Forum Discussion

Hajer_Fathallah's avatar
Hajer_Fathallah
Copper Contributor
Jun 03, 2024

Disable Microsoft Monitoring Agent (MMA) automatic installation

Hello,

 

We have ARC enabled on-premise server and we want to uninstall MMA agent but each time we uninstall it from our server it installs again and Azure Log Analytics workspace is configured again.

Any one has an idea where can we find the automatic rule for the installation please ?

 

Thanks.

Regards,

  • DylanInfosec's avatar
    DylanInfosec
    Iron Contributor
    Jun 04, 2024

    Hi Hajer_Fathallah,

    First place to look is to open Azure Arc and navigate to the Machine in question. On the Machine page check under Settings > Extensions. You might see a Log Analytics Extension for Windows. Next, go back under the main Azure Arc Dashboard > Settings > Policies. Check if there are any policies referencing Log Analytics or OMS there.

     

    If you haven’t found anything yet and you’re leveraging Defender for Cloud it might be that someone turned on the data collection tool there which iirc installs the MMA agent automatically as you're experiencing. Trying to remember my conversation with a very knowledgeable MS engineer but all I can remember is him telling me not to turn data collection on here. See here on how to remove it: remove OMS agents installed by MDC

    Best,

    Dylan

Resources