Force remove Elastic Agent on SO 2.4

[jtchi717]

Version

2.4.0

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

64

Storage for /

2tb

Storage for /nsm

3 days retention

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Previous installation of SO 2.4 failed so decided to reinstall fresh with all 3 nodes manage/search/sensor. The previous installation has Elastic Agents installed on endpoint workstations.
When trying to install over it, I get:
"
Error: already installed at: C:\Program Files\Elastic\Agent
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.10/fleet-troubleshooting.html
: exit status 1
"

Question: How do I remove the old agent (no longer connect to host) and reinstall the new one.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[jtchi717]

This appears to be a workaround.. please let me know if there's an official procedure on this.

1. Use ""c:\Program Files\Elastic\Agent\elastic-agent.exe" uninstall -f" to uninstall the agent. You will get an error due to service is running.
2. Restart the workstation
3. Reinstall as normal.

This works, however it requires a restart to complete.

[Bal33p]

You may want to move the host to a policy that does not have any integrations installed and all monitoring is disabled.