Overview 💥
In some scenarios, a Liongard Agent may fail to automatically upgrade or uninstall. This can occur due to permission issues, disabled schedulers, endpoint security controls, or legacy installation methods.
This article explains:
🔍 Why agent upgrades or uninstalls fail
⚙️ How Liongard agent auto-updates work
🧪 Step-by-step troubleshooting
🗑 Proper uninstall methods by platform
📂 Where to collect logs for support
Why Agent Upgrade or Uninstall Issues Happen 🤔
The most common causes include:
Cause | Description |
❌ Incorrect service account | Agent installed using a user or domain account |
⛔ Scheduler blocked | Auto-update task removed or blocked |
🛡 EDR / AV interference | Security tools prevent updates or MSI execution |
📦 Missing MSI | Original installer unavailable during uninstall |
🔄 Legacy install method | Older PowerShell-based installs |
How Liongard Agent Auto-Updates Work
When installing the Liongard Agent with auto-update enabled:
🕛 A scheduled task is created on Windows
⏱ Runs daily at midnight
🔎 Checks for a newer agent version
⬇ Automatically downloads and installs updates
🧠 Requires local SYSTEM permissions
✅ No user interaction is required
❌ If permissions are insufficient, the update silently fails
Important: Supported Service Account (Windows) 🖥️
🚨 Liongard Agents must run as LOCAL SYSTEM
Running the agent under a custom service account or domain user is no longer supported.
Why SYSTEM Is Required
✔ Always present (no password rotation)
✔ Not impacted by user logouts
✔ Least-privilege, local-only permissions
✔ Required for scheduled updates
✔ Prevents domain policy conflicts
🧯 Newer MSI installers no longer allow custom service accounts. All new installations default to SYSTEM by design
Step-by-Step Troubleshooting 🧑🏫
1️⃣ Verify Agent Version
Go to Admin → Agents
Locate the affected agent
Confirm agent is Up To Date
2️⃣ Check Agent Status
Online but outdated → Auto-update likely blocked
Offline → Inspections will fail and upgrades will not occur
ℹ️ Self-Managed agents appear in inspector dropdowns even if offline, but inspections will show Agent Issues
3️⃣ Verify Auto-Update Scheduler (Windows)
Open Task Scheduler
Navigate to: Task Scheduler Library
Look for: Liongard Agent Updater
Status | Action |
Task exists | Review last run result |
Task missing | Reinstall agent |
Task blocked | Check EDR / AV logs |
🔍 Removal events are often logged in Windows Event Viewer
4️⃣ Check for Security Software Interference
Auto-updates commonly fail when:
EDR deletes the scheduler
Antivirus blocks MSI execution
Firewalls block outbound update traffic
📌 Review endpoint security logs for:
Task deletion
MSI execution blocks
Process termination
Uninstalling the Liongard Agent 🚀
⚠️ Uninstalling the agent does NOT remove it from the Liongard UI
✅ Option 1: Uninstall via MSI (Recommended)
🧠 Best method if you still have the original MSI. Run the same MSI version used for installation:
Select Uninstall when prompted
✅ Option 2: Windows Add / Remove Programs
Open Control Panel
Select Programs → Uninstall a program
Right-click Liongard Agent
Select Uninstall
Reboot is NOT required. Click Continue if prompted.
✅ Option 3: Command Line (Silent)
msiexec /x LiongardAgent-lts.msi /qn
🔄 Legacy PowerShell-Installed Agents
If installed using older PowerShell scripts:
Run the latest MSI to upgrade
Run the MSI again
Select Uninstall
This migrates the agent under MSI control before removal.
Remove Agent from Liongard Platform 🫧
After uninstalling locally:
Go to Admin → Agents
Click the ⋯ menu next to the agent
Select Delete
🧼 This cleans up orphaned agents from the platform.
Collecting Agent Logs for Troubleshooting 👨💻
Type | Location |
Main logs |
|
Service log |
|
Event logs | Check Windows Event Viewer under 'Application and Service Logs' for 'LiongardAgentLogs' |
When to Contact Support 🦁
Contact Liongard Support if:
Agent fails to upgrade after reinstall
Scheduler keeps disappearing
Logs show unexplained permission errors
📎 Include:
Exact issue description
Agent version
OS
Relevant logs
Screenshot of agent status
Summary 🤩
Liongard agents auto-update using a scheduled updater
Agents must run as LOCAL SYSTEM
EDR / AV tools are the most common blockers
Missing schedulers require reinstallation
Uninstall methods vary by OS
Logs are critical for deeper troubleshooting