App Control: Uninstall a Disconnected Agent (Windows)

[#1]

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Objective

• Uninstall a disconnected Agent using an Agent Uninstall Key and the endpoint's MAC Address.

Resolution

Obtain Agent Version and MAC Address:

1. Login to the Console
2. Navigate to Assets > Computers.
   • Make note of version displayed in the "Agent Version" column.
3. Login locally to the device being uninstalled.
4. Open a command prompt
5. Type in "ipconfig /all"
   • Make note of the MAC Address

Obtain Uninstall Key:

• https://community.carbonblack.com/t5/Knowledge-Base/App-Control-Where-can-an-agent-uninstall-key-be-...

Using the Agent Uninstall Key:

1. Boot the system into Safe Mode
2. Go to Start > Run > regedit > click OK
3. Browse to:
   1. 32-bit endpoints:  HKEY_LOCAL_MACHINE > Software > Bit9 > Parity Agent > ServerSettings 
   2. 64-bit endpoints:  HKEY_LOCAL_MACHINE > Software > Wow6432Node > Bit9 > Parity Agent > ServerSettings
4. Click Edit > New > String Value
5. Name the new key (string value):  B9_UNINSTALL_KEY
6. Set the value to the uninstall key obtained through the tool
7. Set the registry key B9_HOST_ENFORCEMENT to 80
8. Exit Regedit
9. Type the following in an administrative command prompt (to disable service startup)

   sc config parity start= disabled

10. Reboot to Normal Mode and uinstall the Agent via Add/Remove Programs.

Additional Notes

• If the Global CLI password is known the Agent can be removed manually without an Uninstall Key.
• Alternatively; the Windows Agent can also be uninstalled using the Safe Mode method, without an Agent Uninstall Key.

Related Content

App Control: Where Can an Agent Uninstall Key Be Provided?
App Control: How to Manually Uninstall an Agent (Windows)
App Control: How to Uninstall an Agent via Safe Mode (Windows)
App Control: What methods are available to uninstall a Windows agent?