How to remove old sysaid agent
I have sysaid agent 9.0.53 deployed on some machines for which the server is gone for good. There is no uninstall in add/remove programs and the service is running. What is the best clean way to remove it?
Hello MichalUVT,
Thank you for your post.
Regarding this topic , if the service it's still running it means that the manually performed un-install did not remove the Service as well (and in some of the situations the registry keys are still there as well).
What you can do it's eider use this text and create a batch file which has to be run with administrator rights on the device, or perform the operation from a Command Prompt opened with administrator rights.
This is the "text" :
sc stop SysAidAgent
ping 192.0.2.2 -n 1 -w 5000 > nul
sc delete SysAidAgent
REG DELETE HKLM\SOFTWARE\Ilient /f
REG DELETE HKLM\SOFTWARE\Wow6432Node\Ilient /f
taskkill /F /IM SysAidSM.exe
taskkill /F /IM SysAidWorker.exe
rd /S /Q "C:\Program Files\SysAid"
rd /S /Q "C:\Program Files (x86)\SysAid"
The second method would be to open, as i mentioned, a command prompt with admin rights and just delete the service:
sc stop SysAidAgent
sc delete SysAidAgent
Please test if this will work for you and let me know if i can assist you further.
Best regards,
Ionut.
Thank you for your post.
Regarding this topic , if the service it's still running it means that the manually performed un-install did not remove the Service as well (and in some of the situations the registry keys are still there as well).
What you can do it's eider use this text and create a batch file which has to be run with administrator rights on the device, or perform the operation from a Command Prompt opened with administrator rights.
This is the "text" :
sc stop SysAidAgent
ping 192.0.2.2 -n 1 -w 5000 > nul
sc delete SysAidAgent
REG DELETE HKLM\SOFTWARE\Ilient /f
REG DELETE HKLM\SOFTWARE\Wow6432Node\Ilient /f
taskkill /F /IM SysAidSM.exe
taskkill /F /IM SysAidWorker.exe
rd /S /Q "C:\Program Files\SysAid"
rd /S /Q "C:\Program Files (x86)\SysAid"
The second method would be to open, as i mentioned, a command prompt with admin rights and just delete the service:
sc stop SysAidAgent
sc delete SysAidAgent
Please test if this will work for you and let me know if i can assist you further.
Best regards,
Ionut.
OK, thank you. I already copied unins000 exe and dat from another computer and then run it. These files are not there if the installation was performed by deploying using the network discovery.
It is there if it was installed by SysAidAgent.exe
It is there if it was installed by SysAidAgent.exe
Is this method still valid for version 14?
--- update ---
It seems yes.
sc stop SysAidAgent
sc delete SysAidAgent
taskkill /F /IM SysAidSM.exe
taskkill /F /IM SysAidWorker.exe
rd /S /Q "C:\Program Files\SysAid"
rd /S /Q "C:\Program Files (x86)\SysAid"
--- update ---
It seems yes.
sc stop SysAidAgent
sc delete SysAidAgent
taskkill /F /IM SysAidSM.exe
taskkill /F /IM SysAidWorker.exe
rd /S /Q "C:\Program Files\SysAid"
rd /S /Q "C:\Program Files (x86)\SysAid"
Necroing this.
I went back and forth with SysAid several times trying to get them to provide proper uninstallation methods.
In the end, I had to figure it out by myself.
In case anyone else out there needs a reliable way to nuke installed versions of SysAid so you can properly install a new client, you can run the following powershell script from an admin ps console. The only thing I didn't get around to was code to find and remove start menu entries. (you can find it in the code by #stub and add it yourself, if you'd like)
I'm also still not 100% sure this gets everything, but it removes enough to allow a reinstall in cases where SysAid refuses to run properly. While this did work on over 150 systems in my environment without issue, I do not guarantee this won't break your computers since it is deleting registry keys, though I did add some logic to avoid that. Try it on something controlled before deploying to a large group of computers.
I went back and forth with SysAid several times trying to get them to provide proper uninstallation methods.
In the end, I had to figure it out by myself.
In case anyone else out there needs a reliable way to nuke installed versions of SysAid so you can properly install a new client, you can run the following powershell script from an admin ps console. The only thing I didn't get around to was code to find and remove start menu entries. (you can find it in the code by #stub and add it yourself, if you'd like)
I'm also still not 100% sure this gets everything, but it removes enough to allow a reinstall in cases where SysAid refuses to run properly. While this did work on over 150 systems in my environment without issue, I do not guarantee this won't break your computers since it is deleting registry keys, though I did add some logic to avoid that. Try it on something controlled before deploying to a large group of computers.
function global:Find-PropText{
param($iObject,$iFindText,[switch]$ReturnProps)
# look through names and values of the object properties for matching text
$anythingFound = (
$iObject.PsObject.Properties |
Where {
$_.Name -like $iFindText -or
$_.Value -like $iFindText
}
)
# If -ReturnProps, return any found properties, otherwise return bool of any found
If ($ReturnProps){Return $anythingFound}
ElseIf ($anythingFound){Return $true}
Else{Return $false}
}
$findFilter = '*sysaid*'
##########################
## Kill Process/Service ##
##########################
# Stop services, delete services, kill processes. repeat attempts while services/processes are found
$saServices = Get-Service | Where {$_.Name -like $findFilter}
$saProcesses = Get-Process | Where {$_.ProcessName -like $findFilter}
$bailTrigger = 100000
$bailCount = 1
While ($saServices -and $saProcesses){
# Stop SysAid services
$null = $saServices | Stop-Service
# Remove SysAid services
ForEach ($saService in $saServices){
$thisServiceName = $saService.Name
$thisServiceExists = Get-Service $thisServiceName
If ($thisServiceExists){$thisServiceStopped = ((Get-Service $thisServiceName).Status -eq 'Stopped')}
# Delete the service entry
If ($thisServiceExists -and $thisServiceStopped){(Get-WmiObject Win32_Service -Filter "name='$thisServiceName'").Delete()}
}
# Kill SysAid processes
$null = $saProcesses | Stop-Process
# Check services & processes
$saServices = Get-Service | Where {$_.Name -like $findFilter}
$saProcesses = Get-Process | Where {$_.ProcessName -like $findFilter}
If ($bailCount -ge $bailTrigger){
$saServices = $null
$saProcesses = $null
}
Else{$bailCount++}
}
#########################
## File System Changes ##
#########################
# Delete local SysAid folders
$unc86Folder = 'C:\Program Files (x86)\SysAid'
$unc64folder = 'C:\Program Files\SysAid'
# 'C:\Windows\Installer\{FC5E1D1D-6D3F-4844-A937-567D589F655E}'
# 'C:\Windows\Temp\{FC5E1D1D-6D3F-4844-A937-567D589F655E}'
If (Test-Path $unc86Folder){Remove-Item $unc86Folder -Force -Recurse}
If (Test-Path $unc64Folder){Remove-Item $unc64Folder -Force -Recurse}
# Delete SysAid desktop icon
#stub also remove start menu entries?
$uncPublicDesktop = 'C:\Users\Public\Desktop'
$null = (
Get-ChildItem $uncPublicDesktop |
Where {$_.Name -like $findFilter} |
Remove-Item -Force
)
# Delete any cached installer sources
# Find folders that contain the filter text
$installerCacheUNC = 'C:\Windows\Installer'
$cachedInstallers = (
Get-ChildItem $installerCacheUNC -Force |
ForEach{
$subTreeMatches = $_ |
Get-ChildItem -Recurse -Force |
Where {$_.Name -like $findFilter}
If ($subTreeMatches){$_}
}
)
# Use the name of the folder to find any additional cache files
$deletableInstallerCache = @()
ForEach ($cachedInstaller in $cachedInstallers){
Get-ChildItem $installerCacheUNC -Force |
Where {$_.Name -like ('*' + $cachedInstaller.Name + '*')} |
ForEach {$deletableInstallerCache += $_}
}
# Remove found cached installers
If ($deletableInstallerCache){
$null = (
$deletableInstallerCache |
Remove-Item -Force -Recurse
)
}
######################
## Registry Changes ##
######################
# Remove registry entries
$null = New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT
# Remove registry entries
$manualRegKeys = `
'HKLM:\System\CurrentControlSet\services\SysAidAgent',
'HKLM:\System\ControlSet001\services\SysAidAgent'
$oldRegKeys = `
'HKLM:\SOFTWARE\Ilient',
'HKLM:\SOFTWARE\Wow6432Node\Ilient',
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FC5E1D1D-6D3F-4844-A937-567D589F655E}'
ForEach ($oldKey in $oldRegKeys){$manualRegKeys += $oldKey}
$installedKeys = `
'HKCR:\Installer',
'HKLM:\SOFTWARE\Classes\Installer',
'HKLM:\SOFTWARE\WOW6432Node\Classes\Installer'
$subKeys = 'Products','Features','UpgradeCodes'
$targetKeys = @()
ForEach ($subKey in $subKeys){
ForEach ($installedKey in $installedKeys){
$targetKeys += ($installedKey + '\' + $subKey)
}
}
# Keep only keys that exist
$targetKeys = $targetKeys | Where {(Test-Path $_)}
# Find any registry keys with properties matching the $findFilter ('SysAid')
$matchingKeys = (
$targetKeys |
Get-ChildItem -ErrorAction SilentlyContinue |
Get-ItemProperty |
ForEach {If (Find-PropText $_ $findFilter){$_}}
)
# Find any package codes listed, we will use these to discover more potential registry points
$packageCodes = $matchingKeys | Select -ExpandProperty PackageCode | Sort -Unique
# Search target keys for sub-properties matching any discoveries from $packageCodes
ForEach ($iCode in $packageCodes){
$codeResults = (
$targetKeys |
Get-ChildItem -ErrorAction SilentlyContinue |
Get-ItemProperty |
ForEach {If (Find-PropText $_ ('*' + $iCode + '*')){$_}}
)
# If any results, add each individually to the matching keys.
If ($codeResults){$codeResults | %{$matchingKeys += $_}}
}
# If any old keys exist, add them to the results
ForEach ($manualKey in $manualRegKeys){
If ((Test-Path $manualKey)){$matchingKeys += (Get-ItemProperty $manualKey)}
}
# Clear any duplicate key matches from list, then delete all matches
$matchingKeys = $matchingKeys | Sort -Unique PSPath
If ($matchingKeys){
ForEach ($iMatch in ($matchingKeys.PSPath)){
Remove-Item $iMatch -Force -Recurse
}
}
Hey Pinecones,
Did you get to try that script on XP machines by chance? I'm trying to downgrade agent versions on workstations with that OS since 17.4 (as I've painfully found out) no longer supports it.
Did you get to try that script on XP machines by chance? I'm trying to downgrade agent versions on workstations with that OS since 17.4 (as I've painfully found out) no longer supports it.
there is a fix for that... it's called windows 10. =oP
seriously though, i think windows xp only supports up to version 2 of powershell. i'm not sure if this script will work with it as-is with ps v2. if i find out, i'll let you know, otherwise if you have a safe environment to test in, i would just try it out. (making a hyper-v xp vm is what i would suggest)
seriously though, i think windows xp only supports up to version 2 of powershell. i'm not sure if this script will work with it as-is with ps v2. if i find out, i'll let you know, otherwise if you have a safe environment to test in, i would just try it out. (making a hyper-v xp vm is what i would suggest)
i just tested it by loading powershell in version 2 mode. you can do this by loading powershell with the version switch from cmd:
powershell.exe -version 2
this seemed to remove my installed copy of SysAid without issue. (requires reboot)
that's a pretty good indicator that it should work with windows xp... but i would still test it in a vm first.
i believe with xp you have to choose to install powershell / upgrade to v2. so if you're targeting a large group, you'll likely need to make powershell 2 part of the deployment.
powershell.exe -version 2
this seemed to remove my installed copy of SysAid without issue. (requires reboot)
that's a pretty good indicator that it should work with windows xp... but i would still test it in a vm first.
i believe with xp you have to choose to install powershell / upgrade to v2. so if you're targeting a large group, you'll likely need to make powershell 2 part of the deployment.
Just saw your last post. Greatly helpful. Thank you! I'll give it a try and see where things pan out.
Yea... I'm not too hip on the vbs scripting though, so you'd have to dig into that.
all the logic is there though.
AWESOME! let me know how it goes. also if you need help with any powershell stuff, i'd recommend joining the #PowerShell slack channel.
all the logic is there though.
AWESOME! let me know how it goes. also if you need help with any powershell stuff, i'd recommend joining the #PowerShell slack channel.
i DID just realize that the user folders are in a different spot... so you might have to manually adjust that. same with program folders.
Yeah. Its only added on to the XP hot mess. Also, there's a powershell slack channel? Which slack space?
http://slack.poshcode.org/ <-- you can sign up there.
there is also an IRC channel you can use to access it somewhere.
there is also an IRC channel you can use to access it somewhere.
This is great. Thanks again.
pinecones is the realMVP. So surprised that SysAid doesn't provide this script themselves...
Works great to completely remove the software (including Password self-service from login screen)
Thank you so much!
Works great to completely remove the software (including Password self-service from login screen)
Thank you so much!
I actually deployed a new version of the agent, but before that I created a policy to update the following registry values
[HKEY_LOCAL_MACHINE\SOFTWARE\SysAid\InstalledProducts\SysAid]
with a new accountid, serial number and serverurl. Everything works when the new agent is installed.
[HKEY_LOCAL_MACHINE\SOFTWARE\SysAid\InstalledProducts\SysAid]
with a new accountid, serial number and serverurl. Everything works when the new agent is installed.
Userlevel 5
That's really cool thanks for sharing shubell!
Cheers,
Maayan
Cheers,
Maayan
shubell
I actually deployed a new version of the agent, but before that I created a policy to update the following registry values
[HKEY_LOCAL_MACHINE\SOFTWARE\SysAid\InstalledProducts\SysAid]
with a new accountid, serial number and serverurl. Everything works when the new agent is installed.
Reply
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.
