How to Fix "Service ESET (ekrn) Could Not Be Deleted. (Solved)
Recently, when I tried to uninstall ESET Antivirus from a Windows 10 PC, I got the error "Service "ESET Service" (ekrn) could not be deleted. Verify that you have sufficient privileges to remove system services".
After researching the problem online, I realized that the problem is common and the usual ways to solve it is to run the ESET Uninstaller tool in Windows Safe Mode or uninstall ESET Antivirus in Safe Mode.
But, what can you do if you don't want to restart the affected computer in Safe Mode because you are working remotely? (such in my case). Don't worry, I found the solution and you'll find it below, along with the official one.
This guide addresses several related issues, including:
- Service "ESET Service (efwd) could not be deleted.
- Service "ESET Service (ekrn ) could not be deleted.
- Service "ESET Service (ekrnEpfw) could not be deleted.
- Service "ESET Service (EHttpSrv ) could not be deleted.
- Service "ESET Service (EraAgentSvc) could not be deleted.
- ESET Service could not be stopped.
How to FIX: Cannot Uninstall ESET Security Antivirus – Service ESET could not be deleted.
Method 1. Remove ESET Antivirus without booting into Safe Mode.
If you cannot boot the affected computer in Safe Mode, you can bypass the "ESET Service could not be deleted" error by manually deleting ESET services from the registry before uninstalling the antivirus product. This method is particularly useful for remote troubleshooting.
1. In the "Installer Information" window, click Cancel and then close the ESET Uninstaller window.
2a. Press the Windows 
+ R keys to open the Run command box. 2b. Type regedit and press Enter to open the registry editor.
3. In Registry Editor, navigate to the following location:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
4. Expand the Services key and delete the following ESET services one by one:
- efwd (ESET Forwarder)
- ekrn (ESET Service)
- ekrnEpfw (ESET Firewall Helper)
- EHttpSrv (ESET HTTP Server)
- EraAgentSvc (ESET Management Agent)
* Note: If you can't find any of the above services, don't worry. Some are specific to ESET business products.
5. After removing the ESET services, close the registry editor and reboot the PC.
6. After restarting, navigate to Control Panel > Programs and Features, select the installed ESET Security product, click Change, and then Uninstall to remove it.
7. ESET Security Antivirus should now uninstall without any issues.
* Note: If the problem persists, proceed with Method 2, the official solution from ESET.
Method 2. Run ESET Uninstaller tool in Windows Safe Mode.
The official solution to resolve the "ESET Service could not be deleted" error involves using the ESET Uninstall utility in Safe Mode. This method ensures all ESET components are thoroughly removed.
1. Visit the Manually Uninstall ESET Product page.
2. Scroll down and click Download ESET Uninstaller.
3. Once downloaded, press the Windows + R keys to open the Run command box, type msconfig, and press Enter.
4. In the System Configuration utility, go to the Boot tab, check the Safe boot option, then click OK and Restart to reboot in Safe Mode.
5. Once in Safe Mode, run the ESET Uninstaller tool and follow the on-screen prompts to remove all ESET Security products.
6. After completion, open the System Configuration (msconfig) utility again, select Normal startup in the General tab, and click OK to restart Windows in normal mode.
Additional Method: Use Command Prompt to Remove Services
If the above methods do not resolve the issue, you can try using the Command Prompt to manually remove services. Open Command Prompt as an administrator and execute the following command for each ESET service:
sc delete [ServiceName]Replace [ServiceName] with the actual service name such as ekrn or efwd. This command forcibly deletes the specified service from the system.
Summary
To resolve the "Service ESET (ekrn) could not be deleted" error, you can either manually remove ESET services from the Windows registry or use the ESET Uninstaller tool in Safe Mode. For additional assurance, you can also use Command Prompt to delete services. These methods ensure a clean uninstallation of ESET Antivirus, allowing for a smooth transition to other security solutions.
If you found this guide helpful, please share it to help others facing similar issues.
Frequently Asked Questions
How can I uninstall ESET Antivirus without entering Safe Mode?
If you need to uninstall ESET Antivirus without entering Safe Mode, open the registry editor by pressing Windows + R, typing regedit, and pressing Enter. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and delete the ESET services like efwd, ekrn, and others listed. After deleting these services, reboot the PC and proceed to uninstall ESET from Control Panel > Programs and Features.
What should I do if ESET services cannot be deleted manually?
If manually deleting ESET services doesn't resolve the issue, try using the official ESET Uninstaller tool in Safe Mode. First, download the ESET Uninstaller, reboot your PC in Safe Mode using msconfig, and run the tool to uninstall ESET Security products.
Why can't I find some of the ESET services to delete?
If you can't find certain ESET services like efwd or EraAgentSvc, don't worry. Some of these services are associated with ESET business products and may not be present on your system if you're using a standard version.
What is the official method to resolve 'ESET Service could not be deleted'?
The official method involves using the ESET Uninstaller tool in Safe Mode. Download the tool from ESET's website, reboot your system in Safe Mode, and use the utility to remove ESET products. Then, restart your system in normal mode using the System Configuration utility.
July 3, 2025 @ 9:53 am
Thank you for the detailed guide. I’d like to add a critical clarification for readers based on further research and practical experience with ESET products.
The manual registry deletion and service removal steps described under “Method 1” (in normal mode) may not work as expected due to ESET’s Self-Defense feature. This security mechanism is specifically designed to prevent exactly these types of changes — including service termination and registry tampering — while the system is running in normal mode, even with administrative rights.
Unless the Self-Defense feature is explicitly disabled via the ESET GUI prior to attempting these changes (which requires local access and a functioning ESET installation), such steps are likely to fail or trigger access-denied errors.
For most reliable and supported results, using the ESET Uninstaller Tool in Safe Mode, as officially recommended by ESET, remains the safest and most effective option — especially when dealing with corrupted or partially uninstalled ESET components.
Hope this helps others avoid confusion or wasted effort. Appreciate the article nonetheless!