How to uninstall Cylance Protect without the uninstallation password

Recently a debate has come up in my office regarding giving users local administrator rights.  Once of the arguments for allowing local admins is that we have really good anti-virus, Cylance Protect.  That being said, it appears that Cylance Protect can be easily uninstalled by anyone with local administrator access to the box.

  1. Run Regedit, navigate to “HKEY_LOCAL_MACHINE\SOFTWARE\Cylance\Desktop”
  2. Right click on “Desktop” and go to Permissions.  Click “Advanced”.
  3. The owner of the object should be “SYSTEM”.  Click “Change” and select your username.
  4. Check the “Replace owner on subcontainer and objects” checkbox.
  5. Delete or rename the “LastStateRestorePoint” registry key.
  6. Create a new DWORD32 registry key called “”SelfProtectionLevel” and set the value to “1”.
  7. Reboot the computer.
  8. Run “services.msc” and stop the Cylance Protect service.
  9. Drop to a command prompt and run “msiexec /x {2E64FC5C-9286-4A31-916B-0D8AE4B22954}”, click “Yes” when prompted.
  10. It should be properly and fully uninstalled.

One thought to “How to uninstall Cylance Protect without the uninstallation password”

  1. YOU ARE AWESOME!!!! THANK YOU! This has been bothering me for months and your solution worked perfectly.
    There was only on glitch which when I typed “msiexec /x {2E64FC5C-9286-4A31-916B-0D8AE4B22954}” into the command prompt, I would get message back that I could only remove installed programs. However when I used control+V to paste the string, it worked. Triple checked to make sure I had it right.
    Long story short, lesson learned, cut and paste the string.
    Again, thank you.

Leave a Reply

Your email address will not be published. Required fields are marked *