Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Uninstall a Disconnected Agent (Windows)

App Control: Uninstall a Disconnected Agent (Windows)

Environment

  • App Control Agent: All Supported Versions
  • Microsoft Windows: All Supported Versions

Objective

  • Remove an agent disconnected from the console using it's Mac Address

Resolution

Obtain Agent Version and Mac Address:
  1. Login to the CB Protection Console
  2. Navigate to Assets > Computers.
    • Make note of version displayed in the "Agent Version" column.
  3. Login locally to the device being uninstalled.
  4. Open a command prompt
  5. Type in "ipconfig /all"
    • Make note of the MAC address
Obtain Uninstall Key: Using the uninstall key:
  1. Reboot the system in to Safe Mode
  2. Click on Start > Run
  3. Type 'regedit' and hit enter
  4. Browse to:
    1. 32-bit endpoints:  HKEY_LOCAL_MACHINE > Software > Bit9 > Parity Agent > ServerSettings 
    2. 64-bit endpoints:  HKEY_LOCAL_MACHINE > Software > Wow6432Node > Bit9 > Parity Agent > ServerSettings
  5. Click Edit > New > String Value
  6. Name the new key (string value):  B9_UNINSTALL_KEY
  7. Set the value to the uninstall key obtained through the tool
  8. Set the registry key B9_HOST_ENFORCEMENT to 80
  9. Exit Regedit
  10. Type the following in to an admin command prompt (to disable service startup)
    1. sc config "parity" start= disabled
  11. Reboot
  12. You can now uninstall via the control panel as normal.

Additional Notes

If the Global CLI password is known the steps here can be used without entering safe mode

Related Content


Labels (1)
Was this article helpful? Yes No
34% helpful (1/3)
Article Information
Author:
Creation Date:
‎10-28-2014
Views:
23425
Contributors