Kaseya Community

Mass removal of Kaseya agents?

This question is not answered

We're in a situation where we have just taken over control of a larger company, the previous IT company also uses Kaseya, and they have had agents on each of the PC's on the network.

We don't want to be monitoring the PC's however we do not want the previous IT companies agents on the computers for security reasons.

Is there a way either within VSA or by bat file that we can deploy via login script / Group policy to remove these agents?

I saw the Uninstall string for the agent C:\Program Files\Kaseya\Agent\KASetup.exe /r /g <Your Unique String> /l "%TEMP%\kasetup.log" but will the Kaseya string change from machine to machine?


All Replies
  • Do you want to remove the agents, or just redirect them (hint hint, BIG HINT) to use your site instead?

  • Are you installing your own agent then just removing theirs?

  • the agent string changes from machine to machine on mine b/c of the age of the agents. Some of them are just upgrades from the old 5x so the string may be different. do you rebrand your agents? If so I can give you a vbscript that will remove all instances of "Kaseya"

    if you check out the kaaseyaD.ini file, you should be able to see where they are point the agents to for the Kserver, from there you could just change that to point to yours. or try and change the file to point to yours. (Havn't tested that so not sure if it'll work).

    We rebrand our agents right down to reh uninstall key/string so when we take over a company with Kaseya on it from a different IT company, we just install our agents and run our uninstall script for Kaseya (or what they brand theirs to).   Below is our uninstall script, if it helps:

    Set oArgs = WScript.Arguments
    iCount = WScript.Arguments.Count

    If iCount = 1 Then
        sCmdLine0 = WScript.Arguments.Item(0)
        If instr(1, sCmdLine0, "/help", 1) = 1  OR instr(1,sCmdLine0,"/?",1) = 1  OR instr(1,sCmdLine0,"-?",1) =1 OR instr(1,sCmdLine0,"-help",1)=1 Then
            wscript.echo "cscript app_uninst.vbs <app name> <version number>"
            Wscript.echo "the allowed switches are /? -? /help -help"
            sfindapp sCmdLine0, 0
        end if
    elseif iCount = 2 Then
        sCmdLine0 = WScript.Arguments.Item(0)
        iCmdLine1 = WScript.Arguments.Item(1)
        If IsNumeric(iCmdLine1) <> True Then
            WScript.Echo "The version number should be of a numerical value with no '' or ." & vbcrlf
            wscript.echo "cscript app_uninst.vbs <app name> <version number>"
            Wscript.echo "the allowed switches are /? -? /help -help"
            sfindapp sCmdLine0, iCmdLine1
        end if
    elseif iCount > 2 Then
        wscript.echo "Too many arguments specified" & vbcrlf
        wscript.echo "cscript app_uninst.vbs <app name> <version number>"
        Wscript.echo "the allowed switches are /? -? /help -help"    
    end if

    Sub sfindapp(sAPP, iVersion)
        On Error Resume Next
        iFound = 0 'place holder if not found
        Const HKEY_LOCAL_MACHINE = &H80000002
        Set WshShell = WScript.CreateObject("WScript.Shell")
        Set WshNetwork = WScript.CreateObject("Wscript.Network")
        Set oReg = GetObject("winmgmts:\\" & WshNetwork.ComputerName & "\root\default:StdRegProv")
        strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
        oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys
        For Each subkey In arrSubKeys
             disHolder = WshShell.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" _
             & subkey & "\DisplayName")
             unistString =  WshShell.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" _
             & subkey & "\UninstallString")
            If instr(1, disHolder, sAPP, 1) = 1 Then
                iFound = 1
                Wscript.Echo unistString
                If instr(1, unistString, "msiexec", 1) = 1 Then
                    Wscript.echo "msiexec.exe /x" & subkey & " /qn /promptrestart"
                    WshShell.Run "msiexec.exe /x" & subkey & " /qn /promptrestart",    True
                    WshShell.Run unistString
                End If
            End If
        If iFound = 0 Then logfile(sAPP + " not found")
    End Sub

    Function logfile(text)
        Const ForReading = 1, ForWriting = 2, ForAppending = 8
        Dim fso, f
        Set fso = CreateObject("Scripting.FileSystemObject")
        set f = fso.OpenTextFile("C:\temp\app_unist.log", ForWriting, True)
        f.WriteLine text
    End Function

  • @ David

    how would you redirect the agents to your site? I've thought about using the kaeyad.ini file but have never tried it.

  • danrche,

    You control DNS and firewall for this client site, don't you? I'm pretty sure you can redirect internal dns for any A record to anywhere you want. And if the agent is controlled by IP address, you can redirect that as well.

    Simple, quick solution that I've used before.

  • @ David,

    Ahh, got you. on the one's I've had to do this for, we didn't contorl the dns nor the router, in fact, never seen the site nor stepped foot on it. Property management (Apartment complexes). I've had to burte force local admin passwords before b/c the old IT company wouldn't hand them over. :(    

    the property management comapny sends their people on-site and they usually install our agents on the pc's. :D    The dns would be the prefered method if you can do it.

  • You could always create lmhosts/hosts files with a batch file that copies them to the etc directory and runs nbtstat -R and ipconfig /flushdns then have them plug in the flash drive, for example, and run the batch.  Then the lmhosts/hosts files would redirect just like you would with DNS.  Then you can have a KScript that delets the lmhosts/hosts files once you've updated the KAgents check-in settings.

  • You might also want to start that batch file by renaming the current lmhosts/hosts files, just in case someone has one that they use, and then have the KScript delete yours and rename their old ones back.