cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
970
Views
0
Helpful
1
Replies

Looking for a way to remove AMP en masse

JJRF1197
Level 1
Level 1

Hello,

I am a System Admin for a Credit Union. We are moving away from AMP and need to remove it from all of our nodes. I've been researching and found this thread to script a quick command to remove it remotely.

https://community.cisco.com/t5/advanced-threats/scripted-uninstall-of-amp-client/td-p/3851839

I did the script and tested it on my PC, but it didn't really do anything. At one point AMP showed as disconnected, but then reconnected again. Is there any way to create a remote script that I can push out? Or am I doomed to have to touch each node to uninstall it? Any help is greatly appreciated! Thanks.

1 Reply 1

JJRF1197
Level 1
Level 1

Replying to this, i actually found a way to create a command to push out specifically for PDQ (A systems management tool for tracking and organizing hardware, software, and Windows configuration data). Not sure how many people actually use that software, but for those that do, simply create a package that points to the setup.exe, NOT THE UNINSTALL.EXE. Add the silent parameters and if it has been setup with uninstall password, also include it. Here is what the package would look like. 

PDQ package uninstall Cisco Amp.jpg

Make sure to include the silent parameters. /remove 1 is optional in case you want to leave system files for a later re-install.

This works for the version seen here plus the 7.0.5 version as well, as that was the one I had installed.

Hope this helps!