Uninstall the Windows Forwarder

Four ways to remove the Windows forwarder. Pick by what you have: the console, the original installer, neither, or a lot of machines.

Version 1.4.x is different and needs the procedure at the end of this page. Everything else here applies to all other versions.

Before you start, know what removal does not do. The machine's asset record and every file it reported stay searchable, and keep matching YARA rules written later. Uninstalling ends collection going forward and erases nothing already collected. To pause a machine that is coming back, use Sleep and Wake Forwarders instead.

From Apps & Features

The simplest route, and the right one for a handful of machines.

1. Open Apps & Features, or Programs and Features in Control Panel.
2. Find Stairwell Forwarder.
3. Select it and choose Uninstall.
4. Follow the prompts.

From the command line

For scripted or silent removal.

You need the same installer executable that installed it, matching in both version and installer type. A different build will not uninstall the one that is there, and the failure is not always obvious.

1. Copy the matching installer to the machine.
2. Open an elevated Command Prompt.
3. Change to the directory holding the installer.
4. Run it with the uninstall flags:

StairwellForwarderBundle-1.6.4.0.exe /uninstall /Log StairwellUninstall.log /q /norestart

Substitute your actual version in the filename. Afterwards, confirm the forwarder is gone from Apps & Features and that the Stairwell service is absent from services.msc.

By ProductCode, when the installer is gone

The common case months later, when nobody has the build that was deployed.

1. Open Registry Editor as administrator.
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.
3. Find the subkey whose DisplayName contains "Stairwell". The GUID-shaped key name is the ProductCode.
4. In an elevated Command Prompt:

msiexec /x {YOUR-PRODUCT-CODE-GUID} /qn /norestart

In bulk, with PowerShell

For one machine or many. The script finds Stairwell ProductCodes in the registry, including the 32-bit WOW6432Node path, and runs msiexec /x against each. That second path is why this is worth using rather than writing your own: a forwarder installed as a 32-bit package is invisible to a script that only checks the 64-bit location.

param(
  [string[]]$Computers,
  [pscredential]$Credential = $null
)

if (-not $Computers) { $Computers = @('localhost') }

$sb = {
  $paths = @(
    'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
  )

  $productCodes = foreach ($p in $paths) {
    if (Test-Path (Split-Path $p)) {
      Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
        Where-Object { $_.ProductCode -and
          ($_.DisplayName -like '*Stairwell*Forwarder*' -or
           $_.Publisher -like '*Stairwell*') } |
        Select-Object -ExpandProperty ProductCode
    }
  } | Where-Object { $_ } | Select-Object -Unique

  foreach ($code in $productCodes) {
    Start-Process -FilePath 'msiexec.exe' `
      -ArgumentList "/x $code /qn /norestart" -Wait -WindowStyle Hidden
  }
}

if ($Credential) {
  Invoke-Command -ComputerName $Computers -ScriptBlock $sb `
    -Credential $Credential -ErrorAction Continue
} else {
  Invoke-Command -ComputerName $Computers -ScriptBlock $sb `
    -ErrorAction Continue
}

Running it:

# Local machine
.\Uninstall-StairwellForwarder.ps1

# Remote machines
.\Uninstall-StairwellForwarder.ps1 -Computers "server1","server2"

# Remote, with credentials
.\Uninstall-StairwellForwarder.ps1 -Computers "server1" -Credential (Get-Credential)

Version 1.4.x

This version needs maintenance mode, a repair, and then the uninstall. The repair step is not optional and not intuitive: it puts the installer back into a state where it will accept the uninstall.

1. In cmd.exe, enter maintenance mode:

   cmd

   "C:\Program Files\Stairwell\SwellService\SwellService.exe" -mainttoken=$token

2. In Programs and Features, find StairwellForwarderBundle.exe and choose Repair.

3. Enter maintenance mode again, with the same command as step 1.

4. Run the uninstall:

   cmd

   StairwellForwarderBundle-1.4.0.886.exe /uninstall /Log StairwellUninstall.log /q /norestart

5. Reboot. The driver and service keep running until you do.

6. After the reboot, confirm the service is gone from services.msc and that SWAGENT does not appear in fltmc.exe output.

That last check is the one worth doing. A filter driver still loaded after an apparently successful uninstall is the failure mode this procedure exists to avoid.

The $token in step 1 is a maintenance token from the console. See Asset Identifiers.

What should I read next?

• Asset Identifiers, for the maintenance token version 1.4.x needs.
• Sleep and Wake Forwarders, if the machine is coming back.
• Archive Inactive Assets, for tidying the fleet list afterwards.