FireAMP agent removal

[Jose Cisneros]

Sourcefire newbie here...I have to remove FireAMP agents from computers, but I would like to do this from the FireAMP management console.  I know that if you navigate to Management>Computers and you highlight the computer in question you have the option to "Delete" from actions window on the right.  After executing the deletion, the computer will re-appear since the actual agent was never removed from the client side.  How can this process be done from within Sourcefire FireAMP console without actually "touching" the actual computer?

[miculp · Accepted solution]

Currently there is no method to uninstall the connector from the amp console. This requires touching the computer or some other mechanism.

[David Janulik]

Hello,

let me highlight some facts about uninstalling connector. Uninstalling SW has been always in hands of Administrators. Windows powershell is one of the way to utilize the process, even using remote execution of the scripts. Each Enterprise has its security policies standards. The cli command goes as: "installer-en-us-64-tcp.exe /remove 1 /S /uninstallpassword ConnectorPassword". Which will delete all associated files/registry entries of AMP product. The switch for "/uninstallpassword" is optional in case the connector service is protected.  To uninstall the connector on the remote connector, powershell can supply with command

enter-pssession –ComputerName hostname

To answer why connectors show up even after deleted from console, is that AMP service sends registration attempt. This re-registers connectors back to the cloud, which is by design.

David

[#4]

Have same issue, company split but Cisco has no solution to reclaim our connectors or even simply redirect their assets to their console. Year later and still no solution. deleted from console and just checks back in.