topic Re: Workstation still thinks Cisco AMP is installed in Endpoint Security

Workstation still thinks Cisco AMP is installed

josh.goodin — Wed, 14 Feb 2024 15:31:50 GMT

Amp service would not start. I removed AMP from the Workstation. Tried to reinstall it after a reboot. Now it thinks I am trying to upgrade from an old version. What needs to be clean off so that it does not think an old version of Amp is installed on this workstation?

Re: Workstation still thinks Cisco AMP is installed

Matthew Franks — Wed, 14 Feb 2024 16:16:33 GMT

Josh,

When you uninstall there is an option that asks if you plan to install AMP (Secure Endpoint) again. You probably selected yes, so the older files weren't deleted. Check for a 6.3.1 folder in the C:/Program Files/Cisco/AMP directory. If it exists, delete it and try again. Otherwise, there might be a lingering registry entry that you'll have to delete. If you have trouble finding it, TAC can help if you open a case.

Thanks,

Matt

Re: Workstation still thinks Cisco AMP is installed

npetrele — Wed, 14 Feb 2024 16:46:11 GMT

Revouninstaller is great for this sort of thing. After you install whatever version (it doesn't matter), use Revo to uninstall it. It scans the registry and folders for leftover registry values and files and lets you delete them. Then you have a clean system and can install the version you want.

Re: Workstation still thinks Cisco AMP is installed

ghhfgh — Fri, 24 Jan 2025 20:08:45 GMT

I have the same problem too now. Took same steps to get to this point. I deleted all the registries under AMP, Cisco, Endpoint and its still giving me the same message. Was anyone able to resolve this?

Re: Workstation still thinks Cisco AMP is installed

ccieexpert — Sat, 25 Jan 2025 08:35:48 GMT

you may want to open a TAC case so that they might further ideas of what is lingering..

Re: Workstation still thinks Cisco AMP is installed

kailandrew60 — Wed, 19 Mar 2025 17:27:21 GMT

@josh.goodin wrote:
Amp service would not start. I removed AMP from the Workstation. Tried to reinstall it after a reboot. Now it thinks I am trying to upgrade from an old version. What needs to be clean off so that it does not think an old version of Amp is installed on this workstation? family run plumbing

You need to clean up leftover files and registry entries from the previous AMP installation. First, uninstall AMP completely. Then delete any remaining AMP-related folders in Program Files and AppData. Open Registry Editor (regedit), search for and delete AMP-related keys under HKEY_LOCAL_MACHINE\SOFTWARE and HKEY_CURRENT_USER\SOFTWARE. Reboot the workstation before reinstalling AMP.

Re: Workstation still thinks Cisco AMP is installed

David Janulik — Mon, 17 Mar 2025 07:57:40 GMT

First you should use msi installer to uninstall and log any remnant information. This location might vary. The complete msi help invoke with /? option

msiexec.exe /uninstall "C:\Program Files\Cisco\AMP\8.4.3.30374\SecureClientUI.msi" /l+v* "C:\ProgramData\Cisco\Cisco Secure Client\SecureClientUI.msi.log"

Very last thing is to open SR case with TAC to supply with uninstall script. Share the msi log beforehand, please.

Re: Workstation still thinks Cisco AMP is installed

David Janulik — Fri, 21 Mar 2025 09:12:45 GMT

Hello,

we don't want to disclose the Windows system registry location. The standard way if you run in race condition is via SR ticket. Tac can help you with Powershell script (verified).

Thanks

David