Uninstall TDR Host Sensors

When you log in to your Threat Detection and Response account as an Administrator or Analyst, from the Hosts page you can select an action to remove a Host Sensor from a connected Windows or Mac host. You can also manually uninstall the Host Sensor from the host.

To uninstall a Linux Host Sensor you must use the manual procedures described below. If you manually uninstall a Host Sensor from a host, you can also clear the sensor status in your TDR account so the host does not continue to use a Host Sensor license.

If a host is a member of a Device Group, you can also uninstall Host Sensors or clear the Host Sensor status from the Groups page. For more information, go to Manage TDR Groups.

Remove a Host Sensor from the Hosts Page

On the Hosts page in TDR, you can select an action to remove the Host Sensor from a Windows or Mac host. This causes the Host Sensor to automatically start the uninstall process after the next time it connects to your TDR account.

To remove a Host Sensor from a single host:

  1. Log In to TDR.
  2. Select Monitor > Threat Detection.
  3. In the Devices / Users section, select Hosts.
  4. In the Install State column for the host to uninstall, click .
    Or, select the host and from the Actions drop-down list select Remove Sensor.

To uninstall a Host Sensor from more than one host:

  1. Log In to TDR.
  2. Select Monitor > Threat Detection.
  3. In the Devices / Users section, select Hosts.
  4. Select the check box for one or more hosts.
  5. From the Actions drop-down list, select Remove Sensor.
    If Threat Detection and Response can communicate with the host, the Host Sensor is uninstalled.

If a Host Sensor was originally manually installed, the host is removed from the Hosts list after you uninstall the Host Sensor.

If the Host Sensor does not connect to TDR after you select the Remove Sensor command, the Host Sensor is not uninstalled. In that case, you can manually remove the Host Sensor and then select the Acknowledge Manually Removed action to remove it from the Hosts list, as described below.

Manually Remove a Host Sensor

To uninstall a Linux Host Sensor, you must manually uninstall it. You can also manually uninstall a Windows or Mac Host Sensor.

If the Prevent Host Sensor Uninstallation setting is enabled in the Host Sensor Settings page, you cannot use the Windows Control Panel or Settings to uninstall a Windows Host Sensor. For more information, go to Configure TDR Host Sensor Settings.

  1. On the computer where the Host Sensor is installed, open Control Panel > Programs > Programs and Features.
  2. Find the Threat Detection and Response application.
  3. Right-click the application and select Uninstall.
    The Threat Detection and Response Setup Wizard opens.
  4. On the Remove Installation page, you can choose to remove the Host Sensor completely or you can choose a partial uninstallation.
    1. Select No if you want to remove TDR but keep your settings and log files. If you plan to upgrade or reinstall TDR, select this option.
    2. Select Yes if you want to completely remove TDR and all of its components.
  5. Click Next.
  6. Click Remove to complete the uninstallation.
  1. On the Windows host where the Host Sensor is installed, as an administrator, open a Command Prompt.
    A Command Prompt window opens.
  2. Type this command:

msiexec /x "{Account UUID}" /quiet FULLCLEAN=true

To uninstall a Windows Host Sensor from the same directory as the downloaded Windows Installer package:

  1. Navigate to the directory where you downloaded the Host Sensor and, as an administrator, open a Command Prompt.
    A Command Prompt window opens.
  2. Type this command:

msiexec /x [host_sensor msi file] /quiet FULLCLEAN=true

These commands will uninstall TDR and all of its files and folders. If you want to keep your log files or if you plan to reinstall TDR at a later time, we recommend you uninstall TDR through the Windows Control Panel.

  1. On the Mac host where the Host Sensor is installed, in Finder, select Applications > WatchGuard > TDR.
  2. Double-click the file TDRHostSensorUninstall.
  3. Click OK.
  4. Type your password.
    The Host Sensor is uninstalled and related files are removed.
  1. On the Mac host where the Host Sensor is installed, open the Terminal application.
    A command line window opens.
  2. Type this command:

sudo /usr/local/watchguard/tdr/uninstall_hostsensor.sh /usr/local/watchguard/tdr

  1. Type your password and press Enter. Tip!
    The Host Sensor is uninstalled and this text appears: Forgot package 'com.watchguard.tdr.hostsensor.daemon' on '/'.
  1. Log in to the Linux host as a user with root access.
  2. Type this command:

yum erase host_sensor.x64_64

Acknowledge a Host Sensor was Manually Removed

After you manually remove a Host Sensor, update the Host Sensor status in your Threat Detection and Response account so that host does not continue to use a Host Sensor license.

To acknowledge a Host Sensor was manually removed:

  1. Log In to TDR.
  2. Select Monitor > Threat Detection.
  3. In the Devices / Users section, select Hosts.
  4. Select the host from which you uninstalled the Host Sensor.
  5. From the Actions drop-down list, select Acknowledge Manually Removed.

Related Topics

TDR Host Sensor Manual Installation

TDR Host Sensor Automated Installation

Manage TDR Hosts and Host Sensors