Uninstall Netwrix Auditor Compression and Core Services

1. On the computer where Netwrix Auditor Server resides, navigate to Start → Run and type "cmd".

2. Execute the following command:

   Netwrix_Auditor_installation_folder\Active Directory Auditing\adcr.exe /removecompressionservice domain=<domain name>

   where <domain name> is the name of the monitored domain in the FQDN format.

   NOTE: If any argument contains spaces, use double quotes.

   Example:

   "C:\Program Files\Netwrix\Active Directory Auditing\adcr.exe" /removecompressionservice domain=domain.local

3. To delete Compression Services from a specific domain controller, execute the following command:

   Netwrix_Auditor_installation_folder\Active Directory Auditing\adcr.exe /removecompressionservice dc=<domain controller name>

   NOTE: If any argument contains spaces, use double quotes.

NOTE: Perform this procedure only if you enable the Network traffic compression option for data collection.

1. On the target servers, navigate to Start → Control Panel → Programs and Features.
2. Select Netwrix Auditor for File Servers Compression Service and click Uninstall.

NOTE: During the Netwrix Auditor for SharePoint Core Service installation / uninstallation your SharePoint sites may be unavailable.

1. In the audited SharePoint farm, navigate to the computer where Central Administration is installed and where the Netwrix Auditor for SharePoint Core Service resides.
2. Navigate to Start → Control Panel → Programs and Features.

3. Select Netwrix Auditor for SharePoint Core Service and click Uninstall.

   NOTE: Once you click Uninstall you cannot cancel the uninstallation. The Netwrix Auditor for SharePoint Core Service will be uninstalled even if you click Cancel.

NOTE: Perform this procedure only if you enabled the Compression Service for data collection.

1. On the target servers, navigate to Start → Control Panel → Programs and Features.
2. Select Netwrix Auditor for Windows Server Compression Service and click Uninstall.

1. On every computer where a monitored Exchange is installed, navigate to Start → Run and type "cmd".

2. Execute the following command:

   sc delete “Netwrix Auditor Mailbox Access Core Service”

3. Remove the following folder: %SYSTEMROOT%\Netwrix Auditor\Netwrix Auditor Mailbox Access Core Service.

   NOTE: If any argument contains spaces, use double quotes.

• Remove the Core Service via Netwrix Auditor client on the computer where Netwrix Auditor Server resides:
1. Navigate to All monitoring plans and specify the plan.
2. In the right pane select the Items tab.
3. Select a computer in the list and click Remove. The Netwrix Auditor User Activity Core Service will be deleted from the selected computer. Perform this action with other computers.
4. In the left pane navigate to All monitoring plans → User Activity monitoring plan → Monitored Computers. Make sure that the computers you have removed from auditing are no longer present in the list.
5. In case some computers are still present in the list, select them one by one and click Retry Uninstallation. If this does not help, remove the Core Services manually from the target computers through Programs and Features.
• Remove the Netwrix Auditor User Activity Core Service manually on each audited computer:
  1. Navigate to Start → Control Panel → Programs and Features.
  2. Select Netwrix Auditor User Activity Core Service and click Uninstall.