diff --git a/manifests/auditd.pp b/manifests/auditd.pp
index cb9ad97d59eaddf61d99cddf93874343879e60fe..b27142c033c8e43c59dfb215c4bd1cd37068b7b7 100644
--- a/manifests/auditd.pp
+++ b/manifests/auditd.pp
@@ -165,8 +165,13 @@ define audit::auditd (
 
     'absent': {
       package {
-      'auditd':          ensure => absent;
-      'audispd-plugins': ensure => absent;
+      'auditd':          ensure => purged;
+      'audispd-plugins': ensure => purged;
+      }
+      if ($::osfamily == 'RedHat' and $::lsbmajdistrelease == '5') {
+        # do nothing - package is not available in repos
+      } else {
+        package { 'stanford-auditd-tools': ensure => purged }
       }
       file {
         '/etc/audit/auditd.keytab':             ensure => absent;
@@ -174,6 +179,7 @@ define audit::auditd (
         '/etc/audit/auditd.conf':               ensure => absent;
         '/etc/audisp/audispd.conf':             ensure => absent;
         '/etc/filter-syslog/auditd-wheezy':     ensure => absent;
+        '/etc/cron.d/auditd-restart':           ensure => absent;
       }
     }