Contents

Uninstall TDR Host Sensors

When you log in to the Threat Detection and Response web UI as an Administrator or Analyst, from the Hosts page you can select an action to remove a Host Sensor from a connected Windows or Mac host. You can also manually uninstall the Host Sensor from the host.

To uninstall a Linux Host Sensor you must use the manual procedures described below. If you manually uninstall a Host Sensor from a host. you can also clear the sensor status in your TDR account so the host does not continue to use a Host Sensor license.

If a host is a member of a Device Group, you can also uninstall Host Sensors or clear the Host Sensor status from the Groups page. For more information, see Manage TDR Groups.

Remove a Host Sensor from the Hosts Page

On the Hosts page in TDR, you can select an action to remove the Host Sensor from a Windows or Mac host. This causes the Host Sensor to automatically start the uninstall process after the next time it connects to your TDR account.

To remove a Host Sensor from a single host:

  1. Log In to the TDR Web UI as an Administrator or Analyst.
  2. Select Devices > Hosts.
  3. In the Install State column for the host to uninstall, click .
    Or, select the host and from the Actions drop-down list select Remove Sensor.

To uninstall a Host Sensor from more than one host:

  1. Log In to the TDR Web UI as an Administrator or Analyst.
  2. Select Devices > Hosts.
  3. Select the check box for one or more hosts.
  4. From the Actions drop-down list, select Remove Sensor.
    If Threat Detection and Response can communicate with the host, the Host Sensor is uninstalled.

If a Host Sensor was originally manually installed, the host is removed from the Hosts list after you uninstall the Host Sensor. If a Windows host was added by AD Helper, the host remains in the Hosts list after you uninstall the Host Sensor, and the Install State for that host changes to Uninstalled.

If the Host Sensor does not connect to TDR after you select the Remove Sensor command, the Host Sensor is not uninstalled. In that case, you can manually remove the Host Sensor and then select the Acknowledge Manually Removed action to remove it from the Hosts list, as described below.

Manually Remove a Host Sensor

To uninstall a Linux Host Sensor, you must manually uninstall it. You can also manually uninstall a Windows or Mac Host Sensor.

If the Prevent Host Sensor Uninstallation setting is enabled in the Host Sensor Settings page, you cannot use the Windows Control Panel or Settings to uninstall a Windows Host Sensor. For more information, see Configure TDR Host Sensor Settings.

Acknowledge a Host Sensor was Manually Removed

After you manually remove a Host Sensor, update the Host Sensor status in your Threat Detection and Response account so that host does not continue to use a Host Sensor license.

  1. Log In to the TDR Web UI as an Administrator or Analyst.
  2. Select Devices > Hosts.
  3. Select the host from which you uninstalled the Host Sensor.
  4. From the Actions drop-down list, select Acknowledge Manually Removed.

See Also

TDR Host Sensor Manual Installation

TDR Host Sensor Automated Installation

Manage TDR Hosts and Host Sensors

Give Us Feedback  ●   Get Support  ●   All Product Documentation  ●   Technical Search