Task to uninstall the Rapid7 Agent

Content Authoring
1

I have a task to uninstall Rapid7 agent. I gathered the information from the forums but my will just sit there and say running. The script is as follows:
waithidden “{pathname of system folder}\msiexec.exe” /x{name of key whose (value “DisplayName” of it as string = “Rapid7 Insight Agent” and name of it starts with “{”) of key “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” of native registry} /qn /norestart //(for not rebooting the endpoint)

Did I miss something here?

1 Like
2

Usually if something is stuck in “Running” the installer is trying to display a message to the user (but the message is not visible because the process is running as LocalSystem, not the logged-on user).

The first thing I’d try, because it’s easy, is to disable 32-bit redirection. Just put
action uses wow64 redirection false
in your actionscript somewhere before executing the ‘waithidden’ command. In some cases (especially kernel drivers like what may be delivered in a security package), using the 32-bit version of msiexec on a 64-bit installer package can cause problems.

If that doesn’t clear it, I would check the BES Client Log on one of these machines to determine the full uninstall command it is actually running, and try running it interactively on one of the machines to see whether any messaging is displayed. While your command line parameters look like they are properly set to run silently (/qn), it’s up to the application developer to determine whether it will honor the silent install commands. It could be Rapid7 needs a password or some other setting to enable silent uninstall.

2 Likes
3

It does have that line. I obviously didn’t copy that line

1 Like
4

I wrote a Fixlet sometime ago with the following action script:

appendfile {((tuple string item 0 of substrings separated by ( escape of "%00" as string) of( concatenation "/X" of substrings separated by "/I" of it) & " /qn /norestart %0d%0a")) of(tuple string items (integers in (0, number of tuple string items of it )) of concatenation ", " of it of (value "UninstallString" of it as string as trimmed string) of keys whose ( value "DisplayName" of it as string as trimmed string as lowercase contains "rapid7" as lowercase) of keys "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registry ; native registry))}
 
move __appendfile removeRapid7.bat
waithidden "{(pathname of system folder & "\cmd.exe")}" /C removeRapid7.bat
3 Likes