Windows 11 Agent Uninstall via Command Line

Introduction

The Uninstallation of the Endpoint Agent may be required when you are decommissioning a PC or Server and do not want for it to appear in the MDR Portal. This article outlines the process of uninstalling the endpoint from a Windows 11 device using the command line. 

Uninstallation of the Endpoint Agent will result in the device no longer being monitored by Field Effect.

Should the device continue to be used without the Endpoint agent running, the device will be flagged by an appropriate ARO informing you that a Host has been observed to be running without the Endpoint agent installed.

• How do I remove a device from the Endpoint Devices page?

If you are a partner with access to Field Effect Vision, you can use the uninstall actions to schedule, or immediately, uninstall an endpoint agent from a device. See our Action Center article to learn more.

We recommend disabling Endpoint Protection only on the devices you are servicing while keeping the rest of your fleet protected. See our Help Center article on Bulk Editing Endpoints.

Steps

Step 1 - Login

Log into the Endpoint

Step 2 - Open CMD

Open a command window as an administrator

Step 3 - Open PowerShell

c:\>powershell

Step 4 - Locate installation

PS c:\>get-wmiobject Win32_Product | where Vendor -match "Field Effect"

Step 5 - Installation summary

You should now see the details of your installation

IdentifyingNumber : {164SDF7E1-08A6-4E5D-9636-263GGS9395A7}
Name              : Covalence Endpoint Agent
Vendor            : Field Effect Software Inc.
Version           : 3.2.15
Caption           : Covalence Endpoint Agent

Step 6 - Exit PowerShell

PS C:\>exit

Step 7 - Uninstall command

Run the following command ensuring you replace the <IdentifyingNumber> with the value located earlier.

c:\>msiexec.exe /x <IdentifyingNumber> /qn

This would then resemble:

c:\>msiexec.exe /x {164SDF7E1-08A6-4E5D-9636-263GGS9395A7} /qn