Methods to Uninstall the App Control Agent
search cancel

Methods to Uninstall the App Control Agent

book

Article ID: 286794

calendar_today

Updated On:

Products

Carbon Black App Control

Issue/Introduction

Methods to uninstall the App Control Agent

Environment

  • App Control Agent: All Supported Versions
  • Microsoft Windows: All Supported Versions
  • macOS: All Supported Versions
  • Linux: All Supported Versions

Resolution



Windows

Method 1: Uninstall Via Disabled Mode / Add Remove Programs

When to use: This is the standard method for healthy endpoints that are actively communicating with the App Control Console.

  1. Log in to the App Control Console and navigate to Assets > Computers.
  2. Locate the relevant Agent and move it to a Policy with the Control Mode set to Disabled.
  3. On the endpoint, use Programs and Features (Add/Remove Programs) to uninstall the Carbon Black App Control Agent.
  4. Once uninstalled, return to the Console: Assets > Computers: check the box next to the Agent > Action > Delete Computer.

Method 2: Uninstall via CMD or Script

When to use: Ideal for scripting bulk removals via deployment tools (like SCCM) or when you prefer the command line. Requires a valid CLI password or authorized user/group permissions. See Configuring Agent Management.

  1. Determine the currently installed Agent Product GUID.
  2. Open an administrative command prompt (or use your script) and execute the following, replacing 'InsertCLIPasswordHere' with your actual password and {EnterGUIDHere} with the GUID found in step 1:
    cd "C:\Program Files (x86)\Bit9\Parity Agent"
dascli password InsertCLIPasswordHere
dascli allowuninstall 1
    msiexec.exe /x {EnterGUIDHere} /qn FORCE=1 /L*v "%userprofile%\Desktop\AgentUninstall.log"

Method 3: Uninstall Via Safe Mode

When to use: The endpoint is disconnected from the Console and the CLI password is not being accepted.

Agent Version 8.10+

  1. Boot the machine into Safe Mode.
  2. Disable App Control Agent PPL
    1. Open regedit.exe and navigate to HKLM\System\CurrentControlSet\Services\Parity
    2. Set "LaunchProtected" value to 0
    3. Set "Start" value to 4
  3. Use an administrative command prompt to issue the following command:
    sc config paritydriver start= disabled
    Important: This command must be issued exactly as shown.
  4. Reboot to Normal Mode.
  5. Determine the currently installed Agent Product GUID.
  6. Open an administrative command prompt and issue the command:
    msiexec.exe /x {EnterGUIDHere} /qn FORCE=1 /L*v "%userprofile%\Desktop\AgentUninstall.log"

Agent Version 8.9.6 and lower:

  1. Boot the machine into Safe Mode.
  2. Use an administrative command prompt to issue the following commands:
    sc config parity start= disabled
sc config paritydriver start= disabled
    Important: These commands must be issued exactly as shown.
  3. Reboot to Normal Mode.
  4. Determine the currently installed Agent Product GUID.
  5. Open an administrative command prompt and issue the command:
    msiexec.exe /x {EnterGUIDHere} /qn FORCE=1 /L*v "%userprofile%\Desktop\AgentUninstall.log"

Method 4: Uninstall Using the Agent Uninstall Utility

When to use: The Agent Uninstall Tool should be considered a "Last resort" tool when all other methods (1-3) have failed. It's recommended to open a Support case to confirm this utility is needed before proceeding. Requires a valid CLI password or authorized user/group permissions unless paritydriver is stopped or tamper protection is disabled.

  1. Confirm the version of the utility is equal to or greater than your installed Agent version.
  2. Save the utility to a directory outside the Agent directory (e.g. C:\Temp)
  3. Open an administrative command prompt and execute the following, replacing 'InsertCLIPasswordHere' with your actual password and the -logfile path with the desired location.
    AgentUninstallUtility -password InsertCLIPasswordHere -logfile "%userprofile%\Desktop\Uninstall.log" -uninstall

Post-Uninstall Notes & Troubleshooting:

  • Access Denied: If the uninstall log shows "access denied" errors or authentication failed. Follow steps 1-4 from "Method 3: Uninstall Via Safe Mode" to disable the service and driver, reboot into normal mode, and run the utility again.

  • Reboots: A system reboot is generally not needed unless the uninstall log shows errors removing files/registry keys. If executed on Windows XP or Server 2003, a reboot is required.

  • Test Mode: To run the tool without actually uninstalling anything, remove the -uninstall flag (case-sensitive) from the command. The generated log will include the keyword "TEST" at the beginning of every line. A Global Password is not required for test mode.

macOS

Method 1: Uninstall Via Disabled Mode / Terminal

When to use: This is the standard method for healthy endpoints that are actively communicating with the App Control Console.

  1. Log in to the Console and navigate to Assets > Computers to move the Agent into a Policy that has the Control Mode set to Disabled.
  2. Log in to the endpoint with an administrator account that can run sudo and from a Terminal Window issue the command:
    sudo /Applications/Bit9/uninstall.sh
  3. From the Console, delete the Computer from the Assets > Computers page.

Method 2: Uninstall Via CLI Password / Terminal

When to use: Ideal for scripting bulk removals via deployment tools (like SCCM) or when you prefer the command line. Requires a valid CLI password or authorized user/group permissions. See Configuring Agent Management.

  1. Open terminal, authenticate with the Agent and flag it for uninstall:
    cd /Applications/Bit9/tools
./b9cli --password InsertCLIPasswordHere
./b9cli --tamperprotect 0
  2. Shutdown the Agent and execute the uninstall script:
    ./b9cli --shutdown
sudo /Applications/Bit9/uninstall.sh

Method 3: Uninstall Via Safe Mode

When to use: The endpoint is disconnected from the Console and the CLI password is not being accepted.

  1. Boot the endpoint in Safe Mode.
  2. Log in to the endpoint with an administrator account that can run sudo and from a Terminal Window issue the command:
    sudo /Applications/Bit9/uninstall.sh
  3. Reboot the endpoint and verify the Agent has been successfully removed.

Method 4: Uninstall Via Recovery Mode (If Kernel Panic)

When to use: The endpoint is disconnected from the Console, the CLI password is not being accepted, and the device is having kernel panics.

  1. Boot the endpoint into Recovery Mode
  2. Choose Utilities > Terminal and temporarily disable System Integrity Protection:
    csrutil disable
  3. Reboot to Safe Mode, log in with an administrative account and use Terminal to issue:
    sudo /Applications/Bit9/uninstall.sh
  4. Verify the Agent is removed with the following commands:
    sudo systemextensionsctl uninstall 7AGZNQ2S2T com.vmware.carbonblack.appc-es-loader.appc-es-extension
    sudo rm /Library/LaunchAgents/com.bit9.Notifier.plist
    sudo rm /Library/LaunchDaemons/com.bit9.Daemon.plist
    sudo rm -fR /Applications/Bit9
    sudo rm -fR "/Library/Application Support/com.bit9.Agent"
  5. Reboot to Recovery Mode to re-enable System Integrity Protection via Terminal:
    csrutil enable

Linux

Method 1: Uninstall Via Disabled Mode /Terminal

When to use: This is the standard method for healthy endpoints that are actively communicating with the App Control Console.

  1. Login to the Console and navigate to Assets > Computers to move the Agent into a Policy that has the Control Mode set to Disabled.
  2. Login to the endpoint with an administrator account that can run sudo and from a Terminal Window issue the command:
    cd /opt/bit9/bin
sudo sh ./b9uninstall.sh

Method 2: Uninstall Via CLI Password / Terminal

When to use: Ideal for scripting bulk removals via deployment tools (like SCCM) or when you prefer the command line. Requires a valid CLI password or authorized user/group permissions. See Configuring Agent Management.

  1. Open terminal and issue the commands:
    cd /opt/bit9/bin
./b9cli --password InsertCLIPasswordHere
./b9cli --tamperprotect 0
./b9cli --allowuninstall 1
sudo sh ./b9uninstall

Method 3: Uninstall When b9uninstall.sh Is Missing

When to use: The endpoint is disconnected from the Console, the CLI password is not being accepted, and b9uninstall.sh is missing.

  1. Obtain the b9uninstall.sh script from another endpoint's directory:
    /opt/bit9/bin/b9uninstall.sh
  2. Copy it to the endpoint and follow the steps to either remove via CLI Password or Rescue Mode.

Method 4: Uninstall Via Rescue Mode

When to use: The endpoint is disconnected from the Console and the CLI password is not being accepted.

  1. Boot machine into Rescue Mode.
  2. In terminal issue the commands:
    cd  /opt/bit9/bin
    sudo sh ./b9uninstall.sh

 

All Platforms:

Uninstall Via the App Control Console

WARNING: 
  • Improper configuration could create a situation that would require all Agents in the environment to be reinstalled.
  • Platform Notes with per-Policy Agent Configs:
    • Not all Agent Versions/Platforms support per-Policy Agent Configs.
    • Windows Agent Support: All Supported Versions
    • Linux Agent: Version 8.7.4+ Only (EPCB-8328)
    • macOS Agent: Support pending (EPCB-20260)
  • Proceed with extreme caution!
  1. Log in to the Console and navigate to Rules > Policies.
  2. Click Add Policy and use the following details:
    • Name: Automatic Uninstall (or something memorable)
    • Description: Automatically, and immediately, uninstalls any Agents added to this Policy.
    • Mode: Disabled
    • Automatic Policy Assignment: Unchecked (Only if AD-Based Policy is enabled)
  3. Click Save & Exit.
  4. Navigate to https://ServerAddress/agent_config.php > Add Agent Config
    REMINDER! Limit this Agent Config by Platform to avoid accidental removal of Linux or macOS Agents.
    • Name: Immediate Agent Uninstall (or something memorable)
    • Host ID: 0
    • Value: allow_uninstall=2
    • Platform: Windows
    • Status: Enabled
    • Create For: Selected policies > Policy created in Step 2 (Automatic Uninstall)
  5. Click Save & Exit.
  6. When a connected Agent is successfully moved to the new Policy (Automatic Uninstall) from Assets > Computers it will now be automatically and immediately uninstalled.
    • Agents attempt the uninstall once, when the Config is received.
    • If the OS Installer Service is busy or otherwise fails, the uninstall will not be re-attempted until the Config removed and re-sent to the Agent.

Additional Information

Powered by Wolken Software