New

Uninstalling Webroot

  • 11 January 2019
  • 14 replies
  • 516 views

Userlevel 7
Badge +25
We keep most of our device policies set to not allow access to the console. Due to this, I have to do everything via the console. This generally isn't a big deal. However, I recently ran into an issue where a PC hadn't checked in with the console for one and half months. I could save a log and see that it was still scanning on the PC, however I couldn't:

  1. Force it to check in with the console.
  2. Change the policy in the console and it update on the PC.
  3. Uninstall it via the console.
With all these options unavailable to me, I tried uninstalling it directly on the PC. It refused to allow me to do this, even when I was logged in as a Domain Admin. I understand not allowing the user to uninstall it, but as a Domain Admin I should be allowed to. There needs to an override that allows Admins to uninstall the software in situations like this.

Sincerely,

14 replies

Userlevel 4
Badge +16
You can still do this with command-line switches for WRSA.exe. You can force agent to check-in with console with "-poll", and uninstall with "-uninstall".

However, it should be polling regularly anyway: mine are set to every 15 min by policy. If the agent can't reach GSM or is somehow broken, manually telling it to poll won't work. You may just need to uninstall/reinstall.

If that doesn't do it, make sure you have the necessary FQDN's allowed through your firewall, content-filters, etc.
Userlevel 7
Badge +25
Thanks for the info on the command line switches. However, my policies are set for every 15 minutes and it wasn't checking in. I couldn't force it to refresh the configuration. I could tell it to, but it wasn't communicating with the console anymore so that was useless. I also couldn't uninstall, even as the Domain Admin. Nothing is blocking it, i.e. firewall, filters, etc. Hence the need for an override that allows an admin to uninstall Webroot.
Userlevel 7
Badge +25
Update on the uninstall issue. I have another endpoint that is a server that is having some issues with Webroot. This one has policies that refresh with the console every 15 minutes, allow access to the GUI on the endpoint, allow Webroot to be shutdown on the endpoint, and had the Webroot firewall is turned off. In an attempt to fix the issue, I tried to uninstall from the server after shutting down Webroot. I was logged in as a Domain Admin and still got the message that I wasn't allowed to uninstall. I then went to the console and sent the command to uninstall. Went back to the server and was going to restart Webroot so it could update with the console and uninstall. However, it apparently uninstalled even though it told me I wasn't allowed to. This obviously wasted my time going through the steps of using the console if the server uninstalled and gave me an inaccurate message.
Userlevel 7
Badge +25
I was looking at the policy settings, looking for something completely unrelated and found this setting. I've highlighted it in yellow in the screenshot. If you're going to have a policy setting to show your software in the Add/Remove Programs, at the very least a Domain Admin should be able to uninstall your software from Add/Remove Products. Otherwise, what's the point of this setting? Sorry if that sounds harsh, just trying to understand what appears to be a pointless setting.

Badge
Hello,

I'm new to the Webroot Community and it's glad to share my tips,

Do you have access to the MyWebroot Account Console? If you do, you might try logging in there and deactivating the computer.

  • Go to PC Security tab
  • Click on the computer if it is listed
  • Go to Advanced Options tab
  • Click Deactivate Computer.
After you Deactivate the computer, reboot the computer. This is supposed to send a signal to the computer to remove Webroot. And if all this does not help then please Open a Support Ticket to get the Support Team to assist you in that.

Sincerely,
Userlevel 7
Badge +25
@ClemHarvey, I appreciate the feedback, but your suggestion is a workaround, not a solution. As an admin, I should have the ability to uninstall Webroot directly from the PC. Theoretically this functionality already exists via a policy setting, which I highlighted in my last post above. However, Webroot does not appear in the Add/Remove Programs list for me to uninstall on a PC or Server in any Windows OS. In other words, I don't have control over my endpoints, Webroot does. Can you see how this might worry an admin from a security perspective. I'd love to get the perspective of people like @JGiffard, @TripleHelix, or others who either work at Webroot or deal with systems from a security perspective. If policies aren't working the way they say, is there a potential back door into systems. This is just a question, not an accusation. I'm simply trying to control my systems, not give a vendor or someone nefarious that ability over me. A domain admin should be the top level of the pyramid, not a console on the web.

Thanks for the warning @Ssherjj! Don't worry, I never click links without checking them out first. I prefer not to catch an Interweb STD. 🤤
Userlevel 7
Badge +55
Thank you @NicCrockett I accidentally posted here instead of there..LOL 😜
Userlevel 7
Badge +25
Never hurts to be careful @Ssherjj! I saw the post had disappeared after I hit submit. Oh well. 😀
Userlevel 7
Badge +55
Well @NicCrockett you posted an awesome response as always so that's a good thing! 😊
Userlevel 7
Badge +25
Thanks for the kind words. The truth is, I just want a simple solution where I control my systems and I want to make sure that they are secure. I don't think that's too much to ask for. Hopefully someone will respond with a solution, why the policy isn't working properly, reassurance that the system is secure, or a roadmap of how Webroot is going to implement a solution to alleviate these issues. As always, it's nice talking with you! 😁
Userlevel 7
Badge +55
For Consumers we can do this but not sure if it will help the Business side?
____________________________________________________________________________________________
If you have an issue to uninstall open the RUN command and run this to Uninstall with the quotes and WSA must be running to uninstall:

"C:\Program Files\Webroot\WRSA.exe" -uninstall






Userlevel 7
Badge +25
This is why I included your name @TripleHelix! Solid informative potential solution. I don't know if it works on the business side or if it will work with the console being locked down. However, it's something I can try. I'll have to get back to you and let you know if it works. Currently, I'm dealing with a dead server, so give me some time.

I'd still like to know why that policy exists if it does nothing.

Thanks,
Userlevel 7
Badge +55
This is why I included your name @TripleHelix! Solid informative potential solution. I don't know if it works on the business side or if it will work with the console being locked down. However, it's something I can try. I'll have to get back to you and let you know if it works. Currently, I'm dealing with a dead server, so give me some time.

I'd still like to know why that policy exists if it does nothing.

Thanks,

Sure thing. Also after uninstall reboot the system and before reinstalling make sure the C:\ProgramData\WRData Folder is gone! 😉
Userlevel 7
Badge +25
Thanks for the additional info @TripleHelix!

Thanks,

Reply