Contents

Related Topics

Uninstall TDR Host Sensors

When you log in to the Threat Detection and Response web UI as a user with Operator credentials, from the Hosts page you can select an action to remove a Host Sensor from a connected Windows or Mac host. You can also manually uninstall the Host Sensor from the host.

To uninstall a Linux Host Sensor you must use the manual procedures described below. If you manually uninstall a Host Sensor from a host. you can also clear the sensor status in your TDR account so the host does not continue to use a Host Sensor license.

If a host is a member of a Device Group, you can also uninstall Host Sensors or clear the Host Sensor status from the Groups page. For more information, see Manage TDR Groups.

Some TDR features described in this version of Fireware Help are available only to participants in the WatchGuard Beta program. If a feature described in this section is not available in your TDR account, it is a beta-only feature. For information about how to enable beta features, see Enable TDR Beta Features.

Remove a Host Sensor Uninstall from the Hosts Page

On the Hosts page in TDR, you can select an action to remove the Host Sensor from a Windows or Mac host. This causes the Host Sensor to automatically start the uninstall process after the next time it connects to your TDR account.

To remove a Host Sensor from a single host:

  1. Log in to the TDR web UI as a user with Operator credentials.
  2. Select Devices > Hosts.
  3. In the Install State column for the host to uninstall, click .
    Or, select the host and from the Actions drop-down list select Remove Sensor.

To uninstall a Host Sensor from more than one host:

  1. Log in to the TDR web UI as a user with Operator credentials.
  2. Select Devices > Hosts.
  3. Select the check box for one or more hosts.
  4. From the Actions drop-down list, select Remove Sensor.
    If Threat Detection and Response can communicate with the host, the Host Sensor is uninstalled.

If a Host Sensor was originally manually installed, the host is removed from the Hosts list after you uninstall the Host Sensor. If a Windows host was added by AD Helper, the host remains in the Hosts list after you uninstall the Host Sensor, and the Install State for that host changes to Uninstalled.

If the Host Sensor does not connect to TDR after you select the Remove Sensor command, the Host Sensor is not uninstalled. In that case, you can manually remove the Host Sensor and then select the Acknowledge Manually Removed action to remove it from the Hosts list, as described below.

Manually Remove a Host Sensor

To uninstall a Mac or Linux Host Sensor, you must manually uninstall it. You can also manually uninstall a Windows or Mac Host Sensor.

To manually uninstall a Windows Host Sensor:Closed
  1. On the computer where the Host Sensor is installed, open Windows Control Panel > Programs and Features.
  2. Find the Threat Detection and Response application.
  3. Right click the application and select Uninstall.
    The Host Sensor is uninstalled from the Windows host.

When you uninstall a Windows Host Sensor version 5.1.4 or lower, the properties files created by the Host Sensor are not automatically removed. The Host Sensor properties files contain the Account ID and Controller Address used by the Host Sensor. Before you install a new Host Sensor for a different TDR account, you must manually remove the Host Sensor properties files that were created by the previous Host Sensor.

To remove the Host Sensor properties files from the host computer, delete this folder:

c:\program files(x86)\watchguard\Threat Detection and Response\

It is not necessary to manually remove Host Sensor properties files before you install a Host Sensor again for the same TDR account.

To manually uninstall a Mac Host Sensor:Closed
  1. On the Mac host where the Host Sensor is installed, in Finder, select Applications > WatchGuard > TDR.
  2. Double-click the file TDRHostSensorUninstall.
  3. Click OK.
  4. Type your password.
    The Host Sensor is uninstalled and related files are removed.
To manually uninstall the Mac Host Sensor v5.2.1 or lower, you must use the command line:Closed
  1. On the Mac host where the Host Sensor is installed, open the Terminal application.
    A command line window appears.
  2. Type this command:

sudo /usr/local/watchguard/tdr/uninstall_hostsensor.sh /usr/local/watchguard/tdr

  1. Type your password and press Enter. Tip!Characters do not appear in Terminal while you type the password.
    The Host Sensor is uninstalled and this text appears: Forgot package 'com.watchguard.tdr.hostsensor.daemon' on '/'.
To manually uninstall a Linux Host Sensor: Closed
  1. Log in to the Linux host as a user with root access.
  2. Type this command:

yum erase host_sensor.x64_64

Acknowledge a Host Sensor was Manually Removed

After you manually remove a Host Sensor, update the Host Sensor status in your Threat Detection and Response account so that host does not continue to use a Host Sensor license.

  1. Log in to the TDR web UI as a user with Operator credentials.
  2. Select Devices > Hosts.
  3. Select the host from which you uninstalled the Host Sensor.
  4. From the Actions drop-down list, select Acknowledge Manually Removed.

See Also

TDR Host Sensor Manual Installation

TDR Host Sensor Automated Installation

Manage TDR Hosts and Host Sensors

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.