Removing applications or software updates remotely

You can remove applications or software updates on managed devices that run Linux remotely only by using Network Agent.

To remove applications or software updates remotely from selected devices:

In the main menu, go to Assets (Devices) → Tasks.
Click Add.
The New task wizard starts. Proceed through the wizard by using the Next button.
In the Application drop-down list, select Open Single Management Platform.
In the Task type list, select the Uninstall application remotely task type.
In the Task name field, specify the name of the new task.
A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).
Select the devices to which the task will be assigned.
Go to the next step of the wizard.
Select what kind of software you want to remove, and then select specific applications, updates, or patches that you want to remove:
- Uninstall managed application
  A list of Kaspersky applications is displayed. Select the application that you want to remove.
  
  Ensure that the Use uninstallation password policy setting is disabled for the managed application.
- Uninstall incompatible application
  A list of applications incompatible with Kaspersky security applications or Open Single Management Platform is displayed. Select the check boxes next to the applications that you want to remove.
- Uninstall application from applications registry
  By default, Network Agents send the Administration Server information about the applications installed on the managed devices. The list of installed applications is stored in the applications registry.
  
  To select an application from the applications registry:
  1. Click the Application to uninstall field, and then select the application that you want to remove.
    If you select Kaspersky Security Center Network Agent, when you run the task, the status Completed successfully shows that the process of removing started. If Kaspersky Security Center Network Agent is removed, the status does not change. If the task fails, the status changes to Failed.
  2. Specify the uninstallation options:
    - Uninstallation mode
      Select how you want to remove the application:
      
      Define uninstallation command automatically
      If the application has an uninstallation command defined by the application vendor, Open Single Management Platform uses this command. We recommend that you select this option.
      
      Specify uninstallation command
      Select this option if you want to specify your own command for the application uninstallation.
      
      We recommend that you first try to remove the application by using the Define uninstallation command automatically option. If the uninstallation through the automatically defined command fails, then use your own command.
      
      Type an installation command into the field, and then specify the following option:
      
      Use this command for uninstallation only if the default command was not autodetected
      
      Open Single Management Platform checks whether or not the selected application has an uninstallation command defined by the application vendor. If the command is found, Open Single Management Platform will use it instead of the command specified in the Command for application uninstallation field.
      
      We recommend that you enable this option.
    - Perform restart after successful application uninstallation
      If the application requires the operating system to be restarted on the managed device after successful uninstallation, the operating system is restarted automatically.
- Uninstall the specified application update, patch, or third-party application
  A list of updates, patches, and third-party applications is displayed. Select the item that you want to remove.
  
  The displayed list is a general list of applications and updates, and it does not correspond to the applications and updates installed on the managed devices. Before selecting an item, we recommend that you ensure that the application or update is installed on the devices defined in the task scope. You can view the list of devices on which the application or update is installed, via the properties window.
  
  To view the list of devices:
  1. Click the name of the application or update.
    The properties window opens.
  2. Open the Devices section.
    You can also view the list of installed applications and updates in the device properties window.
Specify how client devices will download the Uninstallation utility:
- Using Network Agent
  The files are delivered to client devices by Network Agent installed on those client devices.
  
  If this option is disabled, the files are delivered using the Linux operating system tools.
  
  We recommend that you enable this option if the task has been assigned to devices that have Network Agents installed.
- Using operating system resources through Administration Server
  The option is obsolete. Use the Using Network Agent or Using operating system resources through distribution points option instead.
  
  The files are transmitted to client devices by using the Administration Server operating system tools. You can enable this option if no Network Agent is installed on the client device, but the client device is on the same network as the Administration Server.
- Using operating system resources through distribution points
  The files are transmitted to client devices by using operating system tools through distribution points. You can enable this option if there is at least one distribution point on the network.
  
  If the Using Network Agent option is enabled, the files are delivered by using operating system tools only if Network Agent tools are unavailable.
- Maximum number of concurrent downloads
  The maximum allowed number of client devices to which Administration Server can simultaneously transmit the files. The larger this number, the faster the application will be uninstalled, but the load on Administration Server is higher.
- Maximum number of uninstallation attempts
  If, when running the Uninstall application remotely task, Open Single Management Platform fails to uninstall an application on a managed device within the number of installer runs specified by the parameter, Open Single Management Platform stops delivering the Uninstallation utility to this managed device and does not start the installer on the device anymore.
  
  The Maximum number of uninstallation attempts parameter allows you to save the resources of the managed device, as well as reduce traffic (uninstallation, MSI file run, and error messages).
  
  Recurring task start attempts may indicate a problem on the device and which prevents uninstallation. The administrator should resolve the problem within the specified number of uninstallation attempts and then restart the task (manually or by a schedule).
  
  If uninstallation is not achieved eventually, the problem is considered unresolvable and any further task starts are seen as costly in terms of unnecessary consumption of resources and traffic.
  
  When the task is created, the attempts counter is set to 0. Each run of the installer that returns an error on the device increments the counter reading.
  
  If the number of attempts specified in the parameter has been exceeded and the device is ready for application uninstallation, you can increase the value of the Maximum number of uninstallation attempts parameter and start the task to uninstall the application. Alternatively, you can create a new Uninstall application remotely task.
- Verify operating system type before downloading
  Before transmitting the files to client devices, Open Single Management Platform checks if the Installation utility settings are applicable to the operating system of the client device. If the settings are not applicable, Open Single Management Platform does not transmit the files and does not attempt to install the application. For example, to install some application to devices of an administration group that includes devices running various operating systems, you can assign the installation task to the administration group, and then enable this option to skip devices that run an operating system other than the required one.
Go to the next step of the wizard.
Specify the operating system restart settings:
- Do not restart the device
  Client devices are not restarted automatically after the operation. To complete the operation, you must restart a device (for example, manually or through a device management task). Information about the required restart is saved in the task results and in the device status. This option is suitable for tasks on servers and other devices where continuous operation is critical.
- Restart the device
  Client devices are always restarted automatically if a restart is required for completion of the operation. This option is useful for tasks on devices that provide for regular pauses in their operation (shutdown or restart).
- Prompt user for action
  The restart reminder is displayed on the screen of the client device, prompting the user to restart it manually. Some advanced settings can be defined for this option: text of the message for the user, the message display frequency, and the time interval after which a restart will be forced (without the user's confirmation). This option is most suitable for workstations where users must be able to select the most convenient time for a restart.
  
  By default, this option is selected.
  - Repeat prompt every (min)
  - Restart after (min)
- Force closure of applications in blocked sessions
  Running applications may prevent a restart of the client device. For example, if a document is being edited in a word processing application and is not saved, the application does not allow the device to restart.
  
  If this option is enabled, such applications on a locked device are forced to close before the device restart. As a result, users may lose their unsaved changes.
  
  If this option is disabled, a locked device is not restarted. The task status on this device states that a device restart is required. Users have to manually close all applications running on locked devices and restart these devices.
  
  By default, this option is disabled.
Go to the next step of the wizard.
If necessary, add the accounts that will be used to start the remote uninstallation task:
- No account required (Network Agent installed)
  If this option is selected, you do not have to specify the account under which the application installer will be run. The task will run under the account under which the Administration Server service is running.
  
  If Network Agent has not been installed on client devices, this option is not available.
- Account required (Network Agent is not used)
  Select this option if Network Agent is not installed on the devices for which you assign the Uninstall application remotely task. In this case, you can specify a user account or an SSH certificate to uninstall the application.
  - Local Account. If this option is selected, specify the user account under which the application installer will be run. Click the Add button, select Local Account, and then specify the user account credentials.
    You can specify multiple user accounts if, for example, none of them have all the required rights on all devices for which you assign the task. In this case, all added accounts are used for running the task, in consecutive order, top-down.
  - SSH certificate. If you want to uninstall an application from a Linux-based client device, you can specify an SSH certificate instead of a user account. Click the Add button, select SSH certificate, and then specify the private and public keys of the certificate.
    To generate a private key, you can use the ssh-keygen utility. Note that Open Single Management Platform supports the PEM format of private keys, but the ssh-keygen utility generates SSH keys in the OPENSSH format by default. The OPENSSH format is not supported by Open Single Management Platform. To create a private key in the supported PEM format, add the -m PEM option in the ssh-keygen command.
    
    For example:
    
    ssh-keygen -m PEM -t rsa -b 4096 -C "<user email>"
At the Finish task creation step of the wizard, enable the Open task details when creation is complete option to modify the default task settings.
If you do not enable this option, the task will be created with the default settings. You can modify the default settings later.
Click the Finish button.
The wizard creates the task. If you enabled the Open task details when creation is complete option, the task properties window automatically opens. In this window, you can specify the general task settings and, if required, change the settings specified during task creation.

You can also open the task properties window by clicking the name of the created task in the list of tasks.

The task is created, configured, and displayed in the list of tasks at Assets (Devices) → Tasks.
To run the task, select it in the task list, and then click the Start button.
You can also set a task start schedule on the Schedule tab of the task properties window.

For a detailed description of scheduled start settings, refer to the general task settings.

After the task is completed, the selected application is removed from the selected devices.

Remote uninstallation issues

Sometimes remote uninstallation of third-party applications may finish with the following warning: "Remote uninstallation has finished on this device with warnings: Application for removal is not installed." This issue occurs when the application to be uninstalled has already been uninstalled or was installed only for an individual user. Applications installed for an individual user (also referred to as per-user applications) become invisible and cannot be uninstalled remotely if the user is not logged in.

This behavior differs from applications intended for use by multiple users on the same device (also referred to as per-device applications). Per-device applications are visible and accessible to all users of the device.

Therefore, per-user applications must be uninstalled only when the user is logged in.

Source of information about installed applications

The Network Agent retrieves information about software installed on Windows devices from the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
Contains information about applications installed for all users.
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
Contains information about applications installed for all users.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
Contains information about applications installed for the current user.
HKEY_USER<...>\Software\Microsoft\Windows\CurrentVersion\Uninstall
Contains information about applications installed for specific users.