Uninstall FOG-Client (Service) after deploying with Snapin?

[jcrod73]

Re: Uninstall FOG-Client (Service) after deploying with Snapin?

The reference topic was marked as solved but what was the resolution? I am having to do this as well. I have tried different snapin configurations to run the uninstall but nothing happens on the client.

[george1421]

@jcrod73 What is the use case for uninstalling the FOG client after deployment? There may be a different solution available to you.

[jcrod73]

@george1421 Thanks for the reply. Pretty much the same as the original referenced post. There is a list of approved applications and the FOGService isn’t approved.

I am imaging laptops, having the approved software installed via snapins, then the FOGService needs to be removed. I have tried different snapin methods as mentioned in the referenced post. Tried using a bat script, tried converting the bat to an exe, tried using the msi file. The referenced post is marked solved but no indication as to what solved it?

[george1421]

@jcrod73 Ok the problem is you are trying to cut the branch you are standing on. You need the fog client to install the snapin to remove the fog client.

So how can you do this (on a high level).

1. Add a task to the RUNONCE registry so the next time the computer is rebooted the command will run to remove the application.
2. Create a scheduled task to run the command after the snapin finishes.

I don’t use the fog client in my environment so I can’t confirm this for you. but look in the registry for the fog client uninstall string. It should be in this area: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer once you have the uninstall string you can then craft msiexec /x <guid> /q to uninstall the FOG client. Or if you have the fog client msi, drop the msi behind on the target computer and then reference that file with the /x command. There are a couple of ways to uninstall it, you just can’t use the fog client itself to uninstall it.

The other option is to no use the fog client (and services it provides) but use a third party tool like pdq deploy to install your packages. This gives a zero footprint on the target computer.

[jcrod73]

@george1421 I figured it had something to do with cutting the branch I was standing on. Great analogy! I’ll give what you suggested a shot! Thanks!!

[jcrod73]

@george1421 OK…So I created 2 bat files. One bat file will add a registry entry to “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce”. The other bat file runs the uninstall from the UninstallString command, like you mentioned. I just need the snapin to run the first bat file so that it adds the registry entry then, on reboot, that will run the second bat file to uninstall the service.

Doing this locally on the target machine works fine. The registry entry gets added and after reboot it runs the uninstaller. The FogService is uninstalled.

I created a bat template snapin and it runs fine and the task completes. The registry entry never gets added though. I have tried converting the bat file to an exe and that, as a task, never completes. The command that the snapin is running is just the basic batch template “cmd.exe /c AddtoRegRO.bat”

Any ideas??

[george1421]

@jcrod73 That run once key exists in 2 locations. One in the 64 bit name space and one in the 32 bit name space. If the FOG Client is 32 bit (I have no idea) but it will add the key to the SYSWOW64 32 bit root registry root path. The point it it may be there just not in the 64 bit registry space.

[jcrod73]

@george1421 This is the bat file that I can run locally on the target machine and it works fine:

REG ADD “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce” /V “FOGServiceUninstall” /t REG_SZ /F /D “C:_Install\Image Reset W10 x64_2019\FOGServiceUninstall.bat”

I don’t see how it could end up in any other registry container?

The snapin runs and “completes” but the registry entry never gets put in “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce”

[Sebastian Roth]

@jcrod73 @george1421 The fog-client runs as SYSTEM. Should not make a difference for the reg key mentioned but I thought I might throw that in.

Search the forums for “psexec” to find a hint on how to test your script run in SYSTEM context.

[george1421]

@sebastian-roth said in Uninstall FOG-Client (Service) after deploying with Snapin?:

The fog-client runs as SYSTEM

@jcrod73

OK here is what I’m thinking. I’m not saying its the exact case here but I’ve experienced this in the past.

If the application that is running is 32 bits (regardless as who it runs as), windows knows this. Windows will map the 32bit application to this path (akin to chroot) to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node So if you have a 32 bit application creating the runonce key, the value should be found here: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Whereas a 64 bit application would create the key here: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Note the: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce would only “run once” the current user who created the key logs in again (i.e. SYSTEM). You will probably not get the response you expected from that reg key location.

I’m speculating the fog client is a 32 bit app because I don’t see an install for 32bit vs 64bit its just one install. I don’t know if the installer is smart enough to install the 32 bit stuff for a 32 bit machine and the 64 bit stuff for a 64 bit machine. So some of this is just an educated guess.