How to Uninstall RSA NetWitness Windows Legacy Collector from a Windows Server

Issue

Use these steps to uninstall the RSA Security Analytics Windows Legacy Collector from a Windows server.

Resolution

1. Logon to the RSA Security Analytics Server WebUI and remove the Windows Legacy Collector from the Hosts tab.
2. Logon to the Windows Server as Administrator.
3. From a command prompt type services.msc to administer Windows Services.
4. Stop the NwLogCollector and RabbitMQ services and disable services.
5. Right click on Windows Taskbar and start Task Manager. Go to the Details tab and kill any running epmd.exe (Erlang) processes (this is especially important if OS reboot is not possible for the last step and the Windows Legacy Collector is being immediately reinstalled).
6. Navigate to Control Panel | Programs | Uninstall a program.
7. Verify the following circled packages are installed.

5. Select each package in turn and click "Uninstall" to remove:

6. You may also remove the four Microsoft Visual C++ Redistributable packages that are installed as part of the SA 10.6.3 Windows Legacy Collector installation, but you may wish to leave these packages if you have concerns about other dependencies.

7. Reboot your Windows server after removing the Windows Legacy Collector components that are no longer necessary.

Product Details

RSA Product Set: NetWitness Logs & Network/Security Analytics
RSA Product/Service Type: Windows Legacy Collector (WLC/LWC)
RSA Version/Condition: 10.5.x, 10.6.x, 11.X
Platform: Windows

Summary

Use these steps to uninstall RSA NetWitness Windows Legacy Collector from a Windows Server.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue