IBM Security QRadar

 View Only
Expand all | Collapse all

WinCollect Standalone mode installation Issues

  • 1.  WinCollect Standalone mode installation Issues

    Posted Mon November 29, 2021 03:02 AM
    Hi All,
    I have QRadar SIEM AIO 7.4.1 in my environment. For some machines, I have to integrate them with QRadar using WinCollect standalone mode on public IP but accidentally my team mate installed the managed mode on those machines. I uninstalled the WinCollect from control panel and deleted the IBM folder from Program Files, then re-installed the agent in standalone mode but the issue is,  agents are still responding to console as managed agent and logs are also not being pushed to QRadar, just receiving the heartbeats. What can I do to completely uninstall managed mode agent and reinstall it in the standalone mode.

    Thanks,

    ------------------------------
    Abdul Rahman
    ------------------------------


  • 2.  RE: WinCollect Standalone mode installation Issues

    Posted Mon November 29, 2021 06:46 AM
    Hello are you first uninstalling with this string to remove all config files?

    msiexec /x{1E933549-2407-4A06-8EC5-83313513AE4B} REMOVE_ALL_FILES=True /qn

    I have found stopping service, then issuing the above, followed by
    reinstalling is my preferred sequence.

    Hope this helps,
    Al