Security Compliance

Uninstall and reinstall SEM agents on Windows machines

This article describes how to uninstall and reinstall Security Event Manager (formerly Log & Event Manager) agents on Microsoft Windows machines.

First published date

3/28/2019 4:22 PM

Last published date

10/29/2020 6:24 PM

Overview

This article describes how to uninstall and re-install a SEM agent or a group of agents on one or more Microsoft Windows machines. You may need to perform these steps if:
  • The agent cannot be uninstalled via control panel.
  • You want to uninstall so that you can upgrade to the latest agent version.

Product section

Security Event Manager

Cause

  • Environmental issues like permissions/AV
  • Manual Migration of SEM Appliance

Resolution

Warning: Do not execute the installer from a network share. The installer must be copied onto a local drive to run properly with the correct permissions. No matter what level of user you are logging in with, it is important to right-click the installer and select Run as admin. This is true even if you are a local admin or a domain admin. Do not skip these steps or the admin user rights may fail during the installation procedure or later on during an automatic update from the Appliance.

Uninstall the SEM agent from a remote machine 

  1. Log in to the Customer Portal.
  2. Navigate to the SEM Downloads page.
  3. Download and unzip the SEM Agent Remote Un-installer. 
  4. Open a text file in a text editor (such as Notepad++). 
  5. In the file, create a host list of IP addresses (or hostnames if DNS is working properly), entering one IP address per line.
  6. Locate and access the system where you are uninstalling the SEM agent.
  7. Download the unzipped SEM Agent Remote Un-installer on the system hard drive (not a network share).
  8. Right-click the installer and select Run as admin. 
  9. When prompted, select the Host List option and the host file you created in step 5. If you see all devices you expect in the Automatic list, that is an option.
    The un-install procedure will take several minutes to communicate with each system on your network.

Reinstall the SEM agent on a local machine 

  1. Log in to the Customer Portal.
  2. Navigate to the SEM Downloads page.
  3. Download and unzip the SEM Agent Remote installer.
  4. Locate and access the system where you are uninstalling the SEM agent.
  5. Download the unzipped SEM Agent Remote Un-installer on the system hard drive (not a network share).
  6. Right-click the installer and select Run as admin. 
  7. When the installation is completed, navigate to:
    C:\Windows\SysWOW64
  8. Verify that the ContegoSPOP directory was created during the installation.
  9. Open the ContegoSPOP directory and verify that the following files are included in the directory:
    • communications.xml
    • database_cfg.xml
    • datadictionary.xml
    • hierarchy.trigeo
    • peer.trigeo
    • private.trigeo
  10. Log in to Log and Event Manager.
  11. Click Manage > Nodes.
  12. Verify that the files were created.
    If the files were not created, wait a few minutes and then check again.
    If the files are not created after five to ten minutes, there may be something blocking the initial handshake with the SEM. This is usually caused by either a firewall that is blocking ports or security software (such as anti-virus) blocking the install from completing and may need to be disabled or configured to allow the installation to finish. 

Reinstall the SEM agent on a remote machine 

Test this procedure on a few nodes in a lab environment to make sure there are no issues before you install the SEM agent on your production machines.

  1. Make sure you are logged in as a Domain Admin or Local Admin with the permissions and rights to access the machines on your network that require a SEM agent.
  2. Log in to the Customer Portal.
  3. Navigate to the SEM Downloads page.
  4. Download and unzip the SEM Agent Remote Un-installer.
  5. Open a text file in a text editor (such as Notepad++). 
  6. In the file, create a host list of IP addresses (or hostnames if DNS is working properly), entering one IP address per line.
  7. Locate and access the system where you are uninstalling the SEM agent.
  8. Download the unzipped SEM Agent Remote Un-installer on the system hard drive (not a network share).
  9. Right-click the installer and select Run as admin. 
  10. When prompted, select the Host List option and the host file you created in step 5. If you see all devices you expect in the Automatic list, that is an option.
    The installation procedure will take several minutes to communicate with each system on your network.

Manually Uninstall Agent from a Local Machine

If other uninstallation methods fail, you may have to remove the SEM agent and it's associated service manually. If this is done, you'll have to open up the Add and Remove Programs list in Control Panel after running the script below and have it try to uninstall once more. It should then recognize that the files are no longer present and offer to remove the entry from the list.

Run the following commands one by one in command prompt on the machine with the issue to remove the services and files. The USB-Defender service will only be present if it was selected upon install. 
net stop contego_spop
net stop usb-defender
sc delete contego_spop
sc delete usb-defender
rmdir /s /q C:\Windows\SysWoW64\ContegoSPOP