Disabling the Actifile Agent on a Server

A PowerShell Script to Disable Actifile on a server: #

The following PowerShell script (run as administrator) disables Actifile on the server and then removes the filter driver:

Stop-Service "Actifile Updater"
Stop-Service "Actifile Agent"
Set-Service -Name "Actifile Updater" -StartupType Manual
Set-Service -Name "Actifile Agent" -StartupType Manual
fltmc unload EaseFilter
remove-item -Path $Env:WinDir\System32\drivers\EaseFlt.sys -Force
fltmc filters

Note: If the Actifile Agent doesn’t stop (it may take a minute for it to finish the task it was working on) killing the AFAgentService process almost always does. If you want to run this step-by-step see walkthrough below.

Stop-Service "Actifile Updater"
Stop-Process -Name AFAgentService -Force 

At this point Actifile can be uninstalled or left in place for the next scan. To enable Actifile for the next scan start the Actifile Updater service.

Disabling Actifile on a server (step-by-step walkthrough): #

Step1: Stop the two Actifile Services in the following order:

Actifile Updater
Actifile Agent

This can be done manually (using Services.msc or Task Manager) or using PowerShell as follows:

Stop-Service "Actifile Updater"
Stop-Service "Actifile Agent"

Step 2: Use the services.msc tool or PowerShell to set the services to manual start (so they won’t restart). Using PowerShell:

Set-Service -Name "Actifile Agent" -StartupType Manual
Set-Service -Name "Actifile Updater" -StartupType Manual

Note: It is important that the services are set to manual or disabled (or they will reinstall the filter driver upon reboot).

Step 3: Then make sure the filter driver is removed by the following two Powershell commands:

fltmc unload EaseFilter
remove-item -Path $Env:WinDir\System32\drivers\EaseFlt.sys -Force

Step 4 (Optional): Check that the driver was removed by running:

fltmc filters

Verify that a line that starts with Easefilter (see example below) no longer exists.

If the machine is unresponsive? #

If the machine is unresponsive and cannot run the scripts – start it in Safe mode. Safe mode starts with the two services and minifilter disabled allowing you to run the scripts.

Use the command window to navigate to c:\windows\system32\drivers and delete easeflt.sys.

At that point reboot should succeed.