ALERT  Reinstalling the agent permanently destroys local log files. Datto Support needs these logs to investigate the underlying issue. Always collect logs before reinstalling. If you reinstall first, the root cause may become impossible to determine.

To collect agent logs using the EDR portal (preferred), complete the following steps:

1. Log into the Datto EDR portal.
2. Navigate to the Devices page and find the applicable device.
3. Click Fetch Logs in the endpoint's ellipses menu. The agent uploads its log bundle directly to the Reports page.
4. Wait for the job to complete before proceeding to reinstall.

The log bundle is now available to Datto Support in your ticket. If the agent is offline or too unhealthy to complete the Fetch Logs job, use the manual method below instead.

To collect logs manually, complete the following steps:

1. On the endpoint, open the log directory for your platform:
   • Windows: %ProgramFiles%\infocyte\agent\logs\
   • macOS: /usr/local/infocyte/agent/logs
   • Linux: /opt/infocyte/agent/logs
     
     NOTE Log paths can vary by version and deployment. If the folder is not present at the path shown, locate the agent's installation directory and copy its logs subfolder.
2. Copy the entire logs folder and compress it into a ZIP archive.
3. Attach the ZIP archive to your Datto Support ticket before proceeding.

The log archive is attached to your support ticket and preserved for Datto Support to review.

BEFORE YOU BEGIN  Complete the Gather logs before reinstalling procedure above. Confirm you have administrator or root access to the endpoint. On Windows, confirm that PowerShell is defined in the system PATH.

To reinstall the EDR agent on one or a few endpoints using a single command, complete the following steps:

1. Log in to the Datto EDR portal and navigate to Admin > Agents.
2. Click Download Agent to open the modal.
3. Select the platform that matches your endpoint (Windows, macOS, or Linux).
4. Click Copy Command Line. The portal copies a command that generates a registration key and installs the agent in a single step.
5. On the endpoint, open PowerShell as administrator (Windows) or Terminal (macOS and Linux).
6. Paste the copied command and press Enter to run it.

The agent installs and begins checking into the EDR portal. Proceed to the Verify the reinstall procedure below to confirm the installation is complete.

BEFORE YOU BEGIN  Complete the Gather logs before reinstalling procedure above. Confirm you have administrator or root access to the endpoint. Obtain a registration key from Admin > Agents > Registration Keys in the EDR portal.

To manually download and install the agent on a single endpoint, follow the steps for your platform.

Windows

To reinstall on Windows, complete the following steps:

1. Log in to the EDR portal, navigate to Admin > Agents, and click Download Agent.
2. Select Windows and download the installer.
3. On the endpoint, right-click the installer and select Run as administrator.
4. When prompted, type your instance URL (for example, https://mycompanyname.infocyte.com), your registration key, and any optional proxy credentials or agent friendly name.
5. Alternatively, open an elevated PowerShell session in your Downloads folder and run:
   agent.exe --key <Registration Key> --url https://mycompanyname.infocyte.com

The agent installs to C:\Program Files\infocyte\agent and starts as the HUNTAgent service.

macOS

To reinstall on macOS, complete the following steps:

1. Log into the EDR portal, navigate to Admin > Agents, and click Download Agent.
2. Select macOS and download the agent binary.
3. Open Terminal and run: cd ~/Downloads
4. Rename the binary and make it executable:
   sudo mv ./agent.macos-amd64.<sha256>.bin ./agent.macos.bin
   Then run:
   chmod +x ./agent.macos.bin
5. Install the agent:
   sudo ./agent.macos.bin --url <instance URL> --key <registration key>

The agent installs to /usr/local/infocyte/agent and starts as the com.datto.HUNTAgent service.

Linux

To reinstall on Linux, complete the following steps:

1. Log in to the EDR portal, navigate to Admin > Agents, and click Download Agent.
2. Select Linux and download the agent binary.
3. Open Terminal and run: cd ~/Downloads
4. Rename the binary and make it executable:
   sudo mv ./agent.linux-amd64.<sha256>.bin ./agent.linux-amd64.bin
   
   The run:
   chmod +x ./agent.linux-amd64.bin
5. Install the agent:
   sudo ./agent.linux-amd64.bin --key <Registration Key> --url https://mycompany.infocyte.com

The agent installs to /opt/infocyte/agent and starts as the HUNTAgent.service systemd service.

BEFORE YOU BEGIN  Complete the Gather logs before reinstalling procedure above. Note that Datto RMM does not uninstall the EDR agent. You must uninstall the agent from the EDR portal or locally on each endpoint before redeploying.

To reinstall the EDR agent across multiple endpoints using Datto RMM (remote monitoring and management), complete the following steps:

1. In the EDR portal, uninstall the agent from the target endpoints using the EDR console response actions, or run the agent's local uninstaller on each endpoint.
2. Wait for the endpoints to report the uninstall as complete in the EDR portal.
3. In Datto RMM, open the Endpoint Security policy that targets the affected devices.
4. Click Save and Deploy Now. Datto RMM reinstalls the agent on the targeted devices.
5. Verify a sample of endpoints as described in the Verify the reinstall procedure below before considering the remediation complete.

Datto RMM redeploys the EDR agent to all targeted devices. The agent checks in and restores Datto AV and Ransomware Detection based on the assigned policy.

To confirm the agent and its modules are installed and healthy after reinstalling, complete the following steps:

1. In the EDR portal, navigate to the endpoint's asset or host page and confirm the endpoint shows a recent heartbeat, Last Seen time stamp within the last few minutes.
2. Confirm the Datto EDR agent status shows as online and healthy.
3. On Windows endpoints, confirm Datto AV shows as installed and protection is enabled.
4. On Windows endpoints, confirm Ransomware Detection shows as enabled.
5. If a module does not appear after 30 minutes, confirm the endpoint's assigned policy has the module enabled, then contact Datto Support and attach the logs you gathered before reinstalling.

NOTE  Allow up to 15 - 30 minutes after the first agent check-in for Datto AV and Ransomware Detection to download, install, and report status in the portal.

Detections already reported to the portal are retained. Local agent state, including local logs, is removed.

If files are currently quarantined on the endpoint, contact Datto Support before reinstalling to avoid losing access to those files.

No. The EDR agent manages both modules automatically.

After the reinstalled agent checks in against a policy that has Datto AV and Ransomware Detection enabled, the agent re-downloads and re-enables both modules. You do not install them separately.

Open or update a ticket with Datto Support and include the log bundle, endpoint details, and a description of the problem.

Include the following information in your support ticket:

• The log bundle collected before reinstalling (see the Gather logs before reinstalling procedure above)
• The endpoint hostname and organization name
• A description of the original problem and the steps you have already taken