Uninstalling the Datto Endpoint Security agent

SECURITY   Datto EDR subscription with administrator-level platform access or Datto AV subscription with administrator-level platform access

SECURITY   Service account or administrator-level rights on the target endpoint

IMPORTANT  Uninstalling the Endpoint Security Agent is not a recommended troubleshooting step, as it can complicate the support process and require additional effort to restore full functionality.

This article describes the methods for uninstalling the Endpoint Security agent from an endpoint.

Uninstalling from the EDR platform

If you need to uninstall the EDR agent, it is highly recommended that you do so from within the EDR platform for the following reasons:

  • You will already be authenticated in the platform, and therefore, won't have to provide additional security information, like an uninstall token.
  • The agent will be removed from the Devices table.
  • The licenses assigned to the agent will released and made available to be assigned to another device.

Device Status

When uninstalling a device from the EDR platform, the Status of the device affects the uninstall process.

  • Active: The uninstall process completes in approximately 10 minutes for an Active device.
  • Inactive: A device that is Inactive (offline) cannot check-in with the EDR platform. Therefore, the uninstall process will be queued on the EDR server until the device is back online (Active).
  • Stale: The uninstall process cannot be completed on a Stale device because it has been offline for more than 30 days.

To uninstall an EDR agent from the EDR platform:

  1. Navigate to the Organizations page.
  2. In the navigation pane, click Devices. The Devices page is displayed with the Devices tab selected.
  3. To filter for specific devices:
    1. Click the Filter icon.
    2. Select the filter criteria. You can select multiple criteria items. To uninstall multiple devices at once, it is recommended you filter by Organization and/or Location.
    3. Click the Apply button.
    4. If you want to change your filter selections, click the Filter icon and edit your selections. Or, you can click Clear All > Apply to remove all selections. Then, click the Filter icon and make new selections.
  4. To uninstall all devices at the same time:
    1. Select the check box in the column header row (to the left of Device).
    2. To the right of the Scan button, click the ellipses.
    3. Select Uninstall.
    4. In the confirmation modal, click OK.
    5. For each device, Pending Removal is indicated in the Status field and Unlicensed is displayed in the Licensed field.
  5. To uninstall a single device:
    1. At the end of the applicable device's row, click the ellipses.
    2. Select Uninstall.
    3. In the confirmation modal, click OK.

IMPORTANT  An offline device will be uninstalled if it is back online within six months of the start of the uninstall process. If the device checks in after the six month time frame, it will reappear on the Devices page and need to go through the uninstall process again.

In the event that you are unable to uninstall the agent from the EDR platform, you can uninstall from within the platform for which the agent is deployed, like Windows, for example.

However, doing so presents the following issues that may make device management more difficult:

  • Using the uninstaller command from within the platform for which the agent is deployed, like Windows, may require you to enter an uninstall token, which you may not have readily available.
  • The device will still be listed in Devices table even though it has been uninstalled.
  • The licenses assigned to the device will still count as being used even though the device has been uninstalled.

Uninstalling from Windows

To remove the Endpoint Security agent from a Windows system, you can launch its built-in uninstaller via the Add/Remove Programs feature. Alternatively, you can run the following PowerShell commands on the endpoint.

PS > cd "C:\Program Files\Infocyte\Agent"
PS > .\agent.exe --uninstall

Uninstalling from Linux or macOS

To remove the Endpoint Security agent from a Linux or macOS system, you can either automatically or manually perform the uninstall from a Terminal session.

Automatic method 

sudo /usr/local/infocyte/agent/agent.exe --uninstall

Manual method 

systemctl stop HUNTAgent
systemctl disable HUNTAgent
rm /etc/systemd/system/HUNTAgent.service
systemctl daemon-reload
systemctl reset-failed
rm -rf /opt/infocyte

Uninstalling from RMM

cd "C:\ProgramData\CentraStage\AEMAgent\RMM.AdvancedThreatDetection"

.\agent.exe --uninstall

IMPORTANT   If a device does not have network connectivity, it cannot be uninstalled regardless of the method used (EDR platform or locally).