MS Teams Vulnerability detection

Question

While scanning the server, we detected a vulnerability on the Windows server related to an outdated version of Microsoft Teams. Although we have already uninstalled Teams from the system, the vulnerability is still being detected. How can we completely remove Teams from the server?

The path shown is: HKEY_USERS/S-1-5-21-4109376241-3782159086-2763052967-1002/SOFTWARE/Microsoft/Windows/CurrentVersion, but this path is not found on the server.

Answer 1

@Sha

To completely remove Microsoft Teams remnants from your Windows server, you can follow these steps:

1. Uninstall Microsoft Teams: Ensure that Microsoft Teams is properly uninstalled. You mentioned you have already done this, but it's good to perform a clean uninstall to make sure no remnants are left behind.
   • Go to Control Panel > Programs > Programs and Features.
   • Find Microsoft Teams in the list, right-click it, and choose Uninstall.
2. Remove Teams Directory: After uninstalling, check and manually remove the Teams directories.
   • Navigate to %LocalAppData%\Microsoft and delete the Teams folder.
   • Also, check %AppData%\Microsoft and delete the Teams folder if it exists.
3. Clean Up Registry Keys: If the path mentioned in the scan result (HKEY_USERS/S-1-5-21-4109376241-3782159086-2763052967-1002/SOFTWARE/Microsoft/Windows/CurrentVersion) does not exist, you'll need to manually search for and delete any related registry entries.
   • Open Regedit (Registry Editor) by typing regedit in the Start menu search bar and pressing Enter.
   • Navigate to HKEY_CURRENT_USER\Software\Microsoft and look for a Teams folder. If found, delete it.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---