What you will do: remove Prixl Warden from a server cleanly, know what the uninstaller puts back and what it leaves in place, and tidy up the few things it leaves behind.
Time: about 15 minutes.
You need: an administrator account on the server; a way into the server that does not depend on Warden or Prixl Guard (office network, cloud console or the physical keyboard); and, if anyone connects through Prixl Guard, a moment to warn them.
What the uninstaller does
Before it starts, the uninstaller asks you to confirm. It will:
- stop the Prixl Warden service;
- remove all Prixl firewall rules (RDP, SMB, WinRM and Guard), including IP block rules;
- switch the default Windows Remote Desktop rules back on, so you keep remote access;
- shut down the Prixl Guard tunnel on the server, which disconnects anyone connected through it;
- put the Remote Desktop port back to what it was before Warden was installed (or 3389);
- delete
C:\ProgramData\Prixl\warden\(local settings, cached licence and logs), Warden’s scheduled tasks, its Windows Defender exclusions, the program folder and its services.
After that, Remote Desktop, SMB and WinRM go back to Windows defaults. Monitoring and email alerts stop.
Before you start
- Remote Desktop may become reachable from the internet again. If you used Lock RDP to Secure Access only or blocked addresses, those protections go with Warden. If your office router forwards Remote Desktop to this server, close that forward or put another protection in place first.
- If Warden changed the Remote Desktop port, the port goes back to the old one. Anyone who connects using the new port number will need the old one, and any router forward will need changing to match.
- Staff who connect through Prixl Guard will be disconnected and will not be able to reconnect. Tell them first.
- Windows settings changed by hardening fixes stay changed (password and lockout policy, SMBv1 off, audit policy, firewall profiles switched on). If you want any of them back as they were, revert them first from the Hardening tab, Previously Applied, Revert. Most offices should keep them.
Steps
- On the server, open Settings, Apps, Installed apps (on older Windows Server versions: Control Panel, Programs and Features).
- Find Prixl Warden (publisher Prixl Technologies) and choose Uninstall.
- Read the question that starts “Uninstalling Prixl Warden will:”. The default answer is No, which cancels. Click Yes to continue, and Yes at the Windows permission prompt if one appears.
- Wait while Warden is removed. Part-way through, a window titled Prixl Warden – Uninstall Report appears with two lists: “Auto-reverted” (what was put back) and “Still applied (review and revert if desired)” (what stays).
- Read the “Still applied” list and keep a note of it, then click OK. The same report is emailed to your Warden admin addresses with the subject “[Prixl Warden] Uninstalled from” followed by the server name.
- Remove the leftovers described below if you want a completely clean server.
Uninstalling from the command line
Your IT vendor can uninstall without prompts from an administrator command prompt in the folder that holds the installer file:
msiexec /x PrixlWarden.msi /qnA silent uninstall skips the confirmation and shows no report window. The report is written to the Windows Application event log instead, source PrixlWarden, event ID 4160.
What is left behind, and how to remove it
| Left behind | What to do |
|---|---|
| Windows settings changed by hardening fixes (password and lockout policy, SMBv1 off, audit policy), listed under “Still applied” | Usually keep them. To change one, ask your IT vendor to set it back in Windows (for example in Local Security Policy). |
| Windows Firewall profiles that Warden switched on | Leave them on. |
A line in the hosts file: 127.0.0.1 prixlhardening.local # Prixl Warden | Harmless. To remove it, open Notepad as administrator, open C:\Windows\System32\drivers\etc\hosts, delete that one line and save. |
The installer log C:\Windows\Temp\prixl-warden-installer.log | Delete it if you wish. |
| The Prixl Guard app on staff laptops | It is a separate install on each laptop. Remove Prixl Guard from Installed apps on each one if it is no longer needed. |
| Your server’s record in your Prixl organisation, including its trusted IPs | If you reinstall Warden on the same server under the same organisation, it picks up the same record and trusted IPs. To have the record removed, contact support through the contact form. |
Check it worked
Open PowerShell as administrator and run:
Get-Service PrixlWarden, PrixlUpdater
Get-NetFirewallRule -DisplayName 'Prixl-*'
Test-Path 'C:\ProgramData\Prixl\warden'- The first two commands should print red messages saying no matching service and no matching firewall rule were found. Here that red text is the good result.
- The last command should print
False. - Prixl Warden is no longer listed in Installed apps, and the Prixl Warden Dashboard icon has gone from the desktop.
- You can still connect to the server by Remote Desktop from the office.
If something goes wrong
- Remote Desktop no longer connects on the port you were using: the port went back to its pre-Warden value. Connect from the console and check the port, or try the old one.
- Some Prixl- firewall rules are still listed: contact support through the contact form with the output of the command above.
- You keep getting “Device Unreachable” emails for the removed server: contact support so the server can be removed from your organisation.
- For installer errors and other problems, see Troubleshooting Warden.
Next
- Previous: Trial, licence renewal and what happens at expiry
- Next: Troubleshooting Warden
- Back to all Prixl Warden guides