How to use the clean agent tool to uninstall the DLP agent

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

When uninstalling the agent it may be necessary to use the clean agent tool to remove the agent when the normal DLP agent uninstall procedures do not work.

The clean agent tool is provided by support to assist with uninstall problems. It is only to be run under the direction of support. Do not use clean agent as a primary method to uninstall agents in an environment. When used incorrectly, clean agent can cause further uninstall difficulties.

New Support Policy: The clean agent tool will only be provided on a case by case basis by Broadcom support after reviewing the failed msiexec uninstall logs and determining that clean agent is the appropriate solution.

This utility and its instructions are only to be used on one off situations where Broadcom engineering has deemed it necessary to use this tool see new article: What is the process to request the DLP Clean Agent Tool?

Environment

DLP 15.x, 16.x

Resolution

Before using clean agent, try the recommended uninstall with msiexec /x as described in this KB.

If the above fails then contact support to obtain the clean agent tool.

Clean agent requires that the agent services be stopped before running the tool. To stop the agent use one of the following methods:

• Service_shutdown tool (requires tools password). See this KB.
• Shut down the agent via the console. See this KB
• Contact support if neither of the above options work.

Note that shutting down the agent services by using the service_shutdown tool or the Enforce Console is only required if both EDPA and WDP services are still running on the affected agent. If both services are stopped already, or fail to start, clean_agent utility can be used without any additional actions. Status of the services can be verified by using standard Operating System functionality.

Once the agent is stopped use an administrative command prompt to run the clean_agent.exe. Note: It is recommended to populate the -installdir=<path> parameter.

Example:

clean_agent.exe -installdir="c:\Program Files\Manufacturer\Endpoint Agent"

Items to Note:

• Do not run the clean_agent.exe from the DLP Agent folder.
• Clean agent is backwards compatible with all supported older versions of the agent.
• Clean agent is not fully forward compatible. If using a 16.0 RU2 version of the agent you will want to get the latest version to remove the 16.1 agents. However, using the -installdir=<dir> parameter will usually work around this limitation. The forward compatibility limitation is mostly due to the unknown product ID and the ability to find the proper install path.
• Clean agent may require a reboot and then trying again. It is also recommended to close all other programs before running clean agent. 

If the above fails then contact support following this KB for engineering to determine next steps which in some cases may require the use of the Clean agent tool.

Additional Information

When using the -prompt parameter it is asking if you want clean agent to prompt before running. -prompt=no will uninstall the agent without asking to continue, -prompt=yes will prompt before starting the uninstall.