There are multiple options available to uninstall the LimaCharlie sensor, depending on the operating system and/or method of installation. macOS and Windows systems allow for easy uninstallation via sensor commands or D&R rules. Linux systems may require additional steps, as detailed below.
macOS and Windows
When uninstalling macOS and Windows Sensors, please attempt to utilize a method similar to sensor deployment. For example, if sensors were deployed via a package manager, then the same package manager may have uninstall options as well. This will help keep software inventories up to date.
On Windows, the LimaCharlie sensor can be uninstalled on individual endpoints by running the installer EXE with the
-c argument, which will remove the Sensor and its service entirely.
If uninstalling via the Windows MSI installer, the
/x switch can be used to uninstall.
msiexec /x lc_sensor.msi /qn
If you run into issues where the service is still present (
sc.exe query rphcpsvc) or the exe is still left behind (
C:\Windows\System32\rphcp.exe), you can remove them with the following:
C:\Windows\System32\rphcp.exe -c # If this throws an error about the service, it's safe to ignore
Manual installation of macOS Sensors is detailed here.
For macOS and Windows operating systems, you can uninstall a sensor with the
uninstall command. More information on that can be found here.
On Windows, the command defaults to uninstalling the sensor as if installed from the direct installer exe. If an MSI was used for installation, you can add a
--msi flag to the
uninstall command to trigger an uninstallation that is compatible with MSI.
To run the uninstall command against all Sensors, a simple loop with the SDK in Python would work:
lc = limacharlie.Manager()
for sensor in lc.sensors():
sensor.task( 'uninstall' )
Using a D&R Rule
As an alternative approach, you can also use a Detection & Response (D&R) rule to automatically trigger an uninstall of the LimaCharlie sensor when a sensor connects to the LimaCharlie cloud. Below is an example of the rule you can use for this purpose. This example is specific to Windows-based endpoints, but can be modified based on your needs:
op: is windows
- action: task
command: uninstall --is-confirmed
- action: add tag
Package Management Tools
For Package Management tools, and other enterprise application-management tools, we recommend utilizing the integrated program removal options, rather than installing from LimaCharlie. This will help keep software inventories up to date.
Linux Sensor uninstallation depends on how the sensor was installed. For example, if installed via a Debian package (
dpkg file), you should uninstall via the same mechanism. If you installed via the SystemV installation method, please utilize the bottom of this script.
uninstall command does not work for Linux systems. However, there is a chained command that can be run from the Sensor Console:
run --shell-command "service limacharlie stop; rm /bin/rphcp; update-rc.d limacharlie remove -f; rm -rf /etc/init.d/limacharlie; rm /etc/hcp ; rm /etc/hcp_conf; rm /etc/hcp_hbs"
The above command removes LimaCharlie and associated files from the system when run remotely. Note that the above command could also be coupled with a D&R rule for automated sensor uninstallation, if necessary.
If the sensor was originally installed with the .deb file, this option is the cleanest uninstall method.
apt remove limacharlie