Uninstalling FSE

Applies to: Forefront Security for Exchange Server

Each of the cluster types requires a different method of uninstalling FSE.

Uninstalling FSE from an LCR system

These are the steps to remove FSE from a Local Continuous Replication system.

To uninstall FSE from an LCR system

1. Ensure that the Forefront Server Security AdministratorXE "Antigen Client" is not running.

2. Open Services in the Control Panel.

3. Stop the FSCController service. This causes the Microsoft Exchange Transport Service and Microsoft Exchange Information Store to be stopped also.

4. When all these services have stopped, close the Services dialog box.

5. Open Add or Remove Programs in the Control Panel.

6. Remove Microsoft Forefront Security for Exchange Server. Click Yes to confirm the deletion.

7. At the Uninstall Complete screen, click Finish.

8. Any settings that you have made still remain in .fdb files in the Microsoft Forefront Security folder in Program Files (or whatever folder you installed to). Additionally, the incidents and quarantine database files remain, as well as Statistics.xml. If you will be reinstalling FSE and want to retain those settings, do nothing. If you will not be reinstalling FSE or if you want to start with fresh settings, delete that folder.

9. If you are not planning to re-install Forefront Security for Exchange Server, restart the stopped Exchange services.

Uninstalling FSE from an SCR system

How FSE is removed from an SCR Exchange server system depends on the configuration of your source (data center) installation. Additionally, see SCR system tips.

• If the source system is configured as a standalone server, follow the instructions at Uninstalling FSE From an LCR System.

• If the source system is configured as CCR, follow the instructions at Uninstalling FSE From a CCR Cluster.

• If the source system is configured as SCC, follow the instructions at Uninstalling FSE From an SCC Cluster.

Uninstalling FSE from a CCR cluster

These are the steps to remove FSE from a CCR cluster. When uninstalling from clustered servers, the Remove Program tool stops the Internet Information Services (IIS). It also takes the CMS offline on the active node. You do not have to stop services to uninstall from a CCR cluster.

To uninstall FSE from a CCR cluster

1. Begin with the active node.

2. Use Add or Remove Programs in Control Panel to remove Forefront Security for Exchange Server. When uninstalling from clustered servers, the Remove Program tool takes the CMS offline on the active node.

3. After FSE has been removed from the active node, remove it from the passive node.

Additional CCR cluster uninstall notes

FSE configures a checkpoint for the following two registry subkeys:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Forefront Server Security\Exchange Server

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan

When you uninstall Forefront Security SP1 from a cluster, it is important to follow the instructions exactly. If the instructions are not followed correctly, the registry checkpoint settings that were configured by the FSE installation may still be active. In this scenario, you must use the cluster command to remove the checkpoint settings.

To remove the checkpoint settings for the resource names

1. From a command prompt, you can view the list of cluster resources and their corresponding registry checkpoint settings by executing the following command:

   cluster RES /CHECK

2. To remove the checkpoints for the resource names, type the following commands:

   • cluster res “Exchange Information Store Instance (CLUSTER_MAILBOX_NAME)” /removecheck:“SOFTWARE\Microsoft\Forefront Server Security\Exchange Server”

   • cluster res “Exchange Information Store Instance (CLUSTER_MAILBOX_NAME)” /removecheck:“SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan”

Uninstalling FSE from an SCC cluster

These are the steps to uninstall FSE from an SCC cluster. When uninstalling from clustered servers, the Remove Program tool stops the Internet Information Services (IIS). It also takes the CMS offline on the active node . You do not have to stop services to uninstall from an SCC cluster.

To uninstall FSE from an SCC cluster

1. Uninstall Forefront on the active nodes first, then on the passive nodes.

2. Use Add or Remove Programs in Control Panel to remove Forefront Security for Exchange Server. When uninstalling from clustered servers, the Remove Program tool takes the CMS offline on the active node.

3. Restart all computers.