Jun 03 2024 03:18 AM
Hello,
We have ARC enabled on-premise server and we want to uninstall MMA agent but each time we uninstall it from our server it installs again and Azure Log Analytics workspace is configured again.
Any one has an idea where can we find the automatic rule for the installation please ?
Thanks.
Regards,
Jun 03 2024 05:27 PM
Hi @Hajer_Fathallah,
First place to look is to open Azure Arc and navigate to the Machine in question. On the Machine page check under Settings > Extensions. You might see a Log Analytics Extension for Windows. Next, go back under the main Azure Arc Dashboard > Settings > Policies. Check if there are any policies referencing Log Analytics or OMS there.
If you haven’t found anything yet and you’re leveraging Defender for Cloud it might be that someone turned on the data collection tool there which iirc installs the MMA agent automatically as you're experiencing. Trying to remember my conversation with a very knowledgeable MS engineer but all I can remember is him telling me not to turn data collection on here. See here on how to remove it: remove OMS agents installed by MDC
Best,
Dylan