0

Internally we are trying to remove bitdefender from ~250 devices. We have got stuck as Windows still thinks bitdefender is installed. We created a script, but its coming back with an Invalid Parameter. Any help?

Our Script:

$bitdefender = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Where-Object {$_.displayName -like "bitdefender"}
$instanceGuid = $bitdefender.instanceGuid
Remove-WmiObject -path \\localhost\ROOT\securitycenter2:AntivirusProduct.instanceGuid="$instanceGuid"

The first command will show the antivius's that are installed, we want to remove BitDefender not Windows Defender, so when creating the script, I tried to copy the instanceGuid from just BitDefender. Internally we tested by manually copying the instanceGuid, and pasting in the remove command, which works flawlessly, but when trying to 'automate' it, we get the following error:

.Remove-WmiObject : Invalid parameter 
\bitdefender_removal.ps1
PS C:\temp> At C:\temp\bitdefender_removal.ps1:3 char:1
+ Remove-WmiObject -path \\localhost\ROOT\securitycenter2:AntivirusProd ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Remove-WmiObject], ManagementException
    + FullyQualifiedErrorId : System.Management.ManagementException,Microsoft.PowerShell.Commands.RemoveWmiObject

Any help would be greatly appreciated

I have tried to automate this, to no avail. We can always manually do this, but for 200+ devices, its kind of a ball ache

George Bellamy
  • 1
  • 1
    Why not just pass (via the pipe) the CIMInstance you get from `Get-CIMInstance` to [`Remove-CIMInstance`](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/remove-ciminstance?view=powershell-7.3)? – Jeff Zeitlin Jan 04 '23 at 15:24
  • 1
    You need to run with "As Admin". Make sure you start powershell by right click shortcut and select Run As Admin. – jdweng Jan 04 '23 at 15:36
  • @jdweng - yeah, that too. – Jeff Zeitlin Jan 04 '23 at 15:48
  • Using `Remove-CimInstance`, as Jeff suggests, is definitely preferable, as there is no good reason to mix CIM and WMI cmdlets; in fact, the latter are obsolete and should be avoided - see [this answer](https://stackoverflow.com/a/54508009/45375) for more information. – mklement0 Jan 04 '23 at 15:55

0 Answers0