How to Uninstall AMP for Endpoints Windows Connector with Safe Mode

Introduction

This document describes the steps to uninstall an Advanced Malware Protection (AMP) for Endpoints connector through Safe Mode on Windows operating systems.  This is only required if you run into a problem with the Add/Remove Programs option or if there is a major issue, such as a Blue Screen of Death (BSoD). 

Booting into Safe Mode

To boot into Safe Mode, follow the instructions provided by Microsoft based on your Operating System.  

Windows 10

Windows 8 (Server 2012 and Server 2016)

Windows 7

Uninstalling AMP

Booting into safe mode prevents the AMP drivers from loading, so the BSoD issue is avoided while the system loads.  Verify that you are in safe mode by looking at the corners of the screen for the words Safe Mode.

Open File Explorer, navigate to C:\Program Files\Cisco\AMP\<version_number>, and select uninstall.exe. 

For example:  C:\Program Files\Cisco\AMP\7.2.3 

Proceed through the Uninstall menus until the Uninstallation Complete screen.  

Select Close.  When asked, Do you plan on installing Cisco AMP for Endpoints Connector again?, select Yes to save historical data or no to remove all data.

Restart the computer.  AMP is now uninstalled and a stable version can be installed.  If you encounter any issues with this procedure, open a case with Cisco Support.

Known Issues

An issue discovered after the release of AMP for Endpoints Windows connector 7.2.3, CSCvt56075, caused some endpoints to encounter a stop error (BSoD).  Endpoints that did not encounter the error can still encounter this while upgrading to 7.2.5 or uninstalling 7.2.3.  In these cases, the recommendation is to uninstall AMP through Safe Mode and perform a fresh installation of 7.2.5.