkeys still remain. Is there a uninstall or clean-up tool please to help fully remove Microsoft Defender Endpoint??

Thanks,
Dan

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,249 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,646 questions
Microsoft Q&A
Microsoft Q&A
Use this tag to share suggestions, feature requests, and bugs with the Microsoft Q&A team. The Microsoft Q&A team will evaluate your feedback on a regular basis and provide updates along the way.
652 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
172 questions
Microsoft Defender for Endpoint Training
Microsoft Defender for Endpoint Training
Microsoft Defender for Endpoint: A Microsoft unified security platform for preventative protection, postbreach detection, and automated investigation and response. Previously known as Microsoft Defender Advanced Threat Protection.Training: Instruction to develop new skills.
27 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sandeep G-MSFT 15,816 Reputation points Microsoft Employee
    2024-06-28T09:31:48.5866667+00:00

    @Dan Beeney

    Thank you for posting this in Microsoft Q&A.

    As I understand you need assistance in uninstalling Microsoft Defender for endpoint.

    I see that you have also posted this issue on tech community platform. There is an answer posted on the tech community thread with detailed steps on how to uninstall MDE.

    https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-do-you-fully-uninstall-clean-up-microsoft-defender-endpoint/m-p/4177365

    To fully uninstall and clean up Microsoft Defender Endpoint (MDE) from your devices, you need to follow a comprehensive process that involves stopping services, removing registry keys, and uninstalling associated components. Here’s a detailed guide to help you achieve this.

     Step-by-Step Guide to Fully Uninstall/Clean-up Microsoft Defender Endpoint.

    Stop Microsoft Defender Services

    • Open PowerShell as Administrator
    • Copy code Stop-Service -Name "Sense" -Force Stop-Service -Name "windefend" -Force Stop-Service -Name "WdNisSvc" -Force

    Disable the Services:

    • Open PowerShell as Administrator
    • Set-Service -Name "Sense" -StartupType Disabled Set-Service -Name "windefend" -StartupType Disabled Set-Service -Name "WdNisSvc" -StartupType Disabled

    Uninstall Microsoft Defender Endpoint Components: Uninstall using PowerShell

    • First uninstall Windows Security app
    • Open PowerShell as Administrator
    • Copy code Get-AppxPackage Microsoft.SecHealthUI | Remove-AppxPackage
    • Uninstall Microsoft Defender Antivirus
    • Open PowerShell as Administrator
    • Copy code Uninstall-WindowsFeature -Name Windows-Defender-Features
    • Remove Defender for Endpoint Using Windows Installer:
    • Open PowerShell as Administrator
    • Copy code msiexec /x {ProductCode} /qn /norestart

    Note: Replace {ProductCode} with the actual product code for Microsoft Defender Endpoint. You can find this in the registry under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

    Now you will have to remove the registry keys:

    • Open PowerShell as Administrator
    • Copy code Remove-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\MDCoreSvc" -Recurse -Force Remove-Item -Path "HKLM:\SYSTEM\ControlSet001\Services\MDCoreSvc" -Recurse -Force

    Next step is to offboarding script again and this is optional

    If you have not already, you can run the offboarding script provided by Microsoft to ensure the device is disconnected from the MDE portal.

    Now next steps is to clean Up Residual Files and Folders

    • Delete Microsoft Defender Folders:
    • Open PowerShell as Administrator
    • Copy code Remove-Item -Path "C:\Program Files\Windows Defender" -Recurse -Force Remove-Item -Path "C:\ProgramData\Microsoft\Windows Defender" -Recurse -Force

    Now reboot the device

    Reboot the device to ensure all changes take effect and to complete the cleanup process.

    Additional Considerations

    Permissions:

    • Ensure you have sufficient permissions to perform these operations, especially when manipulating services and registry keys.
      • If the system account or local admins are unable to remove certain keys or services, you might need to boot into Safe Mode to perform these actions.
      Group Policy: 
      - Verify that there are no Group Policies that might be re-enabling or protecting Microsoft Defender services or components.

    Let me know if you have any further questions.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.