remove endpoints

1

Hi, how do we remove endpoints from ERD portal.

2

Hi @dittoit
As you simply install the agent to add an endpoint to EDR, you can simply uninstall the agent from the endpoint to remove it from EDR. Also make sure, the extra registry entries added during the agent installation be removed also.

It’s the reverse steps from what is described in the EDR agent installation guide.

3

I have 14 endpoints that haven’t reported in, in months. I was testing but getting problems so removed the install. But they still remain in the portal…

4

Interesting, what issues you getting with EDR @dittoit ?

5

Currently, cWatch EDR agent doesn’t perform clean uninstall. Therefore you need to:

  1. Uninstall the agent
  2. Delete the registry key Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\COMODO\EDREndpoint (for 64 bits)
  3. Delete C:\Program Files (x86)\COMODO\EDRPoint
  4. Delete C:\ProgramData\COMODO\EDRPoint
6

what sort of problems have you encountered?

7

Ok. Please turn the below into a script :wink:

cheers James

8

Off the top of my head I can’t remember but I think it was performance related.

9

The one thing we do not need on clients machines…
Got to be careful to not require a i7 8GB just to run MS Word :wink:

10

Hi @dittoit

We are progressing the Script for your request. Will update you with perfect result as soon as possible.

Thank you.

11

Hi @dittoit

please refer the below script to

  1. Uninstall the EDR agent
  2. Delete C:\Program Files (x86)\COMODO\EDRPoint
  3. Delete C:\ProgramData\COMODO\EDRPoint

https://scripts.comodo.com/frontend/web/topic/remove-edr-agent-from-endpoints

12

so I sill have endpoints showing in ERD that are no longer online, server decommissioned and my laptop reinstalled, how are these removed?

?? running the above script is impossible !!!

13

Ok, so I sill have endpoints showing in ERD that are no longer online, server decommissioned and my laptop reinstalled, how are these removed?

?? running the above script is impossible !!!

14

Hi @dittoit
By uninstalling the EDR agent , the device from online goes to offline status.but we can’t able to completely remove the device from the endpoint.
Thank you.

15

So what you saying is that there Is no way of removing OLD or offline endpoints from the ERD portal?

if so this is unactable !!! please get the ability to manually delete endpoints on the TODO list !!!

16

Actually, this will be implemented when we handle different license types. It is debatable if manually deleting is a feasible option though. But your point is definitely worth considering. Thanks.

17

@dittoit ,

We understand its necessity. We’ll make the request to our developers for this ability.

18

This is a basic requirement, and is missing from other C1 based products too.

19

Just think of that lovely term everyone seems to be a pro on, GDRP and how holding old out of data like this complies.

20

I got pointed to this thread as an answer to how to delete end points from EDR only to find the answer is you cannot…
I am finding more and more of these examples where products are half baked, half implemented or have some kind of base flaw.