Skip to content

Uninstall Uptycs

Windows#

Option 1: Uninstall Using the MSI Installer#

If you have the MSI installer file, run the following command to uninstall:

msiexec /i <osquery msi file complete path>

Option 2: Uninstall Using the product code#

If you do not have the MSI installer file, you can uninstall using the product code.

  1. Obtain the product code:
    Get-WmiObject Win32_Product | Select-Object Name, IdentifyingNumber | findstr -i osquery
  2. Run the following command:
    msiexec /x <PRODUCT-CODE>

Option 3#

wmic is not installed in Windows 11 by default - use option 1 or 2 for Windows 11 devices

  1. Open a Command Prompt and run the following to stop the service: sc stop uptycsosquery
  2. Check the status of osquery using the following command: sc query uptycsosquery
  3. Check for the osquery PID using the following command: tasklist | findstr -i osquery
  4. If osquery is still running then kill the osquery PID. Execute the following command on the administrative cmd: taskkill /pid /f
  5. Run the following to remove: wmic product where name="Uptycs-Osquery" call uninstall /nointeractive > NUL
  6. Navigate to Control Panel and check if Uptycs-OSquery is still present. If so, uninstall it.

MacOS#

  1. Remove /usr/local/bin/osquery*
  2. Remove /var/log/osquery
  3. Remove /var/osquery
  4. Unload and remove /Library/LaunchDaemons/com.facebook.osqueryd.plist

On macOS, /var is /private/var but they are symlinked.

If you’re running Uptycs Protect, use Finder to drag /Applications/UptycsProtect.app to the Trash to unload the system extension immediately. Reboot the system to complete the uninstall.

Linux#

Uninstall with rpm#

text
sudo systemctl stop osqueryd
sudo rpm -e osquery
# Cleanup osquery directories
sudo rm -rf /etc/osquery
sudo rm -rf /var/osquery
sudo rm -rf /var/log/osquery

Uninstall with yum#

text
sudo systemctl stop osqueryd
sudo yum remove osquery -y
# Cleanup osquery directories
sudo rm -rf /etc/osquery
sudo rm -rf /var/osquery
sudo rm -rf /var/log/osquery

Debian#

  1. Run the commands below to list all install packages if needed.

    text
    sudo apt list --installed

  2. Stop the service.

    text
    sudo service osqueryd stop

  3. Uninstall osquery.

    text
    sudo apt remove osqueryd