How to Stop the “Agentless Monitoring” of a Single VM on an ESX Server?

To achieve this, follow the steps given below:

  1. If the VM being ‘unmanaged’ is a Linux VM, then disable SSH on that VM.
  2. In case of a Windows VM however, first, login to the Windows VM as a user with full access to the admin$ share on that VM.

  3. Go to the command prompt, and type the following command therein to remove the admin$ share:

    net share ADMIN$ /delete

  4. Then, proceed to uninstall any eG software on the Windows VM. For this, first determine the mechanism using which the remote Windows agent obtains the inside view of the Windows VMs - whether it is using the eG VM Agent? or via NetBIOS? If an eG VM Agent has been deployed on the target Windows VM for obtaining the inside view, then uninstall the eG VM agent to make sure that such a VM is no longer monitored. To achieve this, follow the steps given below:

    • Login to the Windows VM.
    • Stop the eG VM agent using the menu sequence: Start -> Programs -> eG Monitoring Suite -> eG VM Agent -> Stop Agent.
    • Then, follow the menu sequence, Start -> Programs -> eG Monitoring Suite -> eG VM Agent -> Uninstall Agent, to begin uninstalling the VM agent.

    • Figure 1 then appears. Select the Remove option from Figure 1 and click the Next button therein to uninstall the eG VM agent.

      Figure 1 : Selecting the Remove option

    • Click the ok button in the message box of Figure 2 to resume the uninstallation.

      Figure 2 : Confirming the removal of the eG VM agent and its components

    • Upon successful uninstallation, setup automatically exits.
    • Repeat this procedure on every Windows VM on the ESX server.

  5. On the other hand, if the remote Windows agent has obtained the inside view of the Windows VM without using the eG VM Agent - i.e., by remotely connecting to every Windows VM via NetBIOS - then, follow the steps given below to ensure that the Windows VM is no longer monitored:

    • The first step is to remove the eGRemote Execution service that the remote Windows agent creates on each of the Windows VMs it monitors - this service enables the remote agent to execute certain key scripts/executables on the Windows VM for collecting the inside view metrics. To uninstall this service, an executable named ServiceInstaller.exe should be made available on the Windows VM. Typically, every eG agent deployed on a Windows host is bundled with a ServiceInstaller.exe. Therefore, login to the Windows host on which the remote agent operates, and copy the ServiceInstaller.exe from the <eg_agent_install_dir>\bin directory on the agent host to any location on the Windows VM.
    • Next, login to the Windows VM.

    • Go to the command prompt of the VM, switch to the directory that contains the ServiceInstaller.exe, and run the following command:

      ServiceInstaller.exe uninstall eGRemoteExec

      This command uninstalls the eGRemote Executionservice.

    • Then, delete the eGRExecSvc.exe in the C:\Windows directory of the VM.
    • Finally, delete the C:\Windows\eg folder on the VM.