Uninstalling CSA Agent

[rakeshsharma3000]

I have inherited a laptop from one of our sister concern, which was running CSA. I cannot uninstall the CSA agent since the policy does not permit.

I cannot reinstall the OS due to some programs running on the PC which I do require.

Is there any way to uninstall it without any interaction with CSA MC.

[sachinraja]

This is just for security sake, the CSAMC is used to interact with the HIDS. If you have the CSAMC on the same LAN as the agent, you need to change the mode of the HIDS server before uninstalling the agent. Please do the following:

a. Log into the Console.

b. To display the Agent Management view, click Agents.

c. Select the Agent that is installed on the Console host.

d. If the Agent is in SecureSelect-Warning mode, close the Console.

e. To change the Agent mode to SecureSelect-Warning mode, right-click the Agent and select Set to SecureSelect-Warning Mode.

f. Close the Console.

From the Windows taskbar, select Start > Programs > Cisco HIDS > Cisco HIDS Uninstall.

The Install Shield Wizard appears.

Click Yes in the Uninstall Setup window to remove the Cisco IDS Host Console. The publickey and serverkey are copied to the PreserveKeys folder.

You can try removing the agent by taking off the laptop out of the network and uninstall the same. if it is on the network, please follow the above said procedure.

All the best !!

[rakeshsharma3000]

I don't have the original CSA MC. But I have just found a link about how to uninstall CSA manually from cisco web site. I will check that out and see how it works.

Thanks

[pcomeaux]

If that link doesn't work, please write back and I can tell you another way you can try.

peter

pgc@cisco.com

[rakeshsharma3000]

Hi Peter,

I tried through the registry but the system seems to be unstable now. I took a image of the laptop before doing the registry edit. So I would like to try out other ways of removing it.

[pcomeaux]

There is a way to use a command line command to stop the agent, though the rules on the CSA could prevent the "net stop xxxxxx" command from working.

Also, one of the boot options of a PC can provide a 'safe' way to uninstall the agent.

Please e-mail me at pgc@cisco.com for more information and details.

thanks

peter