Uninstalling an application via uninstall string

Content Authoring
1

Hi everyone,

I'm trying to uninstall an application via bigfix action script and I have tested the below script

wait {value "UninstallString" of keys "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BDD5C7FB-E87F-3070-9397-2CA9BAF7CE7D}" of ( x64 registries; x32 registries )} /S

this is giving the error:

Relevance clause must be surrounded by { and } guards.

then I tried:

wait {value "UninstallString" of keys "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{{BDD5C7FB-E87F-3070-9397-2CA9BAF7CE7D}" of ( x64 registries; x32 registries )} /S

which should've worked but didn't and throwing the same error.

I have also tried:

wait {value "UninstallString" of keys "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall{{BDD5C7FB-E87F-3070-9397-2CA9BAF7CE7D}}" of ( x64 registries; x32 registries )} /S

but getting the same error, what am I doing wrong here?

btw this relevance is working fine in fixlet debugger and fetching the value of the uninstall string which is

MsiExec.exe /X{BDD5C7FB-E87F-3070-9397-2CA9BAF7CE7D}

any help would be appreciated.

thanks

2

I think in this case you need to escape the trailing "}" of the GUID to prevent the relevance substitution expression terminating too soon.

{(value "UninstallString" of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BDD5C7FB-E87F-3070-9397-2CA9BAF7CE7D}}" of ( x64 registries; x32 registries ))}

Also watch out for any trailing “%00” or duplication of values that exist in both x86 and x64 hives than may result in plural results where as your method is geared toward a singular.

I’ve typically tended to avoid calling the command from the uninstall string as it can sometimes contain “msiexec.exe /i {app_guid}” instead of the /x argument and this can prevent silent uninstallation from being successful.

3

thanks this is working but I’m getting a prompt for uninstall confirmation even when I’m using /S or /qn.

image
image1912Ă—367 19.3 KB

any idea how to deal with this?

Thanks for your help.

4

I’ve used waithidden and passed the /qn and /norestart args with success in the past

5

Ahhh, with this method the /qn isn’t being appended to the end of the uninstall command.

Seeing as you are statically specifying the reg key, which is the GUID you are wanting to uninstall, why not reuse the same GUID in your uninstall method, ie

waithidden msiexec /x {{BDD5C7FB-E87F-3070-9397-2CA9BAF7CE7D} /qn /norestart

If you were dynamically searching for an unknown GUID the relevance substitution makes sense but with a static GUID being coded in the registry path, I’m not seeing the advantage of then looking up and calling its uninstall string

2 Likes
6

I have a template for uninstalling MSI’s here: generate_bes_from_template/examples/Uninstall_MSI-Windows.bes.mustache at master · jgstew/generate_bes_from_template · GitHub

I also have automation to generate uninstall tasks for all MSI installed applications: generate_bes_from_template/examples/generate_uninstallers.py at master · jgstew/generate_bes_from_template · GitHub

The automation requires you make an analysis property named “DisplayNames of MSI Applications - Windows“ with the following relevance: (set eval period to once a day)

if (windows of operating system AND (if exists property whose(it as string contains "in proxy agent context") then NOT in proxy agent context else TRUE)) then ( unique values of (it as trimmed string) of (preceding text of first "%ae" of it | it) of (preceding text of first "Â" of it | it) of (preceding text of first "%a9" of it | it) of (preceding text of first "™" of it | it) of (it as string) of values "DisplayName" of keys whose(exists (values "UninstallString" of it; values "ModifyPath" of it) whose(it as string as lowercase contains "msiexec")) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x64 registries; x32 registries) ) else NOTHINGS
3 Likes