This security update is causing havoc on my enterprise, Microsoft has acknowledged that this patch is buggy. I need to get his off 400 machines this morning and I can’t get it to work using the Bigfix uninstall Wizard. It works if I go to the machine and manually uninstall it, but who wants to go to 400 machines tomorrow. I need help!
I haven’t quite figured out how to do it yet, but you can get the guids you need by pulling the name of the keys:
keys whose (exists values "DisplayName" whose( it as string as lowercase contains "kb4484119" ) of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of ( x64 registries; x32 registries )
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.SharePointDesigner_{3B7EE494-CBED-477C-AF90-8B8653C86985}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}
or
values "UninstallString" of keys whose (exists values "DisplayName" whose( it as string as lowercase contains "kb4484119" ) of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of ( x64 registries; x32 registries )
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\Oarpmany.exe" /removereleaseinpatch "{90150000-006E-0409-0000-0000000FF1CE}" "{3B7EE494-CBED-477C-AF90-8B8653C86985}" "1033" "0"
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\Oarpmany.exe" /removereleaseinpatch "{90150000-006E-0409-0000-0000000FF1CE}" "{3B7EE494-CBED-477C-AF90-8B8653C86985}" "1033" "0"
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\Oarpmany.exe" /removereleaseinpatch "{91150000-0011-0000-0000-0000000FF1CE}" "{3B7EE494-CBED-477C-AF90-8B8653C86985}" "1033" "0"
so all you need to do is extract the unique Office Guids and run this for each one:
waithidden "{pathname of system folder & "\msiexec.exe"}" /package {"{OfficeGuid}}"} /uninstall "{3B7EE494-CBED-477C-AF90-8B8653C86985}}"} /qn REBOOT=ReallySuppress /l*v “C:\Windows\temp\KB4484119_uninstall.log”
For this machine, I would need to run:
waithidden "{pathname of system folder & "\msiexec.exe"}" /package {"{Office Guid}}"} /uninstall "{90150000-006E-0409-0000-0000000FF1CE}}"} /qn REBOOT=ReallySuppress /l*v "C:\Windows\temp\KB4484119_uninstall.log"
waithidden "{pathname of system folder & "\msiexec.exe"}" /package {"{Office Guid}}"} /uninstall "{91150000-0011-0000-0000-0000000FF1CE}}"} /qn REBOOT=ReallySuppress /l*v "C:\Windows\temp\KB4484119_uninstall.log"
@JasonWalker I have hit a wall with tuples, substrings, unique values and concatenation trying to extract the values. I bet you can do some magic in a couple seconds of typing.
My registry looks a bit different. My Office patch uninstall keys don’t have DisplayName values, but the key names themselves indicate the Office GUID, Patch GUID, and Patch Name, as in
I don’t have that particular KB installed, so I started off parsing based on your registry key name, before moving on to a different KB that happens to be installed on mine
q: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}"
A: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}
T: 12.485 ms
q: preceding text of first "}" of following text of first "{" of "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}"
A: 90150000-006E-0409-0000-0000000FF1CE
T: 12.449 ms
q: concatenation ", " of (preceding texts of firsts "}" of it) of substrings separated by "{" of "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}"
A: 90150000-006E-0409-0000-0000000FF1CE, 3B7EE494-CBED-477C-AF90-8B8653C86985
T: 12.349 ms
q: ("%22" & pathname of file "msiexec.exe" of system folder & "%22 /I {" & tuple string item 0 of it & "}} /MSIPATCHREMOVE={" & tuple string item 0 of it & "}} /qn") of concatenation ", " of (preceding texts of firsts "}" of it) of substrings separated by "{" of "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}"
A: "C:\windows\system32\msiexec.exe" /I {90150000-006E-0409-0000-0000000FF1CE}} /MSIPATCHREMOVE={90150000-006E-0409-0000-0000000FF1CE}} /qn
T: 12.124 ms
q: ("%22" & pathname of file "msiexec.exe" of system folder & "%22 /I {" & tuple string item 0 of it & "}} /MSIPATCHREMOVE={" & tuple string item 1 of it & "}} /qn") of concatenations ", " of (preceding texts of firsts "}" of it) of substrings separated by "{" of names of keys whose (name of it as lowercase contains "kb2565063" or value "DisplayName" of it as string as lowercase contains "kb2565063" ) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of ( x64 registries; x32 registries )
A: "C:\windows\system32\msiexec.exe" /I {1D8E6291-B0D5-35EC-8441-6616F567A0F7}} /MSIPATCHREMOVE={F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}} /qn
T: 11.259 ms
So for kb4484119, I think the actionscript could be
action uses wow64 redirection false
delete __appendfile
appendfile {("%22" & pathname of file "msiexec.exe" of system folder & "%22 /I {" & tuple string item 0 of it & "}} /MSIPATCHREMOVE={" & tuple string item 1 of it & "}} /qn") of concatenations ", " of (preceding texts of firsts "}" of it) of substrings separated by "{" of names of keys whose (name of it as lowercase contains "kb4484119" or value "DisplayName" of it as string as lowercase contains "kb4484119" ) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of ( x64 registries; x32 registries )}
delete RemoveOfficeKB.cmd
move __appendfile RemoveOfficeKB.cmd
waithidden cmd.exe /C RemoveOfficeKB.cmd
Before actually running it, I’d suggest you keep enough of the action script to create the RemoveOfficeKB.cmd, and run the cmd file manually on one machine before mass-deployment. I don’t have that KB installed, and haven’t tested the uninstall commands themselves either.