Removal of Rapid7 Agent from Laptops/Desktops Automatically

InsightVM
1

Hi,

I need help with a script of removing Rapid7/Nepose/InsightVM Agent from more than 3K computers. I am having a hard time finding anything or getting a script to work on removing Rapid7 from laptops/Desktop computers automatically. I was wondering if there was a script that Rapid7 has or someone has created to do this process.

This is what I am currently using. It worked on mine computer via Microsoft Intune, however I am not getting any failed attempts and I am running it as a powershell script, and when I do spot checks on a set of computer, it states that it was successful, however when I check that computer, it is showing that it is still installed and the directory folder is still on the computer under C:/Program Files/Rapid7. Any help would be great.

Thanks,

1 Like
2

ffrank,

Here is a script that I use:
(Get-WmiObject -Class Win32_Product | Where {$_.Vendor -like “Rapid7”}).Uninstall()

It will also remove the Scan Assistant if you use that and any multiple copies of the software.

1 Like
3

Hi Michael,

Thanks for the script that you use. However, that does not work.

4

This however did work. You need your uninstall token to uninstall the software from your computer completely. Also, you need to find out where the msi uninstall string is located in the registkey, having the uninstallRegPath will provide the uninstall string for your powershell command. I then added this to your scripts and remediation in Microsoft Intune and added test groups and it worked on removing Rapid7 completely through an automated process.

Define the registry path where the uninstall information is located

$uninstallRegPath = “HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall”

Define the display name of the application you want to uninstall

$appDisplayName = “Rapid7 Insight Agent”

Search for the uninstall string in the registry

$uninstallString = (Get-ItemProperty -Path “$uninstallRegPath*” | Where-Object { $_.DisplayName -eq $appDisplayName }).UninstallString

If the uninstall string is found, proceed with the uninstallation

if ($uninstallString) {
# Append the uninstall token and quiet mode switch to the uninstall string
$uninstallToken = “Use Your UNINSTALLTOKEN”
$uninstallString += " UNINSTALLTOKEN=$uninstallToken /quiet"

# Run the uninstallation
Write-Host "Uninstalling $appDisplayName..."
Start-Process -FilePath "cmd.exe" -ArgumentList "/c", $uninstallString -Wait -NoNewWindow
Write-Host "$appDisplayName has been uninstalled."

} else {
Write-Host “Application $appDisplayName not found.”
}