How to remove the Symantec DLP Endpoint Agent (Windows)

The DLP agent is intentionally designed to be difficult to remove for security purposes. Below are the different methods used to uninstall the DLP agent.

Note: Administrative privileges will be required.

Windows Agent Uninstall

Method 1: Use Uninstall_agent batch file

We provide an uninstall_agent.bat / uninstall_agent64.bat with the agent install files.

Follow these steps to use this batch file:

1. Obtain the batch file from the agent install files that were used when installing the agent. See Agent Install Files Information.
2. If the agent was installed with an uninstall password then add that information to the batch file
3. Copy the batch file to the client computer
4. Run the batch file with administrator privileges.

Method 2: Msiexec command line uninstall

This method requires the uninstall password, unless there is not one configured or it has been disabled (see below). There are two options for uninstall via msiexec. The first one is to uninstall using the GUID. The second one is to provide the original .msi file.

GUID Uninstall

1. Login as an administrator user.
2. Start a command prompt (Administrator command prompt if Windows Vista or higher).
3. Run the command: msiexec /x {PRODUCT_ID.EN_US}

Example 14.6 mp2 silent uninstall command line:

NOTE: Substitute the appropriate value from the following table for {PRODUCT_ID.EN_US} in the command line above (include the curly braces).

You can identify which version of the Endpoint Agent is installed by looking at the file version properties of the edpa.exe or by navigating to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Search for the value called “DisplayName” that contains the string “AgentInstall”. The uninstall command (including the Product ID) will be under that key’s UninstallString.

MSI File Uninstall

The .msi file uninstall is useful if the local copy of the install has been removed from the system and when using the GUID method causes a “This installation package could not be opened” error message.

To uninstall with the .msi copy down the AgentInstallX_X_X.msi file (Example: AgentInstall64_15_0.msi) that was used to install the agent on the machine. Note that it must be the same version .msi as the installed agent version. Then run the following command:

The above methods will prompt for an uninstall password if one is configured. If you are unsure what the uninstall password is then can either disable the uninstall password or setup a new uninstall password. These options are only available in DLP 15 and above.

To apply a new uninstall password from the console go to System > Agents > Agent Password.

Once on this page click configure then check the “Apply New Uninstall Password” box. After that, type in the new uninstall password then re-enter the new password in the next field. Now click save. The updated uninstall password will go down to all agents with a good status. If the agent is disconnect and unable to connect it will keep the old uninstall password.

To disable the password go to System > Agents > Overview and select the agents that you want to disable the uninstall password on. Next click the Troubleshoot button and select “Disable Uninstall Password”.

Method 3: Contact Support

Support has additional tools and resources to help remove agents that will not uninstall using the above method. Contact support for further assistance and reference this knowledge base article.

Alternative solution: Disable the agent

As an alternative solution, the agent can also be deactivated. This will stop the services and the agent machine can be used as though the agent was not installed and no policies will be enforced.

To disable the agent go to System > Agent > Overview. Click the box next to the target agent, and the select the shutdown option.

This option can temporarily stop the agent until the machine is restarted, or permanently shut down the agent by stopping the service and setting it to manual.