Agents
      Back to home
      1. Vali Cyber Knowledge Base
      2. ZeroLock®
      3. Agents

      Uninstalling a ZeroLock® Agent

      Instructions on the options and methods of uninstalling a ZeroLock Agent

      There are three (3) ways that an Agent can be uninstalled:

      1.  ZeroLock Management Console

      2.  Remove the Agent Container

      3.  Command Line

      ZeroLock Management Console

      Using the ZeroLock Management Console (ZMC) there are two options with which to stop an Agent:  Deactivate or Uninstall.  On the ZeroLock dashboard scroll down to ENDPOINTS and select which agent you want to stop/uninstall by checking the box next to the endpoint.

      Agent to Uninstall

      Once the endpoint has been selected, from the ACTIONS drop-down menu select the action you want to perform. 

      Endpoint Actions Dropdown Deactivate

      Selecting Deactivate Endpoint Protection will turn off but NOT uninstall the agent.   This option allows the reactivation of the agent and subsequent protection of the endpoint.  The endpoint status light will briefly turn red indicating the endpoint is offline and unprotected. The status will quickly change to yellow meaning it’s connected but unprotected.

      The endpoint visual indicator at the top right of the screen will reflect the status of the endpoints. 

      Agent Deactivated

      Selecting Activate Endpoint Protection from the ACTIONS menu will immediately return the endpoint to a state of protection (status=green).

      Agent Reactivated

      Selecting Uninstall Endpoint Agent will immediately place the endpoint offline and unprotected (status=red).  

        

      On selection of Uninstall Endpoint Agent, a warning appears requiring selecting the Uninstall button to proceed.

      Warning_Uninstall Endpoint Agent

      Uninstalled Agent

      To re-install the agent, follow the instructions in the appropriate link below.

       

      Removing Agent Container

      Complete the following steps to remove the ZeroLock agent container from an Endpoint.

      1. On a terminal connected to the endpoint, stop the ZeroLock agent container.          Command: docker stop zerolock
      2. If connected using SSH, the session will close when the agent is stopped in step 1 so you must reconnect.
      3. Remove the container:    docker rm zerolock
      4. Remove the docker volume:    docker volume rm zerolock_opt
      5. Reboot

      Command Line

      To ensure the least disruption to the endpoint, uninstalling the ZeroLock Agent requires a three-step process.  First, we disable the ZeroLock service, reboot, and then uninstall.

      The steps below will walk you through this process.

      1. On a terminal connected to the endpoint.
      2. Disable the ZeroLock Agent:    sudo systemctl disable zerolock.service
      3. Reboot endpoint:    sudo reboot
      4. Once the reboot is complete, open a terminal session back to the endpoint.
      5. Uninstall the ZeroLock agent:  

              Centos: sudo yum remove zerolock

              Ubuntu: sudo apt remove zerolock