EDR: How to Remove Sensors from a Decommissioned Server

[#1]

Environment

• EDR Sensors: All versions
• Microsoft Windows
• Linux
• macOS

Objective

How to remove sensors when the server no longer exists from decommissioning or server hardware failure

Resolution

Windows

• EDR: Silently Uninstall Sensor on a Windows Machine
• For Tamper Enabled Sensors
  • EDR: Tamper Protection Password History is Currently Removed when the Group is Deleted

Linux

• EDR: How to Manually Uninstall a Linux Sensor

macOS

• EDR: How to Uninstall a MacOS Sensor?

Additional Notes

• Microsoft Anti Malware Protection Service is used to protect the sensor when Tamper Protection is enabled (for supporting OS's). If Postgres is not available to get the tamper protection password, the only way is to disable the protection service in safemode via the instructions given.