Technical Tip: How to remove stuck FortiEDR collector from Windows

[rduggal_FTNT]

Description	This article describes how to to remove a FortiEDR collector from an endpoint when the regular process to uninstall fails.
Scope	Applies to both On-prem and Cloud FortiEDR deployments.
Solution	Seldom due to config corruption or FortiEDR collector driver load failure uninstallation of collector may fail using FortiEDR Manager or manually from the endpoint. Below Solutions can help in removing the FortiEDR collector from the endpoint: Solution 1: Open the CMD as admin and run below command: "C:\Program Files\Fortinet\FortiEDR\FortiEDRCollectorService.exe" --clean Run the cleanup tool as an admin (even if service operation stopping is timed out, reboot the endpoint). After a reboot, run the cleanup tool again as admin. Solution 2: Boot the machine into Safe mode. This can be done by holding down SHIFT and then selecting 'Restart' from the Windows power option. It will then go into Startup Options - press F5 for Safe Mode with Networking. Alternatively, press F8 upon a reboot of the machine. Run the clean-up tool in safe mode Solution 3: Boot the machine into Safe mode. This can be done holding down SHIFT and then selecting 'Restart' from the Windows power option. It will then go into Startup Options - press F5 for Safe Mode with Networking. Alternatively, press F8 upon a reboot of the machine. Open a Command Prompt with elevated privileges and run the following service command: sc config "FortiEDR Collector Service" start=disabled (This should return a "SUCCESS" string of text). Reboot the machine normally. Then go into Programs and Features and uninstall FortiEDR. Note: Contact Support to get the Cleanup Tool. If there are still any problems encountered, open a new technical support ticket for further assistance: Support Fortinet.