Uninstalling the software

You can uninstall the Advanced EDR software manually from the control panel of the operating system on each computer, or remotely from the Computers menu or from the Computer protection status and Licenses lists.

Manual uninstallation

End users can manually uninstall the security software, if the administrator has not configured an uninstallation password in the security settings profile applied to the computer. If an uninstallation password is required, the end user requires authorization or the necessary credentials to uninstall the software.

To set or delete the agent uninstallation password, see Configuring security against protection tampering.

When you install Advanced EDR, multiple applications are installed, based on the platform:

  • Windows and macOS computers: Agent and protection.

  • Linux computers: Agent, protection, and kernel module.

To completely uninstall Advanced EDR, you must remove all modules. If you only uninstall the security product, the agent will install it again

On a Windows 8 or later device

  • Control Panel > Programs > Uninstall a program.

  • Alternatively, type 'uninstall a program' at the Windows Start screen.

On a Windows Vista, Windows 7, Windows Server 2003, or later device

From 30 September 2024, you will not be able to add devices to the management console or install the protection software on new computers that run these operating system versions: Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008 (Windows 2008 R2 will continue to be supported). Existing computers in the management console will continue to be protected. See https://www.watchguard.com/wgrd-trust-center/end-of-life-policy.

  • Control Panel > Programs and Features > Uninstall or change a program.

On a Windows XP device

  • Control Panel > Add or remove programs.

Uninstallation using the uninstallation tool

On Windows computers, during the uninstallation process, some files or libraries might not be completely removed and cause errors. You can use a Cytomic tool to completely uninstall the agent and protection.

The uninstallation process can take a few minutes. When it is complete, restart the computer.

Follow these steps:

  • Download and unzip the file GU.zip (Password: panda).

  • Run the agent removal file GU_AGENT.exe. Restart the computer.

  • Run the protection removal file DG_PROT.exe. Restart the computer.

On a macOS device

Support for macOS Yosemite, El Capitan, Sierra, High Sierra, and Mojave is only available for customers who purchased Advanced EPDR version 4.30 / 9.30 or earlier.

  • Open Terminal Finder > Applications > Utilities > Terminal.

  • To uninstall the protection software, run this command: sudo sh /Applications/Endpoint-Protection.app/Contents/uninstall.sh

  • To uninstall the agent, run this command: sudo sh /Applications/Management-Agent.app/Contents/uninstall.sh

On a Linux device

On Linux, use the desktop environment to manage the packages included in the distribution.

  • Fedora: Activities > Software > Installed

  • Ubuntu: Ubuntu software> Installed

We recommend that you use the command line as root to uninstall the product. Open a command line. Enter these commands:

$ /usr/local/management-agent/repositories/pa/install --remove

(uninstalls the protection)

$ /usr/local/management-agent/repositories/ma/install --remove

(uninstalls the agent and repositories)

Manual uninstallation result

When you uninstall the Advanced EDR software (Cytomic agent and protection) from a computer, all data associated with the computer disappears from the management console.

When you reinstall the Advanced EDR software, the associated data and counters are restored.

Remote uninstallation

To remotely uninstall the Advanced EDR software on a Windows computer:

  • Go to the Computers menu (or the Licenses or Computer protection status lists). Select the checkboxes for the computers that you want to uninstall the security software from.

  • From the action bar, click Delete. A confirmation dialog box opens.

  • To uninstall the security software, select the Uninstall the Cytomic agent from the selected computers check box.

Remote uninstallation is only supported on Windows platforms. On Linux and macOS platforms, the affected computer is removed from the management console and all of its counters, but it reappears in the next discovery task.