Uninstalling the software

On 30 June 2025, our Windows and Mac protection for these OS versions will become End of Life (EOL): Windows XP, Vista, Server 2003, Server 2008 (Windows 2008 R2 will continue to be supported), macOS Yosemite, El Capitán, Sierra, High Sierra and Mojave. After the EOL date, the product license will be automatically removed from all computers that run these OS versions, and you will not be able allocate licenses to affected computers. Computers without a license will have all protections disabled, lose access to Collective Intelligence, stop receiving signature file updates, and cease to run assigned tasks. See https://www.watchguard.com/wgrd-trust-center/end-of-life-policy.

You can uninstall the Advanced EDR software manually from the control panel of the operating system on each computer, or remotely from the Computers menu or from the Computer protection status and Licenses lists.

Manual uninstallation

End users can manually uninstall the solution, if the administrator has not configured an uninstallation password in the security settings profile applied to their computer. If an uninstallation password is required, the end user requires authorization or the necessary credentials to uninstall the software.

To set or delete the agent uninstallation password, see Password-protection of the agent.

When you install Advanced EDR, multiple applications are installed, based on the platform:

  • Windows and macOS computers: Agent and protection.

  • Linux computers: Agent, protection, and kernel module.

To completely uninstall Advanced EDR, you must remove all modules. If you uninstall the protection module only, the agent will install it again.

On Windows 8 or higher:

  • Control Panel > Programs > Uninstall a program.

  • Alternatively, type 'uninstall a program' at the Windows Start screen.

On Windows Vista, Windows 7, Windows Server 2003, and higher

  • Control Panel > Programs and Features > Uninstall or change a program.

On Windows XP

  • Control Panel > Add or remove programs.

Uninstall using the uninstallation tool

With Windows, it is possible that some files or libraries are not completely deleted during the normal uninstallation process, which might cause error messages to appear. In this case, you must use the tool provided by Cytomic to complete the uninstallation of the agent and the protection.

This uninstallation process might take several minutes. After the process is complete, restart the computer.

Follow these steps:

  • Download and extract the contents of GU.zip (password "panda").

  • Run the agent uninstallation file GU_AGENT.exe. Restart the computer.

  • Run the protection uninstallation file GU_PROT.exe. Restart the computer.

On a macOS device

  • Open the Command Menu from: Finder > Applications > Utilities > Terminal

  • To uninstall the protection software, run this command: sudo sh /Applications/Endpoint-Protection.app/Contents/uninstall.sh

  • To uninstall the agent, run this command: sudo sh /Applications/Management-Agent.app/Contents/uninstall.sh

On Linux

On Linux, use the desktop environment to manage the packages included in the distribution.

  • Fedora: Activities > Software > Installed

  • Ubuntu: Ubuntu software> Installed

We recommend that you use the command line as root to uninstall the product. Open a command line. Enter these commands:

$ /usr/local/management-agent/repositories/pa/install --remove

(uninstalls the protection)

$ /usr/local/management-agent/repositories/ma/install --remove

(uninstalls the agent and repositories)

Manual uninstallation result

When you uninstall the Advanced EDR software (Cytomic agent and protection) from a computer, all data associated with the computer disappears from the management console: all counters, entries in reports, and details of the computer’s activity.

When you reinstall the Advanced EDR software, the associated data and counters are restored.

Remote uninstallation

To remotely uninstall the Advanced EDR software on a Windows computer:

  • Go to the Computers menu (or the Licenses or Computer protection status lists), and select the checkboxes for the computers whose protection you want to uninstall.

  • From the action bar, click Delete. A confirmation window is displayed.

  • In the confirmation window, select the Uninstall the Cytomic agent from the selected computers checkbox to completely remove the Advanced EDR software.

Remote uninstallation is only supported on Windows platforms. On Linux and macOS platforms, the affected computer is removed from the management console and all of its counters, but it reappears in the next discovery task.