Sentinel One Strikes Again. No internet connection. Uninstall Sentinel One Agent.

This happened to a co-worker of mine a while back when his test application file was marked as suspicious by Sentinel One antivirus and had his internet on his laptop disabled. Today, it happened to me without any suspicious file. Probably suspicious activity, who knows. On Microsoft Edge, it says "Hmmm... your Internet access is blocked.", "Firewall or antivirus software may have blocked the connection", and "ERR_NETWORK_ACCESS_DENIED".

So, I worked with my IT to uninstall the agent, but uninstalling is not without a fight. Here are the steps that I took:

  1. Since it is a Windows 11 machine with Bitlocker, I have to first get the Bitlocker key. From command prompt run: manage-bde -protectors -get C:
  2. After I verified it is the same key that the IT has, I saved the key outside of the machine.
  3. Then go to system configuration by searching for "sysconfig" or run msconfig. Under "boot" tab, check the "Safe boot" option, then click "Apply" and then "OK". In my case, it alerts about Bitlocker after clicking "Apply", so I just agree to it since I already have the key.
  4. Restart/reboot the machine and it will run in safe mode.
  5. Rename "C:\ProgramData\Sentinel" to something else. Then go to "C:\Program Files\Sentinel One\Sentinel Agent {Version}\config". We are supposed to delete files here, but the files are owned and managed by SentinelHelperService, so I wasn't able to delete them, and the service can't start in safe mode.
  6. Since I'm local admin, on a privileged (administrator mode) command prompt, I can change ownership of the files by running: takeown /F "C:\Program Files\Sentinel One\Sentinel Agent {Version}\config\*". Replace {Version} with the version of the agent on your machine.
  7. Then we need to change the permissions of the files by running: icacls "C:\Program Files\Sentinel One\Sentinel Agent {Version}\config\*" /grant {YourUserName}:F /t
  8. Go back to "C:\Program Files\Sentinel One\Sentinel Agent {Version}\config" and delete the files. You can also run the command: rm "C:\Program Files\Sentinel One\Sentinel Agent {Version}\config\*".
  9. Once that's done, go back to system configuration, either search for sysconfig or run msconfig, under "boot" tab, uncheck the "Safe boot" option, "Apply", "OK", and restart/reboot. This should launch in normal mode.
  10. After login, I just uninstall the agent as usual, then restart/reboot once more and the issue is fixed.

Comments

Post a Comment

Popular posts from this blog

AWS EC2 Can't Reach EC2 Metadata Service After Subnet Change

Just another black box day. I had to move an EC2 instance to a different subnet, so I created an AMI out of it and launch it on a different subnet. Everything went well and it has no issue reaching the internet, but apparently not everything went well. The AWS agents such as SSM agent and CodeDeploy agent in the instance stop working. After checking the logs, they can't access the EC2 metadata. Since this is a Windows Server 2019 instance, it also shows that it is not activated, which is strange. On the following article, I found out that my issue was due to the "Gateway Address doesn't match that of the current subnet". https://aws.amazon.com/premiumsupport/knowledge-center/waiting-for-metadata/ Running the suggested command fixed the issue: Import-Module c:\ProgramData\Amazon\EC2-Windows\Launch\Module\Ec2Launch.psm1 ; Add-Routes
Read more

A2 Hosting with .NET Core 2.1

Technology advances so fast and I have a new web application which I built using .NET Core 2.1. However, my current web hosting provider does not support .NET Core and I have to look for a new web hosting. Reading some forums, found out that A2 Hosting plans to install .NET Core 2.1 in their shared hosting on August 2018. So on September 5th, 2018, I signed up for a new account with them. The coupon HOSTINGFACTS that I found from a web hosting review website still works and gave me 53% one-time discount. Everything went smoothly until I found out that in my Plesk, I was unable to go higher than .NET 4.6.2. So, I decided to chat with their customer support. It took a while to get in touch with an agent, which makes sense because they have lots of customers and it was during busy hour. From the chat with their customer support, I found out that .NET Core 2.1 has indeed been installed and what is weird is I don't have to flip the .NET version in Plesk. With that information, I d...
Read more

Xcode CodeSign Incorrectly States Password is Incorrect

I was trying to create an archive in Xcode to prepare the app for testing. It requires a code signing certificate and Xcode tried to reach out to Keychain to obtain it, so it prompted me for a password to my Keychain. My first thought is since the Keychain lives in my Mac, it has to be my Mac's password, so I entered it and it failed. I re-checked the characters, re-entered and it still failed. That is odd considering I did that before without issue. I found out that my Keychain Access app was still active. I have to quit the app and then it proceeds properly. So, the solution is quit the Keychain Access app before entering password for signing.
Read more