Export (0) Print
Expand All

Uninstalling FSE

 

Applies to: Forefront Security for Exchange Server

Topic Last Modified: 2008-02-04

Each of the cluster types requires a different method of uninstalling FSE.

These are the steps to remove FSE from a Local Continuous Replication system.

To uninstall FSE from an LCR system
  1. Ensure that the Forefront Server Security AdministratorXE "Antigen Client" is not running.

  2. Open Services in the Control Panel.

  3. Stop the FSCController service. This causes the Microsoft Exchange Transport Service and Microsoft Exchange Information Store to be stopped also.

  4. When all these services have stopped, close the Services dialog box.

  5. Open Add or Remove Programs in the Control Panel.

  6. Remove Microsoft Forefront Security for Exchange Server. Click Yes to confirm the deletion.

  7. At the Uninstall Complete screen, click Finish.

  8. Any settings that you have made still remain in .fdb files in the Microsoft Forefront Security folder in Program Files (or whatever folder you installed to). Additionally, the incidents and quarantine database files remain, as well as Statistics.xml. If you will be reinstalling FSE and want to retain those settings, do nothing. If you will not be reinstalling FSE or if you want to start with fresh settings, delete that folder.

  9. If you are not planning to re-install Forefront Security for Exchange Server, restart the stopped Exchange services.

How FSE is removed from an SCR Exchange server system depends on the configuration of your source (data center) installation. Additionally, see SCR system tips.

These are the steps to remove FSE from a CCR cluster. When uninstalling from clustered servers, the Remove Program tool stops the Internet Information Services (IIS). It also takes the CMS offline on the active node. You do not have to stop services to uninstall from a CCR cluster.

To uninstall FSE from a CCR cluster
  1. Begin with the active node.

  2. Use Add or Remove Programs in Control Panel to remove Forefront Security for Exchange Server. When uninstalling from clustered servers, the Remove Program tool takes the CMS offline on the active node.

  3. After FSE has been removed from the active node, remove it from the passive node.

importantImportant:
Do not restart any computer until Forefront is uninstalled on all nodes, even if the uninstaller prompts you to restart the computer. Otherwise, if an active node is restarted, the CMS running on that node may move to a passive node before the passive node can be uninstalled successfully. Do not manually move any CMS until Forefront has been uninstalled on all nodes.

FSE configures a checkpoint for the following two registry subkeys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Forefront Server Security\Exchange Server
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan

When you uninstall Forefront Security SP1 from a cluster, it is important to follow the instructions exactly. If the instructions are not followed correctly, the registry checkpoint settings that were configured by the FSE installation may still be active. In this scenario, you must use the cluster command to remove the checkpoint settings.

To remove the checkpoint settings for the resource names
  1. From a command prompt, you can view the list of cluster resources and their corresponding registry checkpoint settings by executing the following command:

    cluster RES /CHECK

  2. To remove the checkpoints for the resource names, type the following commands:

    • cluster res “Exchange Information Store Instance (CLUSTER_MAILBOX_NAME)” /removecheck:“SOFTWARE\Microsoft\Forefront Server Security\Exchange Server”
    • cluster res “Exchange Information Store Instance (CLUSTER_MAILBOX_NAME)” /removecheck:“SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan”

These are the steps to uninstall FSE from an SCC cluster. When uninstalling from clustered servers, the Remove Program tool stops the Internet Information Services (IIS). It also takes the CMS offline on the active node . You do not have to stop services to uninstall from an SCC cluster.

To uninstall FSE from an SCC cluster
  1. Uninstall Forefront on the active nodes first, then on the passive nodes.

  2. Use Add or Remove Programs in Control Panel to remove Forefront Security for Exchange Server. When uninstalling from clustered servers, the Remove Program tool takes the CMS offline on the active node.

  3. Restart all computers.

importantImportant:
Do not restart any computer until Forefront is uninstalled on all nodes, even if the uninstaller prompts you to restart the computer. Otherwise, if an active node is restarted, the CMS running on that node may move to a passive node before the passive node can be uninstalled successfully. Do not manually move any CMS until Forefront has been uninstalled on all nodes.
 
Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft