Uninstall Agents

You can use one of the following methods to uninstall Endpoint agents. Select a method based on your current Endpoint agent version.

Uninstalling Agent using UI (Supported from agent version 11.5.1 and later)

Note: To uninstall an agent using UI, the agent must be a managed agent with version 11.5.1 or later.

You can uninstall agent using UI by going to Hosts and performing one of the following options.

Uninstall one or more agents from Hosts view

  1. Select one or more hosts from which you want to uninstall the agents.
  2. Selected More Actions > Uninstall Selected Agent from the toolbar.

    12.2_endpoint_UninAgnts_1122.png

  3. In the Uninstall Agent dialog, click Uninstall.

    netwitness_uninagntspp.png

Uninstall all the agents from Hosts view

Note: Uninstall All Agents via UI is also supported for Broker service.

    1. Select More Actions > Uninstall All Agents from the toolbar.

Note: For the uninstall all agents option, you do not need to select the hosts. Upgrade All Agents / Uninstall All Agents are the default options on the More Actions drop-down. If you select one or more hosts, the More Actions drop-down shows Upgrade Selected Agent / Uninstall Selected Agent as the available options.

12.2_endpoint_UninAll_1122.png

    1. In the Uninstall All Agents dialog, click Uninstall.

netwitness_uninallpp.png

Note: Uninstall All Agents process will require more time to complete depending upon the number of agents selected based on the filters applied.

Uninstall an agent from Host details view

  1. Select the hostname to open the host details, click netwitness_moreicon.png (More Actions) beside the hostname, and select Uninstall Agent.
    12.2_endpoint_Uninstllagnt_hostdetails_1122.png
  2. In the Uninstall Agent dialog, click Uninstall.

  3. After the agent is uninstalled, Agent Last Seen is updated and the host is grayed out in the Hosts view.
    12.2_endpoint_Uninstalled_hosts_1122.png

    Note: Once an agent is uninstalled, only Delete and Analyze Events actions can be performed on it.

    IMPORTANT: If you are uninstalling agent using UI, the uninstalled host data would be retained based on Inactive Agents Retention Policy.

Inactive_agents_ret_pol_highlighted.PNG

Uninstalling Agent Manually

Uninstalling Windows Agent

Run the following command as administrator:

msiexec /x{63AC4523-5F19-42F0-BC43-97C8B5373589}

Uninstalling Linux Agent

For RPM based Linux, run the following command as root:

rpm –ev nwe-agent

For Debian based Linux, run the following command as root:

dpkg -r nwe-agent

Uninstalling Mac Agent

Run the following commands:

  1. sudo launchctl unload /Library/LaunchDaemons/com.rsa.nwe.agent.daemon.plist

  2. sudo rm -Rf /usr/local/nwe
  3. sudo rm -Rf '/Library/Application Support/NWE'
  4. sudo rm –Rf /Library/LaunchDaemons/com.rsa.nwe.agent.daemon.plist
  5. sudo pkgutil –-forget com.rsa.pkg.nwe