Mcafee Endpoint Product Removal Tool Free May 2026

The tool will prompt you that it is removing security software. Click Next or Yes.

If you are a home user, you might be looking for the wrong tool.

If you are unsure which you have installed, check your "Programs and Features" list in the Control Panel. If it says "Endpoint," use the tool discussed in this article. If it says "Total Protection," use the MCPR tool.

The tool is hosted on the official Trellix (formerly McAfee) support site.

If the tool fails in normal Windows mode, or if you need to remove McAfee from 100 endpoints remotely:

I tested this recently on a Windows 11 laptop that had McAfee Endpoint Security (ENS) version 10.7 from a former employer. After a standard uninstall, Windows Defender refused to turn on. A network adapter showed a mysterious "McAfee NDI Filter" driver. Safe mode didn’t help.

Running the official removal tool took 90 seconds. After a reboot, the filter was gone, Defender activated immediately, and the system felt noticeably snappier. No trace of McAfee remained—not even a stray service in services.msc.

The only catch? The tool requires you to run it in normal Windows mode (not safe mode), and it asks for an administrator password. That’s it.

Product Name: McAfee Endpoint Product Removal Tool (EPR)

Overview: The McAfee Endpoint Product Removal Tool is a standalone utility designed to completely uninstall McAfee endpoint products (such as McAfee Agent, VirusScan Enterprise, and Endpoint Security) from Windows systems. It is intended for use when the standard Windows uninstaller fails or when a clean removal is required for troubleshooting or migration purposes.

Usage Context: This tool is particularly useful for IT administrators who need to re-image workstations or migrate endpoints to a different security platform without manually cleaning up corrupted installations.

The McAfee Endpoint Product Removal (EPR) tool, now managed under the Trellix brand, is a specialized utility designed to completely uninstall enterprise-level security software when standard methods fail. Unlike consumer cleanup tools, the EPR tool is built for complex environments where remnants of software can interfere with new installations or system stability. Understanding the McAfee EPR Tool

The EPR tool (EndpointProductRemoval.exe) is specifically used for corporate and enterprise products. It serves as a "last resort" remediation tool for endpoints with issues that standard support channels cannot resolve.

Supported Products: It can remove a wide range of legacy McAfee and current Trellix applications, including: Endpoint Security (ENS) Trellix Agent (MA) Data Loss Prevention (DLP) VirusScan Enterprise (VSE) Host Intrusion Prevention (HIPS)

Expiration Mechanism: To ensure users have the latest bug fixes and support for new software versions, each version of the EPR tool expires every 90 days. Users must download a fresh copy quarterly from the official portal. How to Download the EPR Tool for Free

Official access to the EPR tool is generally restricted to users with an active business support agreement.

Trellix Product Downloads: Navigate to the Trellix Product Downloads site. mcafee endpoint product removal tool free

Authentication: You must log in using a valid Grant Number and registered email address.

Search: Filter by "Utilities and Connectors" or search for "Endpoint Product Removal" to find the latest version.

Alternative for Consumers: If you are trying to remove home-user software like McAfee Total Protection, use the McAfee Consumer Product Removal (MCPR) tool, which is available for free download without a grant number. Step-by-Step Removal Guide

The EPR tool can be executed through a Graphical User Interface (GUI) or a Command Line Interface (CLI). Using the GUI (Recommended for Single Machines) Launch: Run EndpointProductRemoval.exe as an Administrator.

Accept EULA: You must accept the End User License Agreement to proceed.

Scan and Select: The tool will scan for installed products. Select the specific components you wish to remove.

Remove: Click Remove Products. Once complete, a system reboot is mandatory to delete driver files that were locked by the OS. Using the Command Line (For Mass Deployment)

For administrators using ePO or third-party tools, specific switches can be used:

--accepteula: Mandatory flag; the tool will not run without it. --ENS: Removes only Endpoint Security. --ALL: Removes all supported products (use with caution).

--noreboot: Prevents the system from automatically restarting after removal. Important Best Practices

Test First: Always test the tool in a pilot environment before deploying it to the entire organization.

Run Locally: For best results, execute the file from the local drive rather than a network share.

Review Logs: If the removal fails, check the logs located at C:\Windows\Temp\McAfeeLogs\ to identify conflicting products or errors. McAfee Endpoint Product Removal (EPR) tool Recent Release

The McAfee Endpoint Product Removal (EPR) tool is a specialized utility designed to completely uninstall enterprise-level McAfee (now Trellix) security products from Windows systems when standard uninstallation methods fail.  Key Overview & "Free" Access 

While the tool is free to use for licensed enterprise customers, it is not a public "freeware" utility. 

Access: It is typically downloaded from the Trellix Product Downloads site using a valid Grant Number and email. The tool will prompt you that it is

Expiration: The tool is programmed to expire quarterly (every 3 months) to ensure administrators are using the latest version with current bug fixes and product support.

Consumer Alternative: For home/consumer products (like McAfee Total Protection), use the McAfee Consumer Product Removal (MCPR) tool, which is freely available on McAfee's support site.  Supported Products 

The EPR tool handles the removal of numerous Trellix/McAfee enterprise components, including: 

Endpoint Security (ENS): Firewall, Threat Prevention, and Web Control. Management Agents: Trellix/McAfee Agent (MA).

Data Protection: Data Loss Prevention (DLP), Drive Encryption (MDE/TDE), and File and Removable Media Protection (FRP).

Legacy Products: VirusScan Enterprise (VSE) and Host Intrusion Prevention (HIPS).  Usage Best Practices 

To ensure a clean removal and avoid system instability, follow these guidelines: 

Last Resort Only: Only use EPR if standard uninstallation via the Control Panel fails or if directed by technical support.

Administrator Rights: The tool must be run with full Administrator permissions.

Run Locally: Execute the tool from the local drive of the machine being remediated; do not run it from a network share.

Reboot Mandatory: A system restart is required after execution to clear residual kernel drivers and locked files. Command Line vs. GUI:

GUI: Provides a simple interface to select specific products for removal.

Command Line: Useful for mass deployment via ePolicy Orchestrator (ePO). Use specific flags like --VSE or --MA rather than --ALL to avoid removing essential management components accidentally. The --accepteula argument is mandatory for command-line use.  Troubleshooting 

Conflicts: The tool checks for conflicting products (like active Drive Encryption) and may refuse to run if they are not first deactivated.

Logs: Progress and errors are recorded in C:\Windows\Temp\McAfeeLogs\EPR_%TIMESTAMP%.log. 

Do you need help locating your Grant Number or finding the specific command-line arguments for a certain product?  If you are unsure which you have installed,

How to uninstall or remove McAfee software from a Windows PC

McAfee Endpoint Product Removal (EPR) a specialized utility designed for IT administrators to forcefully uninstall enterprise-level security products (now under the

brand) that cannot be removed through standard Windows methods University of Cambridge Important: Free vs. Paid Access Unlike the consumer-facing McAfee Consumer Product Removal (MCPR) tool EPR tool is not free for public download Access Requirement : You must have an active Grant Number for a supported Trellix/McAfee product. Expiration

: The tool is designed to expire quarterly to ensure users always use the version compatible with the latest product updates. Step 1: Download the EPR Tool

If you have a valid Grant Number, you can download the tool from the official portal: Trellix Product Downloads site Log in using your Grant Number and email address. Search for Endpoint Product Removal or filter by Utilities and Connectors to find the latest version. Trellix Thrive Portal Step 2: Run via Graphical User Interface (GUI)

The GUI is the easiest way to remove products on a single local machine. Run as Admin : Right-click EndpointProductRemoval.exe and select Run as Administrator Accept EULA to the license terms. Select Products

: The tool will scan for installed McAfee/Trellix components. Check the boxes for the specific products you wish to remove. and wait for the process to complete.

: A system restart is mandatory to complete the removal of deep-level drivers and registry keys. Step 3: Run via Command Line (Advanced)

For automation or remote deployment (e.g., via ePO), use command line arguments. University of Cambridge Basic Syntax EndpointProductRemoval.exe --accepteula --[ProductCode] Common Arguments --accepteula : Mandatory to bypass the license prompt. : Removes all supported McAfee/Trellix products.

: This will also remove the Trellix Agent, stopping communication with the management console. : Removes VirusScan Enterprise. : Removes Endpoint Security. University of Cambridge Troubleshooting and Logs

If the removal fails, the tool generates detailed logs for analysis: Log Location

: Usually found in the same folder as the executable or in the Windows Temp folder. Exit Codes : Success, no reboot required. : Success, but a reboot is required Any other code

: Indicates a failure or partial removal; check logs for "Access Denied" or conflicting processes. University of Cambridge Alternatives for Home Users Endpoint Product Removal tool to uninstall Trellix products

If your laptop is managed by a company IT department, do not use this tool unless instructed.

For home users or personal devices: Go ahead. For work laptops? Call your helpdesk first.