Uninstall/ Remove AMP Secure Endpoint

[Ah15]

Is there a way to uninstall the Cisco AMP connector from all devices at the same time, instead of logging into each device and uninstalling it manually?

[Ken Stieers]

Not from the cloud.
Do you have a deployment tool? SCCM? PDQ Deploy? Intune?

[hbonagiri-consultant]

What is the process to uninstall Cisco AMP via SCCM ?

[Ken Stieers]

Take a look at this registry key on your machines:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Immunet Protect

The quiet uninstall string is something like this. "C:\Program Files\Cisco\AMP\8.2.3.30119\uninstall.exe" /S
You could probably try all of the various versions, there should be only one copy of the uninstall.exe in the tree.

You will probably want to set the policy to NOT have an uninstall password so it goes smoothly






________________________________

This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this communication in error, please immediately notify us by telephone and return the original message to us at the listed email address.
Thank You.

[pmedinac · Accepted solution]

Hey @Ah15 

At the moment we don´t have any feature to remove the agent massively from different endpoints.

We are working on the feature development.

-- Pedro

[granthow1]

I created a Powershell script that can uninstall AMP automatically... Run the script as admin and give it time to uninstall. As this program gave me a headache and I was not going to go to each server to uninstall it.  The below code is work in progress but it worked for me. If you have a different version of AMP then just edit the file location. I am not sure why Cisco would create a program for mass and not have the ability to uninstall the program. I hope this helps others

# Start the uninstallation process
$process = Start-Process -FilePath "C:\Program Files\Cisco\AMP\7.4.3.20630\uninstall.exe" -ArgumentList "/s /qn /force" -PassThru

# Wait for the process to start and the window to appear
Start-Sleep -Seconds 10 # Increased wait time

# Send keys to navigate and confirm
Add-Type -AssemblyName System.Windows.Forms
Start-Sleep -Milliseconds 500 # Small delay before sending keys
[System.Windows.Forms.SendKeys]::SendWait("{TAB}")
Start-Sleep -Milliseconds 500
[System.Windows.Forms.SendKeys]::SendWait("{TAB}")
Start-Sleep -Milliseconds 500
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")
Start-Sleep -Seconds 1
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")
Start-Sleep -Seconds 50
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")
Start-Sleep -Seconds 10
[System.Windows.Forms.SendKeys]::SendWait("{TAB}")
Start-Sleep -Seconds 2
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}")

# Wait for the final close prompt
$closePromptTitle = "Uninstallation Complete" # Replace with the actual title of the close prompt if different
Start-Sleep -Seconds 30 # Wait for the prompt to appear

# Check if the close prompt window is active
if (Get-Process | Where-Object { $_.MainWindowTitle -like "*$closePromptTitle*" }) {
Start-Sleep -Seconds 1 # Give it a moment
[System.Windows.Forms.SendKeys]::SendWait("{ENTER}") # Close the prompt
}