cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
16865
Views
5
Helpful
13
Replies
OwenBrearley2691
Beginner

Scripted uninstall of AMP client

I am trying to automate the removal of the AMP client using our remote management software. I have been testing on a single workstation using the local CLI and have been unable to get a silent uninstall to work correctly. I am finding no errors in the event logs and am not getting any feedback at the prompt.

 

I have tried:

"C:\Program Files\Cisco\AMP\6.2.3\uninstall.exe" /R /S /remove 1 /uninstallpassword password

 

"C:\Program Files\Cisco\AMP\6.2.3\sfc.exe" -X -K password

 

and many variants of the 2. If I use the uninstall.ext without the silent options the uninstall window does come up but obviously this will not work for removing the software on a large scale.

 

Thanks. 

 

2 ACCEPTED SOLUTIONS

Accepted Solutions
Matthew Franks
Cisco Employee

The remote uninstall needs to be run against the installer, not the uninstall.exe or sfc.exe.  For instance:

C:\Users\mafranks\Downloads\AMPSetup.exe /R /S /remove 1 /uninstallpassword Cisco123

 

/remove 1 will remove all associated files, while 0 will keep them for a later install.  If you're on a version less than 5.1.13, use /S instead of /R /S.

 

Hope that helps!

 

Matt

View solution in original post

I just tested with an exe from a different group and policy.  It uninstalled properly with no issues.  If you have policies with different passwords or without a password, you'll need to use a different commands but the exe shouldn't cause any conflicts.

 

Thanks,

Matt

View solution in original post

13 REPLIES 13
Matthew Franks
Cisco Employee

The remote uninstall needs to be run against the installer, not the uninstall.exe or sfc.exe.  For instance:

C:\Users\mafranks\Downloads\AMPSetup.exe /R /S /remove 1 /uninstallpassword Cisco123

 

/remove 1 will remove all associated files, while 0 will keep them for a later install.  If you're on a version less than 5.1.13, use /S instead of /R /S.

 

Hope that helps!

 

Matt

View solution in original post

Thanks Mathew! That worked. We inherited these installs so I am not entirely sure how they were initially deployed. I logged into the portal and pulled down the workstation installer. Will this also work for other groups such as the servers or do they need to use their own customer .exe for the uninstall?

I just tested with an exe from a different group and policy.  It uninstalled properly with no issues.  If you have policies with different passwords or without a password, you'll need to use a different commands but the exe shouldn't cause any conflicts.

 

Thanks,

Matt

View solution in original post

If you do not have the connector protection password, you'll need to boot into safe mode and uninstall the connector.  Then, install with a new installer for the new version.  This is possible since the service doesn't start in safe mode.

If we do no have the password, will the 

/uninstallpassword Cisco123 work?

Hi Alice,

if the product is protected by password, you need the password to uninstall. Example: /uninstallpassword <password>

If not, omit the previous command.

 

 

 

 

 

What if we do NOT have the password? Is there a way to uninstall the application without it?

It’s not possible. Sorry.

If you have access to the console and you see the endpoint communicating back. then just make a copy of the current policy uncheck the box "Enable connector protection" create a new group apply the modified policy to the group. then just move the endpoint or endpoints to the group. they will get the new policy with no password as they check in

Mathew

That is really helpful. I am able to uninstall and re-install amp remotely. 

we have to reinstall AMP to lot of computers as TAC told us that reinstallation will change the GUID. Our problem is duplicated GUID  The removal and installation are going well will all systems but some systems kept their GUID and TAC has no idea why. Do you know why some systems are not changing their GUID? 

When you uninstall AMP, there is a question asked whether you plan to install AMP in the future.  If you select Yes, some information is saved in the registry such as the GUID for continuity in the console.  I recommend selecting No if you have a duplicate GUID issue.  You may also need to restart after the uninstall for this information to be flushed but I haven't tested that.  

 

Thanks,
Matt

Mathew

Thank you for your replay

Yes I always select the 'NO" option at the end of uninstallation

I have also been uninstalling AMP from the command line locally and remotely. C:\temp\AMPSetup.exe /R /S /remove 1

Both method helped me change the GUID for a lot of systems. But now some are not playing well and kept their original GUID. 

Have you checked for Identity Persistence on those policies?  If it is enabled, it will keep the same GUID.  If it is not enabled, try "C:\Program Files\Cisco\AMP\7.3.3\sfc.exe -reregister" to perform a new registration.  Replace 7.3.3 with your current version if you're not on the latest.

 

Thanks,

Matt

Create
Recognize Your Peers
Polls
Which of these topics should we host an event in the Community?

Top Choice: ISE- Guest and Posture Troubleshooting (40%)

Content for Community-Ad