/build/static/layout/Breadcrumb_cap_w.png
04/06/2017 1117 views

I recently started tackling some of the dead agents in our environment and have been getting mixed results. Hoping someone can light the way…

Environment:

Kbox: v6.4.120756

Agent: v6.4.522

Clients: Win 7 and Win 10

Agent Install: We Use GP to push the agent

 

 

First, I tried uninstalling the agents via the Provisioning Tool and “Technically” it worked. However, I started receiving nasty-grams about systems abruptly rebooting. Ended up that about 5-10% of the targeted machines rebooted after uninstall.

 

So Instead I decided go a different direction and Run a PSExec command:

"C:\Program Files (x86)\Dell\KACE\AMPTools.exe" –uninstall

This produced the same results...

 

Here is what I get from Event Viewer (All computers that restarted are consistent):

 

1.    Konea 1 “konea is Stopping!

2.    MsiInstaller 1040 “Beginning a Windows Installer transaction: {04951A4E-C818-43A7-83A1-A9A74B430A27}. Client Process Id: 13012.”

3.    MsiInstaller 11724 “Product: Dell KACE Agent -- Removal completed successfully.

4.    MsiInstaller 1034 “Windows Installer removed the product. Product Name: Dell KACE Agent. Product Version: 6.4.522. Product Language: 1033. Manufacturer: Dell Inc. Removal success or error status: 0.

5.    MsiInstaller 1038 “Windows Installer requires a system restart. Product Name: Dell KACE Agent. Product Version: 6.4.522. Product Language: 1033. Manufacturer: Dell Inc.. Type of System Restart: 1. Reason for Restart: 1.

6.    MsiInstaller 1042 “Ending a Windows Installer transaction: {04951A4E-C818-43A7-83A1-A9A74B430A27}. Client Process Id: 13012.

7.    MsiInstaller 1005 “The Windows Installer initiated a system restart to complete or continue the configuration of 'Dell KACE Agent'.

 

 It looks like Amptools.exe is just passing the uninstall string to msiexec and not enforcing the /noresart option.


Has anybody else ran into this?

Does anybody have a script for Identifying and fixing dead / non-responsive Kace agents without random reboots? J


Thank you all in advance!

Answer Summary:
1 Comment   [ + ] Show comment

Comments

  • I have not seen this before. Did you end up solving the issue and/or contacting support?
    • Unfortunately, Support just said "That shouldn't happen". They didn't have a good reason or way around this.

      So I am working on a script that will find the Kace Agent entry in the registry, grab the uninstall string and append the /norestart switch. Hopefully that will get me where I need to go :-)

Answer Chosen by the Author

1
Sorry, I forgot about this...

This is what I ended up using to get around the problem. I used PSexec to run it:
$RegUninstallPaths = @(	'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',	'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall')$UninstallSearchFilter = {	($_.GetValue('DisplayName') -like '*Kace*')}foreach ($Path in $RegUninstallPaths){	if (Test-Path $Path)	{		Get-ChildItem $Path | Where-Object $UninstallSearchFilter |		ForEach-Object {			Start-Process 'C:\Windows\System32\msiexec.exe' "/x $($_.PSChildName) /qn /norestart" -Wait -ErrorAction SilentlyContinue		}	}}New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null$ClassesRootPath = "HKCR:\Installer\Products"Get-ChildItem $ClassesRootPath |Where-Object { ($_.GetValue('ProductName') -like '*Kace*') } |ForEach-Object {	Remove-Item $_.PsPath -Force -Recurse -ErrorAction SilentlyContinue}If (Test-Path HKLM:\SOFTWARE\Dell\Kace) { Remove-ItemProperty -Path HKLM:\SOFTWARE\Dell\Kace -name 'Installid', 'Machineid' -ErrorAction SilentlyContinue }If (Test-Path HKLM:\SOFTWARE\WOW6432Node\Dell\Kace) { Remove-ItemProperty -Path HKLM:\SOFTWARE\WOW6432Node\Dell\Kace -name 'Installid', 'Machineid' -ErrorAction SilentlyContinue }
Start-Process 'C:\Windows\system32\CMD.exe' -ArgumentList '/c Echo N | GPUPDATE /Force' -WindowStyle Hidden -ErrorAction SilentlyContinue
Answered 07/12/2017 by: Desktop Jockey
Second Degree Green Belt

All Answers

This content is currently hidden from public view.
Reason: Removed by member request For more information, visit our FAQ's.