Server 2012 STD R2 Hard Disk Expansion Issue - WRLog.log

  • 15 July 2017
  • 2 replies
  • 462 views

After recently terminating a 3rd party IT support service they sent a remote consol command to remove their remotely managed Webroot Secure Anywhree from our network (45 workstations & 5 W Std 2102R2 servers). Although the console shows from their end that all agents were deactivated and uninstalled, that is certainly not the case. 
 
The next day, completely unaware the failed uninstall attempt occured, I came in to find all 5 W Std 2012 r2 servers c: drives completely full. I then discovered the reason was Webroot created a WRLog.log file in c:WindowsTemp directory that expanded exponentially until maximum storage space was depleted. After contacting a support tech from the IT mgmt service we were finally able to stop the service, delete the expanded WRLog,log file and then manually uninstall the agent from the cmd line for all of the servers. The following day, the problem started all over again and I had to go through all the steps to delete the temp log file once again.  
 
My suggestion was to simply activate 'allow enduser uninstalltion' from the management console but now, being at their mercy, they've decided to get a Webroot support tech involved and said they'd 'get back to me'. Since we're no longer a paying customer its clear this isn't a priority for them.  
 
I was hoping to possibly find a workable solution here. After exhuastive searching I can't find any way to stop the agent re-install from reoccuring and removing it entirely from our servers. 
 
Any solutions would be kindly appreciated.
 
 

2 replies

Userlevel 7
Hey @, thanks for joining our Community!
 
I've notified the Team Lead of our Support Team about your case. They'll be responding to your support ticket very shortly.
I would look to see if there is a Group Policy that is used to deploy the agent. This is a method that I use for my clients so that any new workstation or server added to the environment is automatically protected. Removing the agent and the Group Policy would take care of the issue going forward.

Reply