unable to remove MDE for server 2012

Question

I installed MDE for our Windows 2012 R2 server using the installation package from the security center portal. Now, I would like to remove it, but it's been failing. I first used the offboarding package to offboarding the device (WindowsDefenderATPOffboardingPackage_valid_until_YYYY-MM-DD.zip) and it was successful. However, when I tried to remove the installation either using the add\remove program app from control panel or msiexec command, it always said "MDE should be offboarded before uninstall". I can't seem to bypass that error to remove the MDE agent.

Any idea?

Thanks in advance.

Answer 1

@HK G

Offline troubleshooting:

Unable to offboard Windows Server 2012 R2 from MDE, receiving the below error while uninstalling the package from add/remove programs

We onboarded the server with the local script (downloaded from MDE portal ), ran the detection test.
Verified the sense service is running.
Ran the offboarding script to offboard the server and uninstalled the MDE package this successfully.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

@HK G Thank you for reaching out to us. As I understand you want to offboard Windows Server 2012 R2 from MDE. Please help me with the error details/screenshot of the issue while removing the offboard package from add/remove programs.

Also wanted to check status of this device ( windows server 2012 R2 ) in the MDE portal.

Reference: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-endpoints-script?view=o365-worldwide#offboard-devices-using-a-local-script:~:text=Endpoint%20device.-,Offboard%20devices%20using%20a%20local%20script,-For%20security%20reasons

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/offboard-machines?view=o365-worldwide

Let me know if you have any further questions, please feel free to post back.