Uninstalling SanerNow Agent from Bulk Devices Using Active Directory GPO Settings

Modified on Sun, 16 Mar at 1:46 PM

Overview

In scenarios where a large number of devices have Saner agents that are not connecting to the server, it becomes necessary to uninstall the agents and reinstall the latest version. This ensures that all agents actively connect to the server and are listed correctly on the console.

When the agents are in an offline state, they cannot be uninstalled via the user interface (UI). Additionally, manually uninstalling the agent from each device using the command line is time-consuming and impractical for large-scale environments.

To address this, we recommend automating the uninstallation process using Active Directory Group Policy Object (GPO) settings. This approach minimizes manual effort and ensures consistent execution across all targeted devices.

Solution:

Step 1: Prepare the Batch Script for Uninstallation

Before creating a GPO policy, you need a batch script containing the uninstallation command.

Open a text editor (e.g., Notepad) and enter the uninstallation commandFile and Print Sharing must be enabled.
"C:\Program Files (x86)\SecPod Saner\spsaneruninstall.exe" /S

This command runs silently (/S), ensuring the uninstallation occurs without requiring user interaction.

Save the file with the .bat extension (e.g., agentun.bat).

Copy the batch script to a network-shared folder that is accessible by all target devices.
Note: Ensure the shared folder has the necessary permissions for devices to read the script

Step 2 : Create a New GPO Policy in Active Directory

Identify the devices where the uninstallation is required and group them in a new Organizational Unit (OU).
Example: Create a new OU named ’ Uninstall’ and move test devices into this OU for validation

Right-click on the OU and select Create a GPO in this Domain, and Link it Here.

Provide a descriptive name for the GPO (e.g., Uninstall_SanerNow_Agent).

Step 3: Configure the GPO Policy

Right-click the newly created GPO (e.g., Uninstall_Tsysten_Agent) and select Edit to open the Group Policy Management Editor.

Navigate to the following path:
Computer Configuration > Windows Settings > Scripts > Startup.

Double-click Startup, then click Add in the dialog box.

Browse to the batch script saved in the network-shared folder and select it
Ensure you do not modify the Parameter field.

Click OK and then Apply to save the changes.

A screenshot of a computer
Description automatically generated

Step 4: Enforce the GPO Policy

Return to the Group Policy Management Console.

Right-click the newly created GPO (e.g., Uninstall_Tsysten_Agent) and ensure the following options are enabled:
Enforced: Ensures the policy is applied to all devices in the OU.
Link Enabled: Activates the GPO for the linked OU.

Review the configuration to ensure the GPO is correctly linked and ready for deployment.

Step 5: Validate the Uninstallation Process
Before applying the GPO to all devices, it is crucial to test the policy on a small subset of devices:

Reboot one or two devices within the test OU where the GPO is applied.

Verify the results:

Before Reboot: Confirm that the devices are listed on the SanerNow server console with an inactive status.

After Reboot: Check that the Tsysten agent has been successfully uninstalled on the devices.

Best Practices and Recommendations

Test Before Full Deployment: Always test the GPO policy on a few devices before applying it to the entire network. This helps identify any issues and ensures a smooth deployment.
Use a Separate OU for Testing: Create a new OU for test devices to isolate the impact of the policy. Avoid applying it directly to production devices until testing is complete

Conclusion:
By automating the uninstallation process using Active Directory GPO settings, you can efficiently remove the SanerCVE agent from multiple devices without requiring manual intervention. This method not only saves time but also ensures consistency across your environment. After successful uninstallation, you can proceed with reinstalling the latest agent version to reestablish connections with the server.