Taegis Endpoint Agent Uninstall
integrations endpoints edr taegis agent secureworks
Uninstall Taegis™ XDR Endpoint Agents via the function built in to XDR or follow the alternative steps relevant to your OS below.
Uninstall via XDR ⫘
To uninstall one or more agents via the XDR Endpoint Agents page, see Uninstall Taegis Agents.
Note
The Uninstall Agents action is available only for supported Taegis Endpoint Agents that are both Active and Connected. Uninstall Agents is supported by all Windows and Linux versions and macOS version 2.0.9 and later.
Note
Using the Uninstall action within XDR automatically archives the endpoint. See Archive and Unarchive Selected Endpoints for more information on viewing archived endpoints.
Windows Uninstall ⫘
Uninstall the agent via Command Line or Control Panel. An uninstall removes all Taegis Endpoint Agent binaries and registry entries.
Uninstall via Command Line ⫘
There are two options available to uninstall via command line based on your environnment, PowerShell or Command Prompt. All command variations shown below contain an output log to record all uninstall actions.
Uninstall via PowerShell ⫘
At a PowerShell prompt with administrator privileges, use the following command:
$TA_ID_num = Get-WmiObject -Class Win32_Product | Where-Object Name -eq "Taegis Agent" | Select -ExpandProperty IdentifyingNumber
cmd.exe /c msiexec /x$TA_ID_num /quiet /norestart /l*vx C:\ProgramData\SecureWorks\TaegisAgentUninstall.txt
Uninstall via Command Prompt ⫘
At a Command Prompt with administrator privileges, use the following command:
for /f "tokens=2 delims==" %A in ('wmic product where "name='Taegis Agent'" get IdentifyingNumber /format:value') do set ProductID=%A
msiexec /x %ProductID% /quiet /norestart /l*vx C:\ProgramData\SecureWorks\TaegisAgentUninstall.txt
Tip
We recommend adding the /quiet flag for an uninstallation with no interface interaction and the /norestart flag to prevent the endpoint from restarting.
Uninstall via Command Line with Tamper Protection Enabled ⫘
If Tamper Protection is enabled in Agent Group Policies, you must enter the tamper protection token generated in the XDR interface in order to successfully uninstall the agent.
For PowerShell, use:
$TA_ID_num = Get-WmiObject -Class Win32_Product | Where-Object Name -eq "Taegis Agent" | Select -ExpandProperty IdentifyingNumber
cmd.exe /c msiexec /x$TA_ID_num /quiet /norestart TOKEN=<uninstall_token_value> /l*vx C:\ProgramData\SecureWorks\TaegisAgentUninstall.txt
For Command Prompt, use:
for /f "tokens=2 delims==" %A in ('wmic product where "name='Taegis Agent'" get IdentifyingNumber /format:value') do set ProductID=%A
msiexec /x %ProductID% /quiet /norestart TOKEN=<uninstall_token_value> /l*vx C:\ProgramData\SecureWorks\TaegisAgentUninstall.txt
Note
If desired, you may omit the the /quiet flag to manually enter the token using the local workstation interface.
Enter Tamper Protection Token
Uninstall via Control Panel ⫘
- From the Windows Control Panel, go to Programs and Features, select Taegis Agent, and then choose Uninstall.
- Confirm the action, and then select Yes from the User Account Control dialog, entering admin credentials, if prompted.
Note
If Tamper Protection is enabled in Agent Group Policies, you must enter the tamper protection token generated in the XDR UI in order to successfully uninstall the agent.
Enter Tamper Protection Token
- The agent uninstalls with all agent binaries and registry values removed from the endpoint and no uninstall log created.
macOS Uninstall ⫘
Note
If Tamper Protection is enabled in Agent Group Policies, you must enter the tamper protection token generated in the XDR UI in order to successfully uninstall the agent.
- From the menu bar, select the Secureworks® Taegis™ icon, then select Open Secureworks® Taegis™
- Select Uninstall lock from the left, then enter the token copied from Agent Settings in XDR and select Continue.
Enter Tamper Protection Token
- Ensure that the Taegis Endpoint Agent is not running on the system. From the dock, right-click the Taegis icon, then select Quit.
Quit App
- From the Applications folder, locate SecureworksTaegis, right-click, and select Move to Trash to uninstall.
Move to Trash
- A dialog displays a message that the system extensions will also be removed. Select Continue.
Continue to Remove Extensions
- The Taegis Endpoint Agent has been successfully uninstalled.
Linux Uninstall ⫘
Run the following command:
- For Fedora-based distributions like CentOS
yum remove taegis-agent.x86_64 -y
- For Debian-based distributions like Ubuntu
apt remove taegis-agent -y