Please follow the following steps to permanently remove the Change Auditor agent from a Domain Controller or member server:
- Open Service.msc
- Stop ChangeAuditor Agent service, or you may be forced to use the Task Manager to stop the NPSrvHost.exe process.
- Open Command Prompt as administrator and run: sc DELETE NPSrvHost
- Refresh the service and verify that the services have been removed
- Remove the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\<GUID>. Where <GUID> is the key that has the ProductName subkey listed as: Quest ChangeAuditor Agent (x64). Click on each key to find the one with this product name.
- Remove the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall. Where <GUID> is the key that has the Display name Value as: Quest ChangeAuditor Agent (x64). Click on each key to find the one with this product name
- Delete the folder C:\Program Files\Quest\Change Auditor.
NOTE: If you have a Change Auditor version before 6.9.5, any folder/registry paths referenced may contain a non-Quest branded path (Dell). Also, Quest does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support
