Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

FireAMP agent removal

Sourcefire newbie here...I have to remove FireAMP agents from computers, but I would like to do this from the FireAMP management console.  I know that if you navigate to Management>Computers and you highlight the computer in question you have the option to "Delete" from actions window on the right.  After executing the deletion, the computer will re-appear since the actual agent was never removed from the client side.  How can this process be done from within Sourcefire FireAMP console without actually "touching" the actual computer?

Everyone's tags (1)
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Currently there is no method

Currently there is no method to uninstall the connector from the amp console. This requires touching the computer or some other mechanism.

3 REPLIES
Cisco Employee

Currently there is no method

Currently there is no method to uninstall the connector from the amp console. This requires touching the computer or some other mechanism.

Cisco Employee

Hello,

Hello,

let me highlight some facts about uninstalling connector. Uninstalling SW has been always in hands of Administrators. Windows powershell is one of the way to utilize the process, even using remote execution of the scripts. Each Enterprise has its security policies standards. The cli command goes as: "installer-en-us-64-tcp.exe /remove 1 /S /uninstallpassword ConnectorPassword". Which will delete all associated files/registry entries of AMP product. The switch for "/uninstallpassword" is optional in case the connector service is protected.  To uninstall the connector on the remote connector, powershell can supply with command

enter-pssession –ComputerName hostname

To answer why connectors show up even after deleted from console, is that AMP service sends registration attempt. This re-registers connectors back to the cloud, which is by design.

David

Anonymous
N/A

Have same issue, company

Have same issue, company split but Cisco has no solution to reclaim our connectors or even simply redirect their assets to their console. Year later and still no solution. deleted from console and just checks back in.

1199
Views
5
Helpful
3
Replies
CreatePlease to create content