I am in the process of coming up with a McDonald menu pricing structure, meaning one base price then giving upgrade options. I am able to remove the antivirus using the profile, but i cant find an option to uninstall the EDR, can someone guide me on what to do.
Thanks
Rudy
Hi @rudym12,
Can you please try this script to uninstall EDR and let us know if you had any issues
https://scripts.itarian.com/frontend/web/topic/uninstall-comodo-cwatch-edr-agent-version-2
Kind Regards,
PremJK
Hi @PremJkumar & @rudym12
I’ve tried the script (update time Jan 31,2020) but generates this in both cases from within Configuration Templates / Procedures / “Remove EDR” {procedure name created} / Run as System User & also within the device Run Procedure / LocalUser:
The current EDR version is 2.3.0.195 for this endpoint on this test.
| Finished success | CEDR Agent v2 not installed at Endpoint reg delete HKEY_LOCAL_MACHINE\SOFTWARE\COMODO\EDREndpoint /va /f The operation completed successfully. |
The EDR does not remove itself from the endpoint.
I then tried this Script Here withinConfiguration Templates / Procedures / “Remove EDR v2” {procedure name created} / Run as System User
Worked fine with this output:
| 2020/01/31 03:48:54 PM | Finished success | COMODO cWatch EDR Agent are removed |
I’m not convinced that only one script needs to be run, I ran both so I will continue to test.
After testing more endpoints I’ve found varying results, I ran the same sequence of scripts starting with the Ver2 Script mentioned above and then found this error:
| 2020/01/31 04:02:38 PM | Finished success | COMODO cWatch EDR Agent are not available |
I then ran the script mentioned by @PremJkumar and worked on this particular endpoint.
| 2020/01/31 04:03:50 PM | Finished success | EDR Agent v2 Uninstalled successfully reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\COMODO\EDR Endpoint /va /f The operation completed successfully. |
During some endpoint removals I see this:
| 2020/01/31 04:18:31 PM | Failed | Traceback (most recent call last): File "<string>", line 70, in <module> File "C:\Program Files (x86)\COMODO\Comodo ITSM\lib\subprocess.py", line 540, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command 'msiexec /x {C5ABEFAD-1CC8-4AF3-BC07-1C82A2D42262} /qn' returned non-zero exit status 1618 |
Then run the other procedure it completes:
| 2020/01/31 04:24:54 PM | Finished success | EDR Agent v2 Uninstalled successfully reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\COMODO\EDR Endpoint /va /f |
Seems that certain procedures in order of installation of the EDR would probably influence its removal. I can confirm all EDRs running the 2 scripts did remove from the endpoints and from the Endpoint Manager.
Regards,
Jim
Hi @icttech,
Thank you so much for taking the time to provide your valuable feedback.
We will ask our backend team to check and update the script.
Kind Regards,
PremJK