Uninstalling password-protected agent software

Prev Next

If you need to uninstall a password protected Endpoint Security Agent (HX) running on your Windows endpoints, you can use the Endpoint Security Agent (HX) Windows Program Manager or the Windows Installer. Only authorized users can uninstall the agent software.

Note

Endpoint Security Agent (HX) versions 26 or later support the Removal Protection Password for Windows endpoints only.

Important

Endpoint Security Agent (HX) removal protection is disabled if Trend Micro AV is running.

Using the Windows Program Manager

This section describes how to uninstall a password-protected agent from your Windows endpoint using the Windows Program Manager.

Important

A reboot is necessary after uninstalling TrellixEndpoint Security Agent (HX) 24.9 and before installing the 25.12 agent.

Note

Artifacts that remain in the C:\Windows\FireEye folder after the agent software has been uninstalled will be deleted the next time the endpoint host is rebooted.

If a Windows agent uninstall attempt fails because the binary is missing or corrupt or because the ProgramData/FireEye or ProgramFiles/FireEye directories are missing or corrupt, reinstall the agent using command-line commands (msiexec /i <agent software installation msi file> /qb) and then uninstall it.

  1. In the Windows Control Panel, select Programs and Features. Depending on your version of Windows, you might have to select Programs before you can select Programs and Features.

  2. Locate FireEye Endpoint Agent in the program list and right-click and select Uninstall.

  3. Select Yes when prompted to confirm that you want to uninstall the agent software and to similar confirmation prompts.

  4. When prompted, enter the uninstall password and click OK. If you are not authorized to remove the agent software from the Windows host or if you enter an incorrect password, the uninstall process will fail.

Using command-line to uninstall a password-protected agent

This section describes how to uninstall password-protection Endpoint Security Agent (HX) software from your Windows endpoint using the command line.

  1. Open a command line prompt on your Windows host.

  2. Use the msiexec /x command to uninstall the password-protected agent software by specifying the name of the agent installation .msi executable file on the host endpoint and appending the /x command with UNINSTALL_PASSWORD=<password>.

    msiexec.exe /x <agent software installation msi file>|<product identifier #> UNINSTALL_PASSWORD=<password>

  3. When prompted to confirm that you want to uninstall the agent software, select Yes.

Uninstalling the agent software in Silent Mode

You can also use the command line to uninstall the agent software silently (without any user prompting) by inputting the password as a property to msiexec. If this property is missing or if the agent uninstall password is incorrect, the uninstall process will fail.

msiexec /x <agent software installation msi file> /qn UNINSTALL_PASSWORD=password

  1. Open a command line prompt on your Windows host.

  2. Use the msiexec /x and /qn commands to uninstall the password-protected agent software in silent mode. Specify the name of the agent installation .msi executable file on the host endpoint and append the /x command with UNINSTALL_PASSWORD=<password>.

    msiexec /x <agent software installation msi file>|<product identifier #>/qn UNINSTALL_PASSWORD=<password>