How to Uninstall the Secureworks Red Cloak Endpoint Agent

The Secureworks Red Cloak Endpoint agent may require uninstallation to:

• Troubleshoot the product
• Address operating system incompatibilities

This article covers the steps to uninstall the product.

Affected Product:

• Secureworks Red Cloak Endpoint

Affected Operating Systems:

• Windows
• Linux

Click Windows or Linux for the steps to uninstall the Secureworks Red Cloak Endpoint agent.

Windows

An administrator must first uninstall the Secureworks Red Cloak Endpoint agent on Windows. The Secureworks Red Cloak Endpoint agent on Windows can be uninstalled using the user interface (UI) or the command-line interface (CLI). Then an administrator may run Registry and File System Cleanup. Click the appropriate process for more information.

UI

1. As an administrator, right-click the Windows start menu and then click Run.
   
2. In the Run UI, type appwiz.cpl and then click OK.
   
3. In Programs and Features, select Dell SecureWorks Ignition and then click Uninstall.
   
   Note: This removes the application but leaves the registry and file system intact.
4. When prompted, select Yes to confirm the removal.
   
5. In Programs and Features, select Dell SecureWorks Red Cloak and then click Uninstall.
   
   Note: This removes the application but leaves the registry and file system intact.
6. When prompted, select Yes to confirm the removal.
   
7. To clean up the endpoint, follow the steps in Registry and File System Cleanup.

CLI

1. As an administrator, right-click the Windows start menu and then click Run.
   
2. In the Run UI, type cmd and then click OK.
   
   Note: The commands to uninstall Secureworks Red Cloak Threat Detection & Response on Windows using CLI vary between versions. For versioning information, reference How to Identify the Secureworks Red Cloak Endpoint Agent Version.
3. Run the uninstall command or commands.
   1. If using version 2.1.4.0 and later:
      1. Type wmic product where name="Dell SecureWorks Red Cloak" call uninstall /nointeractive and then press Enter.
      2. Type wmic product where name="Dell SecureWorks Ignition" call uninstall /nointeractive and then press Enter.
         
      3. Go to Step 4.
   2. If using version 2.0.7.10 and earlier:
      1. Type msiexec.exe /x <PATH>\redcloak.msi and then press Enter.
         
         Note: <PATH> = Variable file path where redcloak.msi resides
      2. Go to Step 4.
4. Wait for the commands to run and then close Command Prompt.

Registry and File System Cleanup

1. As an administrator, right-click the Windows start menu and the click Run.
   
2. In the Run UI, type appwiz.cpl and then click OK.
   
3. Press CTRL + F.
4. From the Find dialog box, type red cloak and then click Find Next.
   
5. Right-click the returned result and then select Delete.
   
6. Repeat Steps 3, 4, and 5 until no further results are returned.
7. Open File Explorer, go to C:\Program Files (x86), locate the Dell SecureWorks folder, and then delete it.
   

Linux

The process to uninstall Secureworks Red Cloak Endpoint Agent differs between CentOS, Red Hat Linux, Oracle Linux, Amazon Linux 2, and Ubuntu. Click the appropriate operating system for the steps to uninstall the Secureworks Red Cloak Endpoint agent.

CentOS, Red Hat Linux, Oracle Linux, Amazon Linux 2

1. Log in to the endpoint.
2. Click Activities in the upper left.
   
3. Click System Tools.
   
4. Click Terminal.
   
5. In Terminal, type yum remove redcloak and then press Enter.
   
6. Type Y and then press Enter to confirm the uninstall.

Ubuntu

1. Log in to the endpoint.
2. Click Show Applications from the lower left.
   
3. Click Terminal.
   
4. In Terminal, type apt-get remove redcloak and then press Enter.
   
5. Type Y and then press Enter to confirm the uninstall.

To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.