Remove Another Antivirus Before Deploying the SEP Agent
Your office is moving from another antivirus to Symantec Endpoint Protection. The dangerous version of this job is pushing SEP onto machines where the old product is still running: two real-time scanners hook the same files, slow the PC to a crawl and can block each other. The deployment works cleanly when the removal is planned into the install package itself.
🎥 Watch the full deployment in the video — SEPM console, wizard and push, step by step
Two antivirus products with real-time protection should not share a PC. The good news: SEP's install can remove existing third-party security software as part of the installation — but that behaviour is a setting you configure in the Client Install Settings before you launch the Client Deployment Wizard. Set it afterwards and the wizard you already ran will not apply it. This guide covers the setting, the stubborn cases, and how to prove a machine is clean before SEP goes on.
Pre-deployment check — ACCOUNTS-PC02
Another antivirus is still active on this PC
ACCOUNTS-PC02 is still running a different antivirus with tamper protection switched on. Remove that product first (or be ready with its uninstall password), restart the PC, and only then push the SEP package to it.
One machine like this in a rollout is normal. Finding it before the push is the whole point of the check. (Illustrative panel.)
1
Why Two Real Time Antivirus Products Fight
Each product inserts itself into every file open, download and program launch — to inspect it first. With two of them installed:
Every file operation gets scanned twice, so the PC feels slow for no visible reason.
Each product can treat the other's scanning and quarantine activity as suspicious behaviour.
A file one product is holding for scanning can be locked against the other, producing random errors.
Honest exception: a passive, on-demand second scanner is a different thing. The fight is between two real-time products, which is exactly what an SEP rollout would create.
2
Turn On Security Software Removal Before the Wizard
The removal is part of the install package's settings, and the order matters:
In SEPM, open the Client Install Settings for the package you will deploy and enable the option to uninstall existing third-party security software.
Do this before starting the Client Deployment Wizard — packages already pushed do not gain the setting later.
You can also build an install package with this removal behaviour baked in and reuse it for the whole migration.
Know the limit honestly: the feature removes the products and versions it knows about. A very old, broken or unusual product may survive the attempt and need manual handling.
3
When the Old Product Refuses to Leave
Some machines will not let go of their old antivirus quietly. Handle these individually instead of letting them fail silently in a big push:
It asks for an uninstall password — that password was set in the old product's own console by whoever managed it. Find it, or use that vendor's official removal method.
Tamper protection blocks removal — switch it off in the old product's settings or console first, then remove.
The uninstaller itself is broken — most antivirus vendors publish a dedicated removal tool for exactly this case; use the vendor's own tool, not a random download.
Restart after removal — removals often finish only after a reboot. Restart, confirm the old product is gone, and only then push SEP.
4
Verify the Machine Is Clean, Then Push
Sixty seconds of checking prevents a machine that runs two half-products for months:
Confirm the old product is gone from the installed programs list and that its service is no longer running.
Restart the PC once more if the removal asked for it.
Now deploy SEP to that machine with the normal wizard and Remote Push.
Afterwards, confirm on the Clients page that the PC reports in as online and protected.
🔴 About Windows Defender: Microsoft Defender Antivirus is built into Windows and is not what this removal setting targets. When a third-party antivirus like SEP registers itself, Defender normally steps back on its own — you do not need a separate removal step for it, and you should not try to rip out Windows components.
🎥 Watch the Full Video
See the complete SEP agent deployment on screen — every wizard screen and the result in the console.
Where exactly is the third-party removal option in SEP?
In the Client Install Settings of the install package, configured in SEPM before you run the Client Deployment Wizard. If you already pushed a package without it, correct the settings and push again to the affected machines.
The old antivirus asks for a password to uninstall. Whose password is it?
The uninstall password set inside that old product, usually by the administrator or vendor who installed it. Without it, use the old vendor's official removal tool or support route — do not guess, repeated wrong attempts help nobody.
Should I restart between removing the old antivirus and installing SEP?
Yes. Many removals complete only after a restart, and pushing SEP onto a half-removed product invites exactly the two-scanner fight you are trying to avoid. Restart, verify the old product is gone, then deploy.
This guide is based on the Technical Anshu video on deploying the SEP agent • Stuck on a step? Ask in the video comments 🙏