Uninstalling the Endpoint Agent in Bulk

Introduction

If you are a larger organization, you may need to uninstall a large amount of endpoint agents. It may be more efficient to uninstall these endpoint agents in a "bulk" operation, and this article walks through the options available for bulk editing.

These bulk uninstallation options are only currently supported for automated deployments. Also, due to the very customized nature of this installation type, this article provides guidelines, while assuming you have an understanding of the agent in deployed across you automated environment.

Also, if you have Agent Protection on, it will need to be disabled globally to successfully uninstall all endpoint agents.

See the following articles for more:

Using the PowerShell Script

To use the PowerShell script, you will need to edit the script that you originally used for installations in your deployment tool - paste the uninstall parameter into the command that runs the installation script.

To learn more about PowerShell installations, and what needs to be edited, visit Windows Install PowerShell Script for RMM/MDM.

.(PARAMETER): uninstall A switch that indicates the script should uninstall the MDR agent instead of installing it. If this flag is provided, the script will stop any running services and uninstall the agent from the machine.

powershell ./agent_install_script.ps1 -uninstall

Using the Command Line

The following sections outline the process of using the command line to uninstall our endpoint agent.

Obtaining the product code

You can obtain the product code by running the following command:

wmic product where "name like '%%Field Effect%%'" get IdentifyingNumber

This will be used in the uninstall command.

Running the Uninstall Command

If you want to perform a bulk uninstall from the command line, begin by logging into your automated deployment tool and use the following command:

msiexec.exe /x {PRODUCT-GUID} /qn

Notes:

the /x is for the uninstall (vs /i)
the /qn is for silent uninstall
the {PRODUCT-GUID} should be replaced with the product code obtained in the section above.
key to note that you need to use the MSI version that matches the version of the agents that you want to uninstall

Without Using Windows Management Instrumentation Command-line (WMIC)

You can manually uninstall the Field Effect Covalence Agent by stopping its services and deleting the related files and registry entries using command-line tools and scripts. This method does not require WMIC.

Obtaining the Product Code

The product code can be found in the registry under HKEY_CLASSES_ROOT\Installer\Products\**** and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\**** by searching for 'covalence'.

1 - Stop the Service

Open Command Prompt as Administrator.
Run: sc stop "Covalence Endpoint Service"
Run: sc stop covAgent

2 - Delete Files from Disk

Delete C:\Program Files\Field Effect
Delete C:\ProgramData\Field Effect
Delete C:\Windows\System32\drivers\CovAgent.sys

3 - Delete Registry Entries
Delete HKEY_LOCAL_MACHINE\SOFTWARE\Field Effect
Delete HKEY_CLASSES_ROOT\Installer\Products\ (search for 'covalence')
Delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CovAgent
Delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CovalenceEndpointService
Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Covalence SysTray Launcher
Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ (search for 'covalence')