Objective    

This article provides detailed information on how to uninstall a Windows agent from the user interface of EventLog Analyzer.

Prerequisites    

• Ensure the required network ports are open:
  
  

• Port 135

• Port 139
  

• Port 445
  

• Dynamic RPC port range (49152-65535)
  
  

• Ensure the user account used for agent management and log collection has the following permissions:
  

Remote services access

• Permission to access and manage remote services (services.msc).

• Access to the Remote Registry service must be enabled and running.
  

Registry access

• Read Control permission for the following registry path:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg

• Read/Write permissions for one of the following registry paths based on your installation:

• HKEY_LOCAL_MACHINE\SOFTWARE\ZOHO Corp\EventLog Analyzer\

• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ZOHO Corp\EventLog Analyzer\

Steps to follow 

1. Log in to EventLog Analyzer as an admin or with a relevant role to manage agents.

2. Navigate to Settings > Admin settings > Agents.

3. Enable the check box for the Windows device(s) on which you wish to uninstall the agent.

4. Click Uninstall.

Note: Agent uninstallation from the UI is possible when all the prerequisites mentioned above are met and the EventLog Analyzer server is able to communicate with the agent.

Validation and confirmation   

1. Check whether the device is removed in Settings > Admin settings > Agents.

2. Use RDP to access the respective Windows machine, then open Control Panel, go to Programs and Features, and check whether the EventLog Analyzer agent is listed.  

Related topics and articles    

• Troubleshooting EventLog Analyzer Agent installation issues