Unable to uninstall with tamper protection password

Issue

This guide provides step-by-step troubleshooting for issues where you cannot uninstall the ThreatDown endpoint agent because of an invalid or non-functional tamper protection password. Tamper protection is a security feature that requires a password to modify or remove the software, preventing unauthorized changes.

Before starting, ensure you have administrative access to the affected machine and the ThreatDown console. If the issue persists after following these steps, collect diagnostic logs and contact Support.

Symptoms

• Tamper protection password is not being accepted after it was recently changed.
• Previous tamper protection password is forgotten or does not work.

Resolution

Work through the following tasks in order until the issue is resolved.

Task 1: Verify online status and delete endpoint from console

If the machine is online and visible in the ThreatDown console:

1. Log in to the console and navigate to the Endpoints page.
2. Locate the affected endpoint and attempt to delete it directly from the console. This action bypasses local uninstall issues by removing the agent remotely.
3. After deletion, check if the agent is successfully uninstalled on the machine. If not, proceed to the next step.

Task 2: Download and run the ThreatDown Uninstall Tool

1. Log in to the console and navigate to the Download Center > Advanced Tools.
2. Under ThreatDown Uninstall Tool, click Download. 
3. Copy TDUninstallTool.exe to the target endpoint.
4. Double-click TDUninstallTool.exe.
5. Accept the User Account Control window if prompted.
6. Press Y to accept and continue with the removal.
7. Wait for the on-screen message confirming the removal succeeded. A reboot may be required to complete the cleanup.

For more information on the tool, see ThreatDown Uninstall Tool for Nebula and OneView.