How to remove the N-ABLE SentinalOne EDR:

 

1: uninstallation from appwiz.cpl:

 

In RMM go to Integration(puzzle icon) > End Point Detection & Response > Policies
Locate the EDR profile the endpoint is assigned to, Click on the Three Dots icon and Select Edit Policy
 
hint: Check device settings > Endpoint Detection and Response to verify policy
On the Policy Page, select the Endpoints tab
Locate the endpoint
check mark the box next to target endpoint
Select Actions > Show Passphrase
 
hint: type "passphrase" to quickly get the show passphrase option 

Afterward, on the workstation/server, go to “uninstall or change program” (appwiz.cpl) and locate the sentinel agent and uninstall it. When asked for the passphrase, input the passphrase we’ve found earlier.

 

 

2.Unintallation using the SentinalCleaner

 

1. Please download the cleaner on the device https://sftp2.n-able.com/?ShareToken=5BC9EC2E7C079C0540B3CAFD668DF997B933A637


(הלינק שבור, ניתן למצוא הורדה לכלי ב- sharepoint תחת product> setninal) 


2.Please extract the files.
3.Open CMD (Run as Admin)
4.Change directory to the location you saved the cleaner. Example cd c:\Users\username\Downloads\SentinelCleaner
5.type in SentinelCleaner_x64.exe -d 0 -k “1”
6.After this has completed, please reboot the server/workstation.
7.After the reboot, please try to delete this folder if it exists C:\Program Files\Sentinel One
8.After you have deleted or checked it is not there
9.Please Go to Services.msc > Please stop the two Ecosystem Services (Ecosystem Agent and Ecosystem Agent Maintenance)
10.Then Go to C:\ProgramData\SolarWinds MSP\Ecosystem Agent\Config
11.Rename the following files EcocutionerConfig.xml and EcocutionerConfig.xml.backup
12.After you have renamed them, please restart the two Ecosystem Services (Ecosystem Agent and Ecosystem Agent Maintenance)
Nable
   

 

3.uninstallation using safe mode

1. Turn Off EDR by right-clicking on the device from the dashboard > Edit Server / Workstation > EDR > set Settings to Off > click OK to save > wait until EDR shows as Not installed on the Summary tab
2. Run the S1 cleaner as instructed below:

a. Reboot the machine into Safe Mode
b. Extract the attached Sentinel Cleaner tool (Note: Ensure you select the correct OS architecture version for the cleaner E.G. x64 or x86)
c. Open the command prompt as Admin
d. Navigate to folder where you have unzipped the cleaner
e. Type: SentinelCleaner.exe -d 0

3. Go to Add/Remove Programs in the Control Panel of the device and look for Ecosystem Agent and uninstall it
4. Once done, look for these folders and files (whichever are still available) and delete them:

C:\Program Files (x86)\Advanced Monitoring Agent\ecosystem_install.log
C:\Program Files (x86)\Advanced Monitoring Agent\feature_20.log
C:\Program Files (x86)\Advanced Monitoring Agent\downloads\ delete any Ecosystem files
C:\Program Files (x86)\Advanced Monitoring Agent\featureres\feature_20.dll (just the DLL file)
C:\Program Files\Solarwinds MSP\Ecosystem Agent
C:\ProgramData\Solarwinds MSP\Ecosystem Agent

5. Reboot the device
6. Once the device is back online on the dashboard, turn On EDR by right-clicking on the device from the dashboard > Edit Server / Workstation > EDR > set Setting to Use Policy Setting ( On ) or just On then select the correct policy > click OK to save
7. Give it time to install EDR on the device