Upgrade from Endpoint Security (HX) to EDRF using third-party tools

When ePO is unavailable, you can upgrade from Endpoint Security (HX) to EDRF using third-party tools.

Follow these steps to upgrade from Endpoint Security (HX) to EDRF:

Prerequisite

Upgrade Endpoint Security (HX) policies to EDRF policies before deploying the EDRF Client.

To upgrade endpoints from Endpoint Security (HX) to EDRF:

This process onboards the endpoint to the EDRF platform.

For more information about policy migration, refer to Upgrade policies from Endpoint Security (HX) to EDRF documentation.

To download the Endpoint Product Removal (EPR) tool from the Trellix product download site:

Access the Trellix product download site using the link:
https://www.trellix.com/downloads/my-products/
Log in using the Grant Number and registered Email Address.
Navigate to the Filters pane on the right and select the Utilities and Connectors checkbox.
Select the latest Endpoint Product Removal Tool version.
Click the Endpoint Product Removal Tool package, and the .zip downloads to your endpoint.

For Windows endpoints

To uninstall xAgent from Windows endpoints, run the EPR tool and uninstall xAgent manually, or run the commands to uninstall in the command line.

To uninstall xAgent manually using the EPR tool:

Extract the downloaded EPR .zip file, and double-click the application icon. You can also run it as an administrator.
Accept the Trellix License agreement.
The tool installs on your endpoint(s).
After installation, the EPR tool displays the list of products installed on your endpoints. Make sure that you select Trellix xAgent and click Remove.
Note
We recommended that you restart your endpoint after the selected products are uninstalled.

Alternatively, to uninstall xAgent using the command prompt, run the following command:

EndpointProductRemoval.exe --accepteula --NOREBOOT --MVISION_EDR --XAGENT

For Linux endpoints

To uninstall the xAgent from Linux endpoints, run the following commands in the terminal based on how it was installed previously.

If xAgent was installed previously via rpm, identify the installed RPM package and then run the following commands:

sudo /opt/Trellix/XClient/bin/uninstall.sh
rpm -qa |grep xagt
sudo rpm -e <installed rpm>

If xAgent was installed previously via debFind, identify the installed debFind package and then run the following commands:

dpkg -l | grep xagt
sudo dpkg --purge xagtor
sudo dpkg -r xagt_dev

For macOS endpoints

To uninstall the xAgent from endpoints running on macOS, run the following command in the terminal:

sudo /Library/FireEye/xagt/uninstall.tool

After uninstalling xAgent, install Trellix Agent on your endpoint(s). For more details, see Install or Upgrade Trellix Agent.

To deploy EDRF Client, add the EDRF Client package to your deployment task.

Alternatively, you can deploy the EDRF Client using any supported third-party deployment tool.