Uninstalling agents

There are several ways to uninstall an agent. Administrator privileges are required, and the operation must also be allowed in the agent group configuration, except for the challenge-based method. For further information, refer to the section Allowing administrators to uninstall agents.

To uninstall several agents via a GPO, MECM (formerly SCCM), etc., run the executable EsSetupWorker.exe located in the installation_folder\SES Evolution\Agent\Bin. The default installation folder is C:\Program Files.
To uninstall an agent from an individual workstation, use the Uninstall menu in Programs and Features in the Windows control panel. EsSetup.exe is the program that will be run. If you want to use it in a script, refer to the section on Using the EsSetup command to find out which options it offers.
To uninstall an agent without administration privileges, using challenges, refer to the section Resolving issues with challenges.
If none of the above methods work, you can force an uninstall with the AgentRemovalTool.exe tool. Refer to the section below on how to use the tool.

In any case, the uninstallation takes effect only after the workstation has been restarted. All files associated with the agent will be deleted except the registry key HKEY_LOCAL_MACHINE\Software\Stormshield\SES Evolution containing the agent’s unique ID, which can be reused for a future installation.

The log file that captured the uninstallation will also be kept in the temporary folder of the user who uninstalled the agent.

Forcing agent uninstallation

If standard uninstallation methods do not work, download the AgentRemovalTool.exe tool from your MyStormshield client area (32-bit and 64-bit versions available in the section Downloads > StormshieldEndpoint Security > Evolution > Tools). In command line, the tool allows you to force the agent to uninstall from the workstation in Windows safe mode.

To force the uninstallation of an agent, follow the steps below: Repeat the operation twice:

The first time in Windows safe mode,
The second time in normal Windows start mode.

Administration privileges are required to run the tool.

Start the workstation in safe mode.
If necessary, show help with the command AgentRemovalTool.exe --help.
Ensure that the tool detects the right version of the agent installed on the workstation by using the command AgentRemovalTool.exe --supported-versions.
Run the command AgentRemovalTool.exe --remove to start uninstalling the agent.
Select menu number 1. Menu number 2 is not available in safe mode.
Next, start the workstation in "standard" mode.
Run the command AgentRemovalTool.exe --remove again.
Select menu number 2. Menu number 1 is not available in "standard" mode.
Once you have completed these steps, the agent will be uninstalled correctly.
Select menu number 3 to quit the tool.

The following commands are also available in safe and standard modes:

If the tool is unable to detect the version of the agent installed, the command AgentRemovalTool.exe --remove --agent-version "2.3.2.0" makes it possible to indicate which version to remove.
If the agent failed to uninstall at the first attempt with the tool, the command AgentRemovalTool.exe --remove --force makes it possible to launch a second attempt.

`/silent or /s`	Hides the progress bar while the agent is being uninstalled or repaired.
/Repair	Launches an integrity check and an agent repair.
/Log <path>	Specifies the path of the agent’s log file.
/NewAgentId	Deletes data regarding the agent’s communication with the agent handler: unique ID, certificates used internally, as well as the ID and private data used in challenges. The agent retrieves new data the next time it connects to the agent handler.