topic Re: Uninstall Issue in Endpoint Security

Uninstall Issue

tonynray — Fri, 21 Feb 2020 05:08:07 GMT

Anybody ever have issues uninstalling AMP? I have a handful of computers still with v6.2.5 on them that I have been trying to upgrade to 6.2.9, but the upgrade fails because the 6.2.5 service can't be stopped. Even after a reboot, the service just can't be stopped. I've tried uninstalling with the same issue. My policies do use a password so the command lines I've tried include the uninstall password which work 99% of the time, but for some reason the service isn't stopping in these cases.

The install log shows this:

(33169150, +0 ms) Feb 27 09:13:26 [1000]: caLogMessageW: StopAgentServiceWithRetry: Service stop returned -1
(33169150, +0 ms) Feb 27 09:13:26 [1000]: caLogMessageW: StopAgentServiceWithRetry: Restarting service
(33169150, +0 ms) Feb 27 09:13:26 [1000]: caServiceStart: in RunService CiscoAMP_6.2.5
(33169150, +0 ms) Feb 27 09:13:26 [1000]: caServiceStart: Checking current service status
(33169150, +0 ms) Feb 27 09:13:26 [1000]: caServiceStart: Service is already running
(33169150, +0 ms) Feb 27 09:13:26 [1000]: caServiceStop: in caServiceStop CiscoAMP_6.2.5
(33169150, +0 ms) Feb 27 09:13:26 [1000]: caServiceStop: Stopping Service
(33169150, +0 ms) Feb 27 09:13:26 [1000]: ERROR: caServiceStop: ControlService failed : 1052 : The requested control is not valid for this service.

(33169150, +0 ms) Feb 27 09:13:26 [1000]: ERROR: caServiceStart: Unable to stop service
(33169650, +500 ms) Feb 27 09:13:27 [1000]: caLogMessageW: StopAgentServiceWithRetry: Service stop attempt: 4

If I have to open a TAC case I will, just curious if anybody has run into something like this.

Re: Uninstall Issue

Matthew Franks — Wed, 27 Feb 2019 15:26:21 GMT

I haven't seen anything like this unless your command prompt isn't run as an Administrator. Can you post the command you're using to try to uninstall via the command line? Should look like this (if 123456 is your password):
Protect_FireAMPSetup.exe /R /S /remove 0 /uninstallpassword 123456

Thanks,

Matt

Re: Uninstall Issue

tonynray — Wed, 27 Feb 2019 15:30:26 GMT

Matt, I should have waited 30 minutes before posting this... I found a workaround. Create a new policy WITHOUT a password, move the endpoint to that policy in the Console, wait (forever, it seemed), once the client updated to the new policy serial number, I was able to stop the service manually then upgrade to 6.2.9 successfully.

FYI - that is the EXACT uninstall string I was using. No clue why it couldn't stop the service, but it wouldn't for some reason.

Re: Uninstall Issue

Matthew Franks — Wed, 27 Feb 2019 15:33:07 GMT

I'm glad you got it sorted out. Please let us know if you hit any other weird issues.

Thanks,

Matt