How to Sanitize Agents

Before You Start

Users may want to sanitize agents when:

• Policies are not arriving to the agent
• When a scan is stuck in a failing state

How to Sanitize an Agent using PowerShell

• The easiest way to sanitize an agent is via a PowerShell script
• Run this script from the Windows PowerShell ISE

How to Manually Sanitize Agents

When running a PowerShell script is not an option, the steps here describe how to manually sanitize an agent:

1. Navigate to the local agent machine.
2. Open the Task Manager.
3. Go the Processes tab.
4. KILL the following processes by selecting each process and then pressing the Delete key on the keyboard:

• • Identity Finder Endpoint Service (blue arrows in the screenshot below)
  • Identity Finder idfServicesMonitor (blue arrows in the screenshot below)
    
    
  • If it is running, Identity Finder Command Line process
  • If there were previous Shipper or RMQ connection issues, KILL the process IdentityFinderService (red arrow in the screenshot above) as well

1. Open Windows File Explorer.
2. Navigate to the directory C:\ProgramData\Identity Finder 
3. DELETE all files in the following directories:
4. • Tasks
   • TasksMonitor
   • ScanProgress
   • MCData
   • AdminData
     
4. Navigate to the directory C:\ProgramData\Identity Finder\Application\LocalSearch 
5. Delete the file jobQueueLocal.db.
6. Navigate to C:\ProgramData\Identity Finder\Application\Console\DistributedSearchInfo 
7. Delete the file DistributedSearchInfo.db.
8. Go back to the Task Manager.
9. Select the "Services" tab.
10. START the service IdentityFinderEndpointService.
11. 1. Identity Finder idfServicesMonitor service will start automatically
       
    2. IF the IdentityFinderService was previously stopped, this service must be restarted manually
11. Any directories or deleted databases are automatically recreated/regenerated when the service IdentityFinderEndpointService restarts.

*** Unless there are issues shredding temp files, or the directory is full and consuming a lot of memory, there is no need to delete the the directory IDFTmpDir or anything in it, and there is no need to delete anything in the directory boost_interprocess***