Removing AGPM Solution

Question

I am looking to remove AGPM from my environment after almost 6 years of service. I cannot find a document that show the proper procedure, just a Technet forum post by a MVP who said "just uninstall it". Hopefully there is a little more documentation around the process or things to make sure are in place before removing.

If anyone has any insights, I would appreciate some help.

Answer 1

Here is what I end up doing when I did my "AGPM removal"

1. Go to your AGPM console and under Controlled GPO objects you need to delete all GPO's with the option "Delete GPO from the archive only"

After this all GPO's can be found from Uncontrolled section meaning AGPM service does not touch them anymore.

1. Then I cleaned AGPM service account from each GPO object permissions.
2. Uninstalled AGPM server and client components
3. Deleted AGPM related security groups and service account.

keywords: AGPM uninstall, AGPM uninstallation, AGPM removal, AGPM deletion, delete AGPM

Answer 2

The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy objects (GPOs) in the archive and production environment. If this service is stopped or disabled, AGPM clients cannot perform operations through the server.

The archive path and AGPM Service Account are configured during the installation of AGPM Server and can be changed afterward through Add or Remove Programs on the AGPM Server.

Caution

Do not modify settings for the AGPM Service through Administrative Tools and Services in the operating system. Doing so can prevent the AGPM Service from starting.

A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure.

Important

The AGPM Service Account must have full access to the GPOs that it will manage and will be granted Log On As A Service permission. If you will be managing GPOs on a single domain, you can make the Local System account for the primary domain controller the AGPM Service Account.
If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains.
To modify the AGPM Service Account
On the computer on which Microsoft Advanced Group Policy Management - Server is installed, click Start, click Control Panel, click Add or Remove Programs.

Click Microsoft Advanced Group Policy Management - Server, and then click Change.

Click Next, and then click Modify.

Follow the instructions on screen to configure settings for the AGPM Service:

For the archive path, confirm or change the location for the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server.

Enter new credentials for the AGPM Service Account.

For the archive owner, enter the credentials of an AGPM Administrator (Full Control).

Click Change, and when the installation is complete click Finish.

Answer 3

Hi,
 
Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.
 
Best Regards,
Vicky

Answer 4

Hi,
 
Just want to confirm the current situations.
 
Please feel free to let us know if you need further assistance.
 
Best Regards,
Vicky