How to Uninstall the Symantec DLP Endpoint Agent (2024)

Note: Administrative privileges will be required to perform these uninstall steps.

Windows Agent Uninstall

Method 1: Use Uninstall_agent batch file

We provide an uninstall_agent.bat / uninstall_agent64.bat with the agent install files.

Follow these steps to use this batch file:

1. Obtain the batch file from the agent install files that were used when installing the agent. See About the Symantec DLP Agent Install Files.
2. If the agent was installed with an uninstall password, add that information to the batch file.
3. Copy the batch file to the client computer.
4. Run the batch file with administrator privileges.

Method 2: Msiexec command line uninstall

This method requires the uninstall password, unless there is not one configured or it has been disabled (see below). There are two options for uninstalling via msiexec. The first one is to uninstall using the GUID. The second one is to provide the original .msi file.

GUID Uninstall

1. Log in as an administrator user.
2. Start a command prompt (Administrator command prompt if Windows Vista or higher).
3. Run the command (substitute the appropriate value from the table below for {PRODUCT_ID.EN_US} in the uninstall command line (include the curly braces)):

   msiexec /x {PRODUCT_ID.EN_US}


Example 15.8 MP2 silent uninstall command line:

msiexec /x {3A3DF992-BD0A-447D-8A9C-515BE9C2F050} /q UNINSTALLPASSWORD=""

The following command line can be ran in PowerShell to find the GUID for the installed version of the agent

get-wmiobject -Query "select * from win32_Product where name like 'AgentInstall%'" | Format-Table IdentifyingNumber

Note: Although the reasoning behind this has not been determined, MSI's can, at times, store registry information using the reverse of the original product code in the registry. This causes our searches for the original product ID to fail. ( Example: 80F62F21-XXXX-XXXX-XXXX-XXXXXXXXXXXX for 15.5 )

You can identify which version of the Endpoint Agent is installed by looking at the file version properties of the edpa.exe, or by navigating to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Search for the value called "DisplayName" that contains the string "AgentInstall". The uninstall command (including the Product ID) will be under that key's UninstallString.

MSI File Uninstall

The .msi file uninstall is useful if the local copy of the install has been removed from the system and when using the GUID method causes a "This installation package could not be opened" error message.

To uninstall with the .msi copy down the AgentInstallX_X_X.msi file (Example: AgentInstall64_15_0.msi) that was used to install the agent on the machine. Note that it must be the same version .msi as the installed agent version. Then run the following command:

msiexec /x AgentInstall64_15_0.msi -l*v uninstall.log

The above methods will prompt for an uninstall password if one is configured. If you are unsure what the uninstall password is then you can either disable the uninstall password or setup a new uninstall password. These options are only available in DLP 15 and above.

To apply a new uninstall password from the console go to System > Agents > Agent Password.

Once on this page click configure then check the "Apply New Uninstall Password" box. After that, type in the new uninstall password then re-enter the new password in the next field. Now click save. The updated uninstall password will go down to all agents with a good status. If the agent is disconnect and unable to connect it will keep the old uninstall password.

To disable the password go to System > Agents > Overview and select the agents that you want to disable the uninstall password on. Next click the Troubleshoot button and select "Disable Uninstall Password".

Method 3: Contact Support

Contact support for further assistance.

Mac Agent Uninstall

Using the Uninstall Agent Tool

You can uninstall the Mac DLP Agent by running the uninstaller tool from the default agent installation location: /Library/Manufacturer/Endpoint Agent.

Remove the archive attribute from uninstall_agent.

sudo xattr -r -d com.apple.quarantine uninstall_agent

Follow these steps to use the uninstall agent tool:

1. Copy the uninstall_agent tool from the agent install files to the local machine (Note: For best results copy to a temporary folder. Copying to the DLP Agent folder may result in difficulties executing the tool.)
2. Open the Terminal app
3. Run the following commands:

   $chmod +x uninstall_agent
$sudo ./uninstall_agent -verboseR -dumplog

Or you can review uninstall logs on the Terminal application by running this command:

$sudo ./uninstall_agent -prompt=no -log=console

By default, logs are saved to the uninstall_agent.log file in /var/log

Alternative solution: Disable the Mac DLP Agent

As an alternative solution, the agent can also be deactivated. This will stop the services and the agent machine can be used as though the agent was not installed and no policies will be enforced.

To disable the agent

1. Go to System > Agent > Overview.
2. Click the box next to the target agent
3. Click the shutdown option.

This option can temporarily stop the agent until the machine is restarted, or permanently shut down the agent by stopping the service and setting it to manual.