Force Uninstall of McAfee Host Intrusion Protection Service

Sometimes you may have some problems installing software on your windows 2008 server while McAfee Host Intrusion Service (HIPS) is installed.

Here are some options (likely you will go with option 2 as your company may not have given you the uninstall password):

 

Solution 1

If the Host Intrusion Prevention clientUI default unlock password has not yet been changed, disable the Host Intrusion Prevention client manually by unlocking the Host Intrusion Prevention client UI tray:

1. Click Start, Run, type explorer and click OK.
2. Navigate to: C:\Program Files\McAfee\Host Intrusion Prevention\
3. Double-click McAfeeFire.exe.
4. Click Task, Unlock User Interface.
5. Typethe unlock code, and select Administrator Password.
   NOTE: By default, the unlock code is abcde12345. 
6. After the user interface is unlocked, click the IPS Policytab. 
7. Deselect Enable Host IPS and Enable Network IPS. (The Firewall Policy can be disabled on its own tab.)
8. Select Task, Exit.

Solution 2

If the default unlock password has been changed, start the client in Windows Safe Mode and disable the Host Intrusion Prevention agent service.

1. Start the client in Safe Mode. For details about Safe Mode, refer to Microsoft Support at: http://support.microsoft.com
2. Click Start, Run, type services.msc and click OK.
3. Double-click the McAfee Host Intrusion Prevention Service to open the service properties.
4. Select Disabled under Startup type.
5. Restart the client in Normal Mode.
6. Click Start, Run, type regedit and click OK.
7. Navigate to and expand the following key:
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall]
8. Locate the GUID for the installed version of Host Intrusion Prevention.
9. Run the uninstall string value to remove the client .

When I located the guid from the command line I ran the uninstall string value.  In my case this was:

msiexec /x {B332732A-4958-41DD-B439-DDA2D32753C5} REMOVE=ALL

(note: the guid will likely be different in your case)