This article explains how to identify and uninstall an application that was not installed by Factorial IT or FleetDM, using OSQuery and scripts in FleetDM.

Identify the application across the fleet

1. Go to your FleetDM instance
2. Create a new OSQuery query to detect the application on your devices
   • For Windows:

     SELECT * FROM programs WHERE name LIKE '%ApplicationName%'

     For macOS:

     SELECT * FROM apps WHERE name LIKE '%ApplicationName%';

3. Run the query across your fleet to identify affected devices

Uninstall the application on Windows

1. In the OSQuery results, locate the uninstall_string column
2. Copy the command provided in this column
3. Create a PowerShell script containing this command, for example

    Start-Process -FilePath "msiexec.exe" -ArgumentList "/x {ProductCode} /quiet" -Wait

   (Replace the command with the one shown in the uninstall_string column.)
4. Import the script into FleetDM
5. Run the script on the identified devices to uninstall the application

Uninstall the application on macOS

1. Create an uninstall script that removes the app using the rm command
   Exemple:
   

   sudo rm -rf /Applications/ApplicationName.app

2. Import the script into FleetDM
3. Run the script on the affected devices

Verify removal

Run the OSQuery again to confirm that the application has been successfully removed.