Uninstall the Endpoint Software

Applies To: WatchGuard Advanced EPDR This topic applies to the WatchGuard Advanced EPDR endpoint security product., WatchGuard EPDR This topic applies to the WatchGuard EPDR endpoint security product., WatchGuard EDR This topic applies to the WatchGuard EDR endpoint security product.,WatchGuard EDR Core This topic applies to the WatchGuard EDR Core endpoint security product., WatchGuard EPP This topic applies to the WatchGuard EPP endpoint security product.

You can uninstall the endpoint software locally from the control panel of the operating system on each computer, or for Windows, Mac, and Linux computers, you can uninstall remotely from the Endpoint Security management UI.

When you uninstall Endpoint Security from a computer, all data associated with the computer disappears from the management UI. When you reinstall the software, the associated data and counters are restored.

Manual Uninstallation

End users can manually uninstall Endpoint Security, if the administrator has not configured an uninstallation password in the security settings profile applied to the computer. If an uninstallation password is required, the end user requires authorization or the necessary credentials to uninstall the software.

When you install the Endpoint Security software, multiple applications are installed, based on the platform:

• Windows and Mac Computers — WatchGuard Agent and Endpoint Security product
• Linux Computers — WatchGuard Agent, Endpoint Security product, and kernel module
• Android Devices — Endpoint Security product
• iOS Devices — Endpoint Security product and MDM solution management profile

To completely uninstall Endpoint Security, you must remove all modules. If you only uninstall the endpoint security product, the agent will install it again.

Windows Computers

To uninstall Endpoint Security on a Windows 8 or later computer:

1. Open the Control Panel.
2. Select Programs > Uninstall a Program.
3. Select WatchGuard Agent.

4. Right-click and select Uninstall.
5. If prompted, enter the uninstall password. For more information, go to Remove Password Requirement to Uninstall WatchGuard Endpoint Security.
   If requested, do not restart the computer at this time.
6. Select WatchGuard Advanced EPDR, EPDR, EDR, EDR Core, or EPP.
7. Click Uninstall.
8. If prompted, enter the uninstall password.
9. When Endpoint Security is uninstalled, restart the computer.

During the uninstallation process, some files or libraries might not be completely removed and cause errors. You can use this tool to completely uninstall the agent and protection. The uninstallation process can take a few minutes.

To uninstall Endpoint Security with the uninstallation tool:

1. Download and unzip the file GU.zip (Password: panda).
2. Run the agent removal file GU_AGENT.exe.
3. Restart the computer.
4. Run the protection removal file GU_PROT.exe.
   The uninstallation process can take a few minutes.
5. When the uninstallation completes, restart the computer.

Mac Computers

Manual uninstallation on Yosemite, El Capitan, Sierra, High Sierra, or Mojave Mac computers is only available with Endpoint Security version 4.30 or 9.30, or earlier.

To uninstall Endpoint Security on a Mac device:

1. Open Terminal Finder > Applications > Utilities > Terminal.
2. To uninstall the protection software, run this command: sudo sh /Applications/Endpoint-Protection.app/Contents/uninstall.sh
3. To uninstall the agent, run this command: sudo sh /Applications/Management-Agent.app/Contents/uninstall.sh

Android Devices

To uninstall Endpoint Security on an Android device:

1. Open Settings and navigate to Security > Device Administrators.
2. Clear the WatchGuard Advanced EPDR, WatchGuard EPDR, WatchGuard EDR, WatchGuard EDR Core, or WatchGuard EPP check box.
3. Tap Disable > OK.
4. In Settings, tap Apps.
5. Tap WatchGuard Advanced EPDR, WatchGuard EPDR, WatchGuard EDR, WatchGuard EDR Core, or WatchGuard EPP > Uninstall > OK.

Linux Devices

On Linux devices, use the desktop environment to manage the packages included in the distribution.

Fedora: Activities > Software > Installed

Ubuntu: Ubuntu software> Installed

We recommend that you use the command line as root to uninstall the product. Use the --totp parameter if two-factor authentication is enabled, and --pass if agent uninstallation is password protected. For more information, go to Configure Security Against Tampering (Windows and Linux computers).

To uninstall Endpoint Security on a Linux device:

1. Open a command line.
2. Enter these commands:
   $ /usr/local/management-agent/repositories/pa/install --remove --totp=value
   $ /usr/local/management-agent/repositories/ma/install --remove --pass="password" --totp=value
   

iOS Devices

To uninstall the WatchGuard Mobile Security app from an iOS device when it is integrated with the WatchGuard MDM solution:

1. On the Home screen, tap Settings.
   The Settings app opens.
2. From the side panel, tap General.
   The General page opens.
3. Tap VPN and Device Management.
   The WatchGuard MDM Service downloaded profile opens.
4. Tap Remove Management.
   The Remove Management window opens.
5. Tap Remove.
   The management profile and WatchGuard Mobile Security app are removed.

To uninstall the WatchGuard Mobile Security app from an iOS device when it is not integrated with an MDM solution:

1. On the Home screen, press and hold the WatchGuard Mobile Security app.
   
2. Tap the "-" icon on the WatchGuard Mobile Security app.
   The Delete WatchGuard Mobile Security dialog box opens.
3. Tap Delete App.
   
4. Tap Delete.
   The app is removed from the device.

If your WatchGuard Mobile Security app is installed on an iOS device and it is integrated with a third-party MDM solution, we recommend that you uninstall the WatchGuard Mobile Security app from the third-party MDM solution. If you delete the management profile manually from the device, all the software that was installed with the MDM solution is also lost. The device can no longer be centrally managed from the MDM solution.

Remote Uninstallation (Windows, Mac, and Linux Computers)

For Windows, Mac, and Linux computers, you can remove the computer from the management UI and uninstall the WatchGuard Agent and Endpoint Security remotely.

When you remove a computer:

• The computer and related information such as detections are deleted from the management UI.
• The computer is unprotected.
• If the computer is encrypted, it remains encrypted. You cannot get the recovery keys.

If the deleted computer reconnects to the WatchGuard servers, then the computer and information reappear in the management UI.

To prevent reconnection to the WatchGuard servers, you can uninstall the WatchGuard Agent. When you uninstall the WatchGuard Agent, any components such as the FireCloud Connection Manager or the ThreatSync+ NDR Collections Agent are also uninstalled. If you still require these components, you must reinstall them. For information on WatchGuard Agent installation scenarios, go to About the WatchGuard Agent.

Remote uninstallation from the management UI is only available for Mac computers that run Monterrey, Ventura, Sonoma, or Sequoia operating systems. Earlier versions of macOS are not supported.

Your operator role determines what you can see and do in WatchGuard Cloud. Your role must have the Add, Discover, and Delete Computers permission to view or configure this feature. For more information, go to Manage WatchGuard Cloud Operators and Roles.

To remove a computer from the management UI and uninstall the WatchGuard Agent, from WatchGuard Cloud:

1. Select Configure > Endpoints.
2. Select Computers.
3. Select the computers that you want to remove from the management UI and uninstall the Endpoint Security software from.

4. Click Delete.
   A confirmation dialog box opens to remove the computer from the management UI.
5. To uninstall the WatchGuard Agent and the Endpoint Security software, select the Uninstall the WatchGuard Agent from this Computer check box.
6. Click Delete.

Related Topics

Installation Requirements (external link)

Reinstall Endpoint Software Remotely (Windows Computers)