Hi all,
I have some SOAR workflows setup to check for the presence of IR Agent and to alert when its missing.
Having had some time now to dig into some of these alerts a bit more, it seems the R7 Agent just randomly uninstalls.
On my own machine, after some Windows updates this morning, the Agent just uninstalled.
Looking at the Windows Event Logs, SYSTEM uninstalls the application. It leaves the folder structure in place in Program Files. There are also still registry keys present (which is what we use for SCCM to detect its presence, so it doesnt get automatically reinstalled)
Anyone seen this before?
Looking for the same - reg keys for R7 Agent for manual uninstall.