This page is for PortWall on Windows Server. The PortWall appliance runs on its own virtual machine or server, so you remove it by deleting that machine; it has nothing installed on your web servers.
The uninstaller puts your server back the way PortWall found it, then removes PortWall. You start it with the same small program you install with, portwall-install.exe, from portwall.net/download: run with --uninstall, it reads the licence key from the installation, downloads the current PortWall installer, checks it and runs its uninstaller. This works even if your licence has expired or been cancelled.
Before you start
- Work from the server itself. Use its desktop or an RDP session, and avoid a remote session that comes in through a management port PortWall relays (for example WinRM). The uninstaller removes those relays at the very end, so that it does everything else first, but a session that ends part-way is best avoided.
- Expect a short outage. While sites move back to IIS, they can stop answering for a few seconds. Choose a quiet time.
- Know the install folder. The default is
C:\portwall. - Decide about your data. Removing PortWall can also delete its database (sites, settings, blocks, audit history), logs and quarantined files. Back them up first if you might want them again.
Running it
The commands on this page assume you saved portwall-install.exe to the Administrator's Downloads folder, C:\Users\Administrator\Downloads. If it is somewhere else, use that folder in the path.
Open an elevated (Administrator) PowerShell and run:
C:\Users\Administrator\Downloads\portwall-install.exe --uninstall
It shows its progress while it downloads the installer (about 180 MB), then the uninstaller's window opens. If PortWall is not in C:\portwall, give its folder:
C:\Users\Administrator\Downloads\portwall-install.exe --uninstall --install-root D:\portwall
If the licence key cannot be read from the installation (for example, its settings were deleted), add it yourself with --key <licence key>.
A window opens and lists what the uninstaller found: the PortWall services, firewall rules, geo-blocking and threat-feed filters, the Defender exclusions, the install folder and its size, and whether your licence is still bound to this server. Anything that would make removal fail is marked, and the uninstaller deals with each one itself.
- Leave Also delete the database, logs and quarantined files ticked to remove everything, or clear it to keep the install folder.
- Press Uninstall and confirm. A live log shows each step.
- When it finishes, press Finish.
If you still have the full installer, portwall-setup-<version>.exe, from an earlier download, portwall-setup-<version>.exe --uninstall works too, as long as its version is not older than the PortWall you have installed.
Without the window
For scripts, add --quiet:
Start-Process C:\Users\Administrator\Downloads\portwall-install.exe -ArgumentList '--uninstall --quiet' -Wait
This asks nothing and always deletes the data as well as the installation. It prints what it found and each step, and exits with 0 when nothing was left behind or 2 when something needs a restart or could not be removed.
What it does, in order
- Puts the server back. It reads PortWall's record of the changes it made to your server and undoes them while the services and the internal origin address still exist, so that nothing is left pointing at an address that has just gone. Each IIS site gets back the bindings it had before PortWall (the binding PortWall added for its internal origin stays on the site; it is harmless once the address is gone). The extra HTTPS bindings PortWall added for connecting to your sites over HTTPS, their http.sys certificate registrations and PortWall's internal certificate are removed. The http.sys IP listen list is restored to what it was, or to Windows' default of listening on every address if it was empty.
- Removes the service watchdog, the scheduled task that restarts PortWall services, so it cannot restart anything while it is being removed.
- Stops and removes the services:
portwall-dataplane,portwall-api,portwall-worker,portwall-clamdandportwall-broker. It waits up to 45 seconds for each to stop. Any PortWall program still running from the install folder afterwards is ended. - Removes the firewall rules PortWall created: those whose names start with
WAF-Block,PortWall-Egress,PortWall-Geo,PortWall-Reputation,PortWall-HerdorPortWall-HTTP3. It deletes them by exact name and never touches any other rule. - Removes PortWall's real-client-address module from IIS (the module that lets your sites see each visitor's real address). Removing it recycles your IIS application pools once. If a copy of the module is still in use, it is removed at the next restart.
- On a Plesk server, gives Plesk back its address pool settings. The installer hides PortWall's internal address from Plesk's IP pool; the uninstaller removes that entry and leaves any addresses you hid yourself.
- Removes the blocking filters that geo blocking and the threat-feed and herd blocklists install in the Windows Filtering Platform. They survive a restart and do not show in the Windows Firewall console, so they would otherwise keep blocking.
- Deletes the data, if you chose to. It removes the Windows Defender exclusions the installer added, removes the worker from the Event Log Readers group, and deletes the install folder. A file that is still locked is scheduled for deletion at the next restart.
- Removes the relays and the adapter, last. It deletes the TCP relays PortWall created for the control panel and remote management ports (and their firewall rules), then the PortWall Origin loopback adapter, the one PortWall recorded creating. These go last because removing them can end a remote session. On a Plesk server, Plesk is then asked to reread the server's addresses.
If you clear the data option, every step except step 8 still happens. The install folder stays, and so do the Defender exclusions.
After it finishes
- Restart the server if the uninstaller says so. When anything could not be removed straight away it says "Restart this server to finish removing the locked items". It does not ask you to restart and does not restart the server for you.
- Restart the server if PortWall was fronting your sites. Restoring the http.sys listen list only takes effect when http.sys restarts, and Windows does not always do that reliably without a reboot. If a site is dark after the uninstall, reboot the server. A reboot also completes the deletion of any locked files.
- Check your sites. Browse each one. If one does not answer, check its IIS bindings and the output of
netsh http show iplisten.
What it does not do
- It does not release your licence. The licence stays bound to this server on PortWall's licence service, and the uninstaller tells you which key it was. If you reinstall PortWall on this same server, there is nothing to do. If you are retiring the server, ask PortWall to release the binding (how to reach us), or enter the key on the new server (see Licensing).
- If PortWall was installed before it kept a record of its changes, the uninstaller says "No recorded host changes to undo" and leaves your IIS bindings alone rather than guessing. It still restores the http.sys listen list when it finds it restricted to PortWall's internal addresses. Check your bindings afterwards.
If something is left behind
A service that could not be removed is marked for deletion and goes at the next restart. After a restart, run C:\Users\Administrator\Downloads\portwall-install.exe --uninstall again: every step skips what is already gone, so running it twice is safe.
Reinstalling
To put PortWall back, run portwall-install.exe again. See Getting started.