Thursday, 23 August 2012

McAfee HIPS breaks IIS when uninstalling

McAfee HIPS has proven to be more of a hindrance than help, so I've been going around uninstalling it.

Unfortunately this frequently breaks IIS in Windows 2008 (yes, really, in an "Enterprise" product!) and you end up with Error 503 messages when you try to access the website and event log messages:

The Module DLL C:\Windows\System32\inetsrv\HipIISEngineStub.dll failed to load.  The data is the error.


If you remove Host Intrusion Prevention (Host IPS) 8.0 from a Microsoft Server 2008 running with IIS 7.0, the ISAPI filter references are not removed from the IIS applicationHost.config file.


Edit the IIS 7.0 applicationHost.config file and remove the following configuration lines:

  1. Click StartRun, type explorer and click OK.
  2. Navigate to: %windir%\system32\inetsrv\config
  3. Open the file applicationHost.config as Administrator for editing in Notepad.
  4. Edit the <globalModules> section and remove the following line:

    <add name="MfeEngine" image="%windir%\System32\inetsrv\HipIISEngineStub.dll" /> 
  5. Edit the <modules> section and remove the following line:

    <add name="MfeEngine" /> 
  6. After you have finished editing the applicationHost.config file, save the file, then restart the IIS server using iisreset or by restarting the system.