Add a standalone endpoint agent uninstaller
Reverses everything the installer and site-agent generator create: stops and deletes the service, kills agent/tray processes, removes the tray Run key and the HKLM\SOFTWARE\GE\ShopDB credential hive in both registry views, drops the Defender path exclusion, and deletes the install directory and ProgramData tree. Every step is best-effort and idempotent so it is safe to re-run and safe on a partially installed host.
This commit is contained in:
benjamin.baker
189
scripts/uninstall-shopdbagent.ps1
Normal file
189
scripts/uninstall-shopdbagent.ps1
Normal file
@@ -0,0 +1,189 @@
|
||||
# uninstall-shopdbagent.ps1
|
||||
# ShopDB Endpoint Agent uninstaller. Run from an ELEVATED (admin) PowerShell on
|
||||
# the endpoint. Reverses everything install-shopdbagent.ps1 and the site agent
|
||||
# generator's install.ps1 create:
|
||||
# - stops and deletes the Windows service
|
||||
# - kills any running agent/tray processes
|
||||
# - removes the tray logon Run key (64-bit and 32-bit views)
|
||||
# - removes the credential hive HKLM\SOFTWARE\GE\ShopDB (both views)
|
||||
# - removes the Defender path exclusion for the install directory
|
||||
# - deletes the install directory and the ProgramData data/log tree
|
||||
#
|
||||
# Every step is best-effort and idempotent: a missing service, key, process, or
|
||||
# folder is a no-op, so the script is safe to re-run and safe on a partially
|
||||
# installed host. Nothing here fails the run just because an artifact is already
|
||||
# gone; only an unexpected error on a present artifact surfaces as a warning.
|
||||
|
||||
[CmdletBinding()]
|
||||
param(
|
||||
[string] $InstallDir = "C:\Program Files\ShopDB\EndpointAgent",
|
||||
[string] $ServiceName = "ShopDbEndpointAgent",
|
||||
[string] $TrayExeName = "shopdb-endpoint-tray.exe",
|
||||
|
||||
# Also remove any server TLS certificate the site-agent installer imported
|
||||
# into the machine Trusted Root store. Off by default because a root cert is
|
||||
# shared trust material: only pull it when you are sure no other service on
|
||||
# this host relies on it. Match is by subject CN substring.
|
||||
[string] $RemoveRootCertMatching = "",
|
||||
|
||||
# Keep the ProgramData logs (C:\ProgramData\ShopDB) for post-mortem instead
|
||||
# of deleting them with everything else.
|
||||
[switch] $KeepLogs
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
||||
$principal = New-Object Security.Principal.WindowsPrincipal($identity)
|
||||
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
||||
throw "This script must be run from an elevated (Run as administrator) PowerShell."
|
||||
}
|
||||
|
||||
# Delete an HKLM value or subkey from BOTH the 64-bit and 32-bit registry views.
|
||||
# The installer writes both views (a stale WOW6432Node copy would otherwise be
|
||||
# read first by the agent), so a clean uninstall has to clear both.
|
||||
function Remove-HklmBothViews {
|
||||
param(
|
||||
[Parameter(Mandatory)] [string] $SubKey,
|
||||
[string] $Name
|
||||
)
|
||||
foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64,
|
||||
[Microsoft.Win32.RegistryView]::Registry32)) {
|
||||
$base = [Microsoft.Win32.RegistryKey]::OpenBaseKey(
|
||||
[Microsoft.Win32.RegistryHive]::LocalMachine, $view)
|
||||
try {
|
||||
if ($Name) {
|
||||
$key = $base.OpenSubKey($SubKey, $true)
|
||||
if ($key) {
|
||||
try {
|
||||
if ($null -ne $key.GetValue($Name)) { $key.DeleteValue($Name, $false) }
|
||||
}
|
||||
finally { $key.Dispose() }
|
||||
}
|
||||
}
|
||||
else {
|
||||
if ($base.OpenSubKey($SubKey)) {
|
||||
$base.DeleteSubKeyTree($SubKey, $false)
|
||||
}
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Warning " registry cleanup ($view $SubKey $Name): $($_.Exception.Message)"
|
||||
}
|
||||
finally { $base.Dispose() }
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "== ShopDB endpoint agent uninstall ==" -ForegroundColor Cyan
|
||||
Write-Host "InstallDir : $InstallDir"
|
||||
Write-Host "ServiceName : $ServiceName"
|
||||
|
||||
# 1. Stop and delete the Windows service.
|
||||
$service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
|
||||
if ($service) {
|
||||
Write-Host "[1/6] Stopping and deleting service $ServiceName ..."
|
||||
if ($service.Status -ne "Stopped") {
|
||||
try { Stop-Service -Name $ServiceName -Force -ErrorAction Stop }
|
||||
catch { Write-Warning " could not stop service: $($_.Exception.Message)" }
|
||||
}
|
||||
sc.exe delete $ServiceName | Out-Null
|
||||
Start-Sleep -Seconds 2
|
||||
}
|
||||
else {
|
||||
Write-Host "[1/6] Service $ServiceName not present; skipping."
|
||||
}
|
||||
|
||||
# 2. Kill any lingering agent/tray processes (service host, tray, and anything
|
||||
# still running out of the install directory holding files open).
|
||||
Write-Host "[2/6] Stopping agent and tray processes ..."
|
||||
$trayBase = [System.IO.Path]::GetFileNameWithoutExtension($TrayExeName)
|
||||
foreach ($name in @("shopdbagent", $trayBase)) {
|
||||
foreach ($proc in (Get-Process -Name $name -ErrorAction SilentlyContinue)) {
|
||||
try { Stop-Process -Id $proc.Id -Force -ErrorAction Stop; Write-Host " killed $name (pid $($proc.Id))" }
|
||||
catch { Write-Warning " could not stop $name (pid $($proc.Id)): $($_.Exception.Message)" }
|
||||
}
|
||||
}
|
||||
foreach ($proc in (Get-Process -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.Path -and $_.Path.StartsWith($InstallDir, [StringComparison]::OrdinalIgnoreCase) })) {
|
||||
try { Stop-Process -Id $proc.Id -Force -ErrorAction Stop; Write-Host " killed $($proc.ProcessName) from install dir (pid $($proc.Id))" }
|
||||
catch { Write-Warning " could not stop pid $($proc.Id): $($_.Exception.Message)" }
|
||||
}
|
||||
Start-Sleep -Seconds 1
|
||||
|
||||
# 3. Remove the tray logon Run key entry (both views) and the credential hive.
|
||||
Write-Host "[3/6] Removing registry entries ..."
|
||||
Remove-HklmBothViews -SubKey "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "ShopDbEndpointTray"
|
||||
Remove-HklmBothViews -SubKey "SOFTWARE\GE\ShopDB"
|
||||
# Drop the parent GE key only if we emptied it (some sites nest siblings under
|
||||
# GE such as SFLD; never tree-delete a key we do not own).
|
||||
foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64,
|
||||
[Microsoft.Win32.RegistryView]::Registry32)) {
|
||||
$base = [Microsoft.Win32.RegistryKey]::OpenBaseKey(
|
||||
[Microsoft.Win32.RegistryHive]::LocalMachine, $view)
|
||||
try {
|
||||
$ge = $base.OpenSubKey("SOFTWARE\GE")
|
||||
if ($ge -and $ge.SubKeyCount -eq 0 -and $ge.ValueCount -eq 0) {
|
||||
$ge.Dispose()
|
||||
$base.DeleteSubKey("SOFTWARE\GE", $false)
|
||||
Write-Host " removed empty SOFTWARE\GE ($view)"
|
||||
}
|
||||
elseif ($ge) { $ge.Dispose() }
|
||||
}
|
||||
catch { Write-Warning " GE key cleanup ($view): $($_.Exception.Message)" }
|
||||
finally { $base.Dispose() }
|
||||
}
|
||||
|
||||
# 4. Remove the Defender path exclusion the installer added for the install dir.
|
||||
Write-Host "[4/6] Removing Defender exclusion ..."
|
||||
if (Get-Command Remove-MpPreference -ErrorAction SilentlyContinue) {
|
||||
try {
|
||||
Remove-MpPreference -ExclusionPath $InstallDir -ErrorAction Stop
|
||||
Write-Host " removed Defender exclusion for $InstallDir"
|
||||
}
|
||||
catch { Write-Warning " could not remove Defender exclusion (tamper protection or policy?): $($_.Exception.Message)" }
|
||||
}
|
||||
else {
|
||||
Write-Host " Defender cmdlets not present; skipping."
|
||||
}
|
||||
|
||||
# 5. Optionally remove an imported server root certificate.
|
||||
if (-not [string]::IsNullOrWhiteSpace($RemoveRootCertMatching)) {
|
||||
Write-Host "[5/6] Removing Trusted Root certs matching '$RemoveRootCertMatching' ..."
|
||||
$matches = Get-ChildItem Cert:\LocalMachine\Root -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.Subject -like "*$RemoveRootCertMatching*" }
|
||||
foreach ($cert in $matches) {
|
||||
try {
|
||||
Remove-Item -Path $cert.PSPath -Force -ErrorAction Stop
|
||||
Write-Host " removed $($cert.Subject) [$($cert.Thumbprint)]"
|
||||
}
|
||||
catch { Write-Warning " could not remove $($cert.Thumbprint): $($_.Exception.Message)" }
|
||||
}
|
||||
if (-not $matches) { Write-Host " no matching root certs found." }
|
||||
}
|
||||
else {
|
||||
Write-Host "[5/6] Skipping root-cert removal (pass -RemoveRootCertMatching to enable)."
|
||||
}
|
||||
|
||||
# 6. Delete the install directory and the ProgramData data/log tree.
|
||||
Write-Host "[6/6] Removing files ..."
|
||||
if (Test-Path $InstallDir) {
|
||||
try { Remove-Item -Path $InstallDir -Recurse -Force -ErrorAction Stop; Write-Host " removed $InstallDir" }
|
||||
catch { Write-Warning " could not remove $InstallDir (a file may still be locked): $($_.Exception.Message)" }
|
||||
}
|
||||
else { Write-Host " $InstallDir not present." }
|
||||
|
||||
$dataDir = Join-Path $env:ProgramData "ShopDB"
|
||||
if (-not $KeepLogs -and (Test-Path $dataDir)) {
|
||||
try { Remove-Item -Path $dataDir -Recurse -Force -ErrorAction Stop; Write-Host " removed $dataDir" }
|
||||
catch { Write-Warning " could not remove $dataDir : $($_.Exception.Message)" }
|
||||
}
|
||||
elseif ($KeepLogs) { Write-Host " keeping $dataDir (-KeepLogs)." }
|
||||
|
||||
# Also prune an empty C:\Program Files\ShopDB parent left behind.
|
||||
$parent = Split-Path -Parent $InstallDir
|
||||
if ((Test-Path $parent) -and -not (Get-ChildItem -Path $parent -Force -ErrorAction SilentlyContinue)) {
|
||||
try { Remove-Item -Path $parent -Force -ErrorAction Stop; Write-Host " removed empty $parent" } catch { }
|
||||
}
|
||||
|
||||
Write-Host "`nUninstall complete." -ForegroundColor Green
|
||||
Write-Host "Verify with: Get-Service $ServiceName ; Get-Process shopdbagent,$trayBase ; reg query 'HKLM\SOFTWARE\GE\ShopDB'"
|
||||
Reference in New Issue
Block a user