Scripted uninstall of AMP client

[OwenBrearley2691]

I am trying to automate the removal of the AMP client using our remote management software. I have been testing on a single workstation using the local CLI and have been unable to get a silent uninstall to work correctly. I am finding no errors in the event logs and am not getting any feedback at the prompt.

I have tried:

"C:\Program Files\Cisco\AMP\6.2.3\uninstall.exe" /R /S /remove 1 /uninstallpassword password

"C:\Program Files\Cisco\AMP\6.2.3\sfc.exe" -X -K password

and many variants of the 2. If I use the uninstall.ext without the silent options the uninstall window does come up but obviously this will not work for removing the software on a large scale.

Thanks. 

[dmiddlebrooks]

Hello Matthew,

I am attempting to uninstall via intune, would the referenced above instructions also apply. I am currently using  Amp.exe /R /S /remove 1 /uninstallpassword

[MartaC]

How can I uninstall Cisco Endpoint without a password? The company that I worked for remotely no longer exists and I still have Cisco Secure Endpoint (from my old job) connected on my personal computer. Since the company doesnt exist anymore, I cannot contact anyone for a password. I've emailed a Cisco frontline agent but they were not able to help me.  I need uninstalled urgently because it's blocking access to certain apps and internet access!

[Matthew Franks]

The connector protection password is intended to prevent users (and malicious actors) from stopping or uninstalling the Cisco Secure Endpoint service so to remove it without the password you would have to re-install Windows. Since this is your personal laptop, you should have the necessary permissions/access. 

Hope that helps,

Matt

[Ahmed-Madibbo]

hello 

if I forget the uninstallation password and I don't have access to the AMP management console, there is any possibility to remove it? 

[David Janulik]

Do you mean that anybody with no access to the mgmt console want to uninstall password protected agent? Of course that is not possible.

[ADS_18]

Hello All,

I'm just wondering if Cisco will soon release a standalone\independent uninstall tool to uninstall Cisco AMP/SE from several PCs running different versions. Or will Cisco stick with this uninstall procedure using the installer of the same version that is currently running on the PC?

In other vendor, there is a standalone uninstall tool you can use to remove a couple of their endpoint security products and the tool expires every after 3 months. 

Thanks.

[Gazza80]

Sorry to hijack this thread, but it is fairly relevant. I'm trying to perform the uninstall via command line (Amp.exe /R /S /remove 1 /uninstallpassword [password]) and it refuses to uninstall.
Running Amp.exe /R /remove 1 /uninstallpassword [password] brings up the uninstall window which then prompts for the password so i know the password is correct. Any ideas as to why this would not be uninstalling?

[Matthew Franks]

@Gazza80 are you using the installer package or sfc.exe?  I just tested and it worked fine for my 8.1.7 installation when using the installer exe.

-Matt

[Gazza80]

Hi Matthew. It's against the installer eg: C:\temp>amp_org_Protect.exe /R /S /remove 1 /uninstallpassword notrealpword)

The verison we are running is 8.0.1.21164

[Matthew Franks]

I suggest opening a TAC case so they can investigate further and if needed, we can file a bug.

Thanks,

-Matt

[Gazza80]

Thanks Matt, will do that.

[oregonporter1]

Please advise if we have various versions of AMP installed in our environment. Would it be possible to uninstall all the previous versions that are installed in various machines, using the latest version of AMP client only, and using the silent installation command:

AMPSetup8.2.exe /R /S /remove 1 /uninstallpassword <Uninstallpwd>