Removing ConnectWise (itsupport247) agent

As I didn't see a built-in script for the removal of the (now) ConnectWise RMM agent for the platform that used to be Continuum and operates at itsupport247.net, I wanted to share what I've come up with if it's helpful to anyone else. This uninstalls ITSPlatform and ScreenConnect Client, then cleans up SAAZOD folders and registry items left behind. I've run this on set as image.

wmic product where "name like '%ITSPlatform%'" call uninstall /nointeractive
wmic product where "name like '%ScreenConnect Client%'" call uninstall /nointeractive

Stop-Service -Name "SAAZappr"
Stop-Service -Name "SAAZDPMACTL"
Stop-Service -Name "SAAZRemoteSupport"
Stop-Service -Name "SAAZScheduler"
Stop-Service -Name "SAAZServerPlus"
Stop-Service -Name "SAAZWatchDog"
If (Test-Path "C:\Program Files (x86)\SAAZOD"){
   Remove-Item "C:\Program Files (x86)\SAAZOD" -Force -Recurse
} else {}
If (Test-Path "C:\Program Files (x86)\SAAZODBKP"){
   Remove-Item "C:\Program Files (x86)\SAAZODBKP" -Force -Recurse
} else {}
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Virtual Machine\Guest" -Name "ITSPlatformID" -Force
Remove-Item "HKLM:\SOFTWARE\WOW6432Node\SAAZOD" -Force
Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZappr" -Force
Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZDPMACTL" -Force
Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZRemoteSupport" -Force
Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZScheduler" -Force
Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZServerPlus" -Force
Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZWatchDog" -Force
5

Comments (8 comments)

Avatar
Phil Long

Did you use that because the CWRMM agent didnt translate to your session hosts afterwards?  

0
Avatar
Gregory Barr

Without some of these steps, some RMM ID was carried through and multiple machines were acting as one to RMM.

Next thing I'm looking to figure out is to carry that ID forward when host is reimaged so that it does not fill up with duplicate machines.

0
Avatar
Phil Long

Yeah, the duplicate agent entries seem almost unavoidable working with the images and re imaging regularly.  I've been setting some scheduled tasks to run a script (checks hostname) to install my different agent packages on session hosts.  I still end up with duplicate agent entries to go clean up but I like keeping the agents off my image since it doesn't actively run.  

I asked ITS247 support (or CWRMM ) if they will be adding the feature to auto delete agents that haven't checked in after a period of time but they were not aware of the feature in any upcoming releases.  

0
Avatar
Gregory Barr

I'm just starting working on installing RMM agent on image VM. This was shown as a method to apply OS patches using RMM in a session at Nerdiocon. Setting image VM to startup on a schedule to install patches, then shutdown and update image.

0
Avatar
Marcos Artiaga

I'm facing the same problem currently. What I'm envisioning is a script that installs on newly created hosts and then another script that runs on scale in to remove the agent prior to deletion. Haven't figured out a method to do either yet.

0
Avatar
Gregory Barr
(Edited )

This is my ConnectWise DPMA install script as it stands right now. It will download the latest version of installer and checks MSI file attribute to check that download is good before installing.

# Desktop agent download URL from RMM Setup
$DPMAAgentURL = "https://prod.setup.itsupport247.net/windows/DPMA/32/<SITE_NAME>_DPMA_ITSPlatform_<SITE_ID>/MSI/setup"

# Desktop agent MSI file name
$DPMAAgentFile = "C:\!Tech\Software\DPMA\<SITE_NAME>_DPMA_ITSPlatform_<SITE_ID>.msi"

# Check if ITSPlatform already installed
$PreviouslyInstalledITS = get-wmiobject -class Win32_product | Where-object {$_.Name -like "ITSPlatform"}

If ($PreviouslyInstalledITS -eq $NULL){
# Attempt to download DPMA MSI
$HTTPResponse = Invoke-WebRequest -Uri $DPMAAgentURL -OutFile $DPMAAgentFile

# If download status code not equal $Null, attempt download up to 5 more times
$i = 1
$max = 5
DO {
 If($HTTPResponse -eq $Null) {
    break}
  $HTTPResponse = Invoke-WebRequest -Uri $DPMAAgentURL -OutFile $DPMAAgentFile
 $i++
} WHILE ($i -le $max)

# Read properties from downloaded MSI file
$msifile = $DPMAAgentFile

$WindowsInstaller = New-Object -ComObject WindowsInstaller.Installer
$MSIDatabase = $WindowsInstaller.GetType().InvokeMember('OpenDatabase', 'InvokeMethod', $Null, $WindowsInstaller, @($msifile, 0))
$Query = 'SELECT * FROM Property'
$View = $MSIDatabase.GetType().InvokeMember('OpenView', 'InvokeMethod', $null, $MSIDatabase, ($Query))
$View.GetType().InvokeMember('Execute', 'InvokeMethod', $null, $View, $null)

$hash = @{}
$MSIResult = while ($Record = $View.GetType().InvokeMember('Fetch', 'InvokeMethod', $null, $View, $null)) {
$name = $Record.GetType().InvokeMember('StringData', 'GetProperty', $null, $Record, 1)
$value = $hashMSIValue = $Record.GetType().InvokeMember('StringData', 'GetProperty', $null, $Record, 2)
$hash.Add($name,$value)
}

$msiProperties = [pscustomobject]$hash

$ProductName = $msiProperties | Select-Object -Expand ProductName

# Verify MSI by checking ProductName value. Install if match

If ($ProductName -eq "ITSPlatform"){
 start-process msiexec.exe -Wait -ArgumentList "/I $DPMAAgentFile /quiet"
} else {Write-Host "MSI check failed"}

} else {
Write-Host "ITSPlatform already installed"
}
0
Avatar
Marcos Artiaga

Should I need to change anything other than the URL and the file name?

0
Avatar
Shane Vanhulle
(Edited )

Thanks for the uninstall script Gregory. It was hanging in a few spots for me so I added error handling if anyone needs this version.

 

##### Variables #####
$SVC1 = "SAAZappr"
$SVC2 = "SAAZDPMACTL"
$SVC3 = "SAAZRemoteSupport"
$SVC4 = "SAAZScheduler"
$SVC5 = "SAAZServerPlus"
$SVC6 = "SAAZWatchDog"

##### Script Logic #####

$job = Start-Job -ScriptBlock {
    wmic product where "name like '%ITSPlatform%'" call uninstall /nointeractive
}

# Wait for the job to complete with a timeout (in seconds)
$job | Wait-Job -Timeout 30

$job = Start-Job -ScriptBlock {
    wmic product where "name like '%ScreenConnect Client%'" call uninstall /nointeractive
}

# Wait for the job to complete with a timeout (in seconds)
$job | Wait-Job -Timeout 30

## Stop SVC1 ##
Try {
    Stop-Service -Name $SVC1 -Force -ErrorAction Stop
    Write-Host "Service $serviceName stopped successfully."
}
Catch {Write-Host "Error: $($_.Exception.Message)"}

## Stop SVC2 ##
Try {
    Stop-Service -Name $SVC2 -Force -ErrorAction Stop
    Write-Host "Service $serviceName stopped successfully."
}
Catch {Write-Host "Error: $($_.Exception.Message)"}

## Stop SVC3 ##
Try {
    Stop-Service -Name $SVC3 -Force -ErrorAction Stop
    Write-Host "Service $serviceName stopped successfully."
}
Catch {Write-Host "Error: $($_.Exception.Message)"}

## Stop SVC4 ##
Try {
    Stop-Service -Name $SVC4 -Force -ErrorAction Stop
    Write-Host "Service $serviceName stopped successfully."
}
Catch {Write-Host "Error: $($_.Exception.Message)"}

## Stop SVC5 ##
Try {
    Stop-Service -Name $SVC5 -Force -ErrorAction Stop
    Write-Host "Service $serviceName stopped successfully."
}
Catch {Write-Host "Error: $($_.Exception.Message)"}

## Stop SVC6 ##
Try {
    Stop-Service -Name $SVC6 -Force -ErrorAction Stop
    Write-Host "Service $serviceName stopped successfully."
}
Catch {Write-Host "Error: $($_.Exception.Message)"}

## Remove Folders and Files ##
If (Test-Path "C:\Program Files (x86)\SAAZOD"){
   Try {
        Remove-Item "C:\Program Files (x86)\SAAZOD" -Force -Recurse -Confirm:$false -ErrorAction Stop
   }
   Catch {Write-Host "Error: $($_.Exception.Message)"}
} else {}
If (Test-Path "C:\Program Files (x86)\SAAZODBKP"){
   Try {
        Remove-Item "C:\Program Files (x86)\SAAZODBKP" -Force -Recurse -Confirm:$false -ErrorAction Stop
   }
   Catch {Write-Host "Error: $($_.Exception.Message)"}
} else {}

## Remove Registry Keys ##
Try {Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Virtual Machine\Guest" -Name "ITSPlatformID" -Force -Confirm:$false -ErrorAction Stop}
Catch{Write-Host "Error: $($_.Exception.Message)"}
Try {Remove-Item "HKLM:\SOFTWARE\WOW6432Node\SAAZOD" -Recurse -Force -Confirm:$false -ErrorAction Stop}
Catch{Write-Host "Error: $($_.Exception.Message)"}
Try {Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZappr" -Recurse -Force -Confirm:$false -ErrorAction Stop}
Catch{Write-Host "Error: $($_.Exception.Message)"}
Try {Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZDPMACTL" -Recurse -Force -Confirm:$false -ErrorAction Stop}
Catch{Write-Host "Error: $($_.Exception.Message)"}
Try {Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZRemoteSupport" -Recurse -Force -Confirm:$false -ErrorAction Stop}
Catch{Write-Host "Error: $($_.Exception.Message)"}
Try {Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZScheduler" -Recurse -Force -Confirm:$false -ErrorAction Stop}
Catch{Write-Host "Error: $($_.Exception.Message)"}
Try {Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZServerPlus" -Recurse -Force -Confirm:$false -ErrorAction Stop}
Catch{Write-Host "Error: $($_.Exception.Message)"}
Try {Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SAAZWatchDog" -Recurse -Force -Confirm:$false -ErrorAction Stop}
Catch{Write-Host "Error: $($_.Exception.Message)"}
0

Please sign in to leave a comment.