Linux - Software Lifecycle - Uninstall AnyDesk

What the AnyDesk Linux uninstaller does

This Automox Worklet™ removes the AnyDesk remote desktop client from Linux endpoints and erases the package source file that would otherwise reinstall it on the next yum, apt, or zypper update. The Worklet detects the distribution's package manager at runtime, runs the matching uninstall command, and then searches the package manager's configuration directory for any file whose name starts with anydesk.

Package manager detection follows a fixed order. The Worklet checks for yum first, then apt-get, then zypper. On Debian and Ubuntu it runs apt purge anydesk -y so configuration is removed alongside the binary. On RHEL, CentOS, Rocky, Alma, and Fedora it runs yum remove anydesk -y. On openSUSE and SUSE Linux Enterprise it runs zypper remove anydesk -y. A missing anydesk package is treated as compliant rather than as an error, so the policy is safe to run across a mixed fleet where only a subset of endpoints actually have AnyDesk installed.

Once the package is gone, the Worklet enumerates the package manager's source directory and removes any file whose name matches anydesk*. For apt, the search runs against /etc/apt/. For yum, it runs against /etc/yum.repos.d/. For zypper, it runs against /etc/zypp/. Deleting that file closes the loop: without the AnyDesk channel definition, an apt update or yum check-update no longer pulls AnyDesk, and a routine apt install anydesk fails because the package source is no longer registered. The remediation script then re-runs the installed-package check; the Worklet exits 0 only when AnyDesk is no longer installed.

Why remove unauthorized AnyDesk installations

AnyDesk is a legitimate remote support tool, but on a managed Linux fleet it is also a known initial-access vector. An unauthorized AnyDesk client on a server or workstation is a remote desktop session your SIEM does not see and your access-control policy does not gate. Removing it is one of the highest-leverage tasks in a remote-access hygiene sweep.

Removing the package alone is not enough. The .list or .repo file under /etc/apt/ or /etc/yum.repos.d/ will silently reinstall AnyDesk the next time a developer runs apt install anydesk or yum install anydesk from a stale build script. This Worklet uninstalls the package and deletes the repository definition in the same run, so a reinstall from the vendor channel will not succeed until an administrator explicitly re-adds the AnyDesk source.

How AnyDesk removal works on Linux

1. Evaluation phase: The Worklet detects the active package manager with command -v yum, then command -v apt-get, then command -v zypper, in that order. It queries the installed-package database with yum list installed | grep anydesk on yum systems, dpkg -l anydesk on apt systems, or zypper info anydesk on zypper systems. If AnyDesk is found, the endpoint exits 1 and remediation is scheduled. If AnyDesk is not found, the endpoint exits 0 and no changes are made. Endpoints where none of the three package managers resolve return a console message that the package manager could not be identified.

2. Remediation phase: The remediation script re-detects the package manager, then dispatches the uninstall: yum remove anydesk -y on yum, apt purge anydesk -y on apt, or zypper remove anydesk -y on zypper. After the uninstall, it runs find against /etc/yum.repos.d/, /etc/apt/, or /etc/zypp/ for any file matching anydesk* and removes the first match with rm -rf. The script re-runs the installed-package check; if AnyDesk no longer reports as installed, the Worklet exits 0. If the package check still returns installed, the Worklet exits 1 and writes an error message to the Automox activity log.

AnyDesk uninstall requirements

• Linux endpoint running Debian, Ubuntu, RHEL, CentOS, Rocky, Alma, Fedora, openSUSE, or SUSE Linux Enterprise with yum, apt-get, or zypper resolvable through command -v

• Root or sudo privileges on the target endpoint (the default Automox agent context already satisfies this)

• No active AnyDesk session you intend to keep – the uninstall terminates the AnyDesk daemon as part of package removal

• Schedule on a recurring evaluation policy so a reinstall by an end user or build script is caught on the next run

• Note that package manager detection runs in the fixed order yum, apt-get, zypper; on a host where yum and dnf both exist, yum is selected

Expected endpoint state after AnyDesk removal

After a successful run, yum list installed | grep anydesk returns nothing on RHEL family hosts, dpkg -l anydesk returns no matching package on Debian and Ubuntu, and zypper info anydesk reports the package as not installed on SUSE. The anydesk*.list or anydesk*.repo file under the active package manager's configuration directory is gone, and the remediation script exits 0.

For audit evidence, capture the post-remediation output of the corresponding installed-package query on each distribution; each should return empty. Confirm the source list is clean with grep -ri anydesk /etc/apt/ /etc/yum.repos.d/ /etc/zypp/ – a non-zero exit code with no matches confirms the repository file was fully removed. Subsequent Automox policy evaluations report the endpoint as compliant without remediation, and an attempt to apt install anydesk or yum install anydesk fails to locate the package until an administrator re-adds the AnyDesk repository, which is the intended outcome.