topic Re: Uninstalling AMP connector from Cloud in Endpoint Security

Uninstalling AMP connector from Cloud

Antonio Macia — Fri, 21 Feb 2020 05:09:11 GMT

Hello,

For those use cases where the administrators don't have access or no longer manages the computer, is it possible to trigger a connector uninstall from the Cloud?

Let's say that a laptop is stolen and we don't want to keep this connector consuming licenses or generating events. Or, with BYOD, the company let their employees install the connector on their personal computer, but once the employee leaves the company, the connector must be uninstalled remotely.

What is the approach for this?

Regards.

Re: Uninstalling AMP connector from Cloud

Marvin Rhoads — Sun, 26 May 2019 11:37:07 GMT

I don't believe this can be done from the console. We can trigger an upgrade remotely on an otherwise unmanaged computer but not an uninstall.

Re: Uninstalling AMP connector from Cloud

Thomas Busch — Sun, 26 May 2019 22:06:17 GMT

At this current time, there is not a way to do a cloud-based uninstall. What you can do however and place the computer into a separate group which has a fairly restrictive policy (Application control for a common program, block common IPs, etc). While it won't guarantee a user will uninstall it increases the chances of it happening.

You can also ensure to delete computer objects that have not checked in for over 30 days by filtering those machines out on the computer page and subsequently removing those that haven't checked in to ensure you don't have allocated licenses to old/unused machines.

Re: Uninstalling AMP connector from Cloud

Troja007 — Mon, 27 May 2019 09:48:18 GMT

Hello @Antonio Macia,

the remote uninstall from the AMP endpoint is important. You may ask your Cisco representative if there are more infos available.
Just a Hint. 😉

BTW, your Cisco representatives can open a Feature Request for you if you see missing features in our product.

Greetings,

Thorsten

Re: Uninstalling AMP connector from Cloud

Antonio Macia — Mon, 27 May 2019 18:57:12 GMT

Thanks Thorsten, I'll do.

In my opinion is a very important feature for the uses cases I mentioned above.

Re: Uninstalling AMP connector from Cloud

rmeyers23 — Fri, 13 Mar 2020 15:37:23 GMT

Any further updates from Cisco on this topic. We are up against our 50,000 seat license and have multiple sites where we would like to initiate and uninstall. Most of the places had to be installed manually so we can't even use something like SCCM.

Re: Uninstalling AMP connector from Cloud

Antonio Macia — Fri, 13 Mar 2020 18:06:08 GMT

Hi,

No news no this topic so far 😞

Re: Uninstalling AMP connector from Cloud

Troja007 — Mon, 16 Mar 2020 10:53:43 GMT

Hello @rmeyers23,

sent you a private Message.

Greetings,

Thorsten

Re: Uninstalling AMP connector from Cloud

g.osborne — Wed, 01 Apr 2020 17:49:27 GMT

I would love to get an update on this as well. We would love to take advantage of the offer from Cisco to over provision during the Covid-19 crisis. Without a way to either block clients from console that have been installed on byod devices it will be impossible.

I thought about placing them in a policy, then deleting the policy when this is over. If the computer is a member of no policy it should not count against license.

Re: Uninstalling AMP connector from Cloud

Antonio Macia — Thu, 02 Apr 2020 06:00:17 GMT

HI @g.osborne ,

Thanks for the input. If the connector is removed from the cloud it does not count as a license, indeed. However, I think that even if you remove the policy, next time the connector connect with the cloud it will the fall under a default policy or such. Let me know if that approach works.

Regards.

Re: Uninstalling AMP connector from Cloud

Troja007 — Thu, 02 Apr 2020 08:51:18 GMT

Hello all,

I´m aware this is a missing feature in our product. If you send me a private message including your company name, size and maybe some info, why this feature is necessary, i will open a Feature Request for you.

Greetings,

Thorsten

Re: Uninstalling AMP connector from Cloud

ppreenja — Fri, 03 Apr 2020 06:24:20 GMT

Hi,

Below enhancement request raised seems to be in place for remotely uninstalling AMP for endpoint connector:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvq81718

I hope that helps answers the query.

Cheers,
Pratham

Re: Uninstalling AMP connector from Cloud

Antonio Macia — Fri, 03 Apr 2020 06:36:17 GMT

Thank you Pratham.