Roll Back a Windows Agent Installation

If the installation fails, the MSI installer rolls back the installation on the host machine and cleans up the system by removing any folders and files resulting from the failed installation attempt. If this cleanup does not occur, do the following to manually clean up and remove the Windows agent folders and files from the host.

1. Open a PowerShell terminal as administrator.

2. Check the state of the LWDataCollector service by entering the command:

   C:\Users\Administrator> sc.exe query LWDataCollector

   If it is not already removed, remove the service by entering the command:

   C:\Users\Administrator> sc.exe delete LWDataCollector

3. Check the state of the lwdcs driver by entering the command:

   sc.exe query lwdcs

   If it is not already removed, remove the driver by entering the command:

   C:\Users\Administrator> sc.exe delete lwdcs

4. Remove the Windows agent directories:

   • C:\Program Files\Lacework
   • C:\ProgramData\Lacework

5. Open Add or remove programs on your host and uninstall LWDataCollector from the list of programs.

6. Open Registry Editor and do the following:

   • Delete the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\<128-bit GUID> that has the registry value ProductName = LWDataCollector.
   • Delete the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\<Hex value> that has the registry value ProductName = Lacework Agent Version <version-number>.