Uninstall agents from assets

Uninstall agents from assets and decommission assets when you don't want to manage them from Xshield. When assets are decommissioned, all files and folders created by the agents and Xshield policies are permanently deleted from the assets. The assets are not connected to Xshield anymore, and the Assets page displays the decommissioned assets as Suspended.

An asset can be decommissioned from the Xshield UI, the asset's UI, or the asset's CLI. Uninstallations can also be authorized and protected using an uninstallation password.

Password-protected CLI uninstallation

To protect agents from unintended and rogue uninstallations, you can set an uninstallation password on the Xshield UI. This password acts as a layer of authorization to decommission the asset. So, end users and local administrators with administrative privileges cannot uninstall the agents without presenting the password.

The uninstallation password is set at the level of an instance from which the agent was downloaded. All the assets (all of the supported OSes) managed by the instance use a common password to authorize the uninstallation.

After you set the uninstallation password, Xshield sends this password to the agents within a few seconds. When a decommission (from the UI) or a local uninstallation is initiated, the agent compares the presented password with the hash of the stored password. If successful, the agent is uninstalled.

Currently, password-protected uninstallation is only supported when you uninstall the agent from the CLI of the asset. If you try to decommission an asset from the Xshield UI or uninstall from the asset's UI (Add/Remove Programs on Windows), you will see an error message.

Set an uninstallation password

Go to Settings > Configure > Agent config.
Set the Use security password to uninstall agents knob.
Type the uninstallation password.

Comply with the password rules you see next to this text box; the rules turn Green when you comply.
Click Save.

Uninstall from the asset's CLI

Uninstall agents from the assets' CLI by using the uninstall commands listed on the Agent Download page. Uninstall commands vary by the OS, so ensure that you select the right OS to use the right command.

See the example screenshot of how you are prompted to present the uninstallation password on a Windows asset.

If you provide the correct password (set for the instance), the agent is uninstalled.
If you do not provide the correct password, you cannot uninstall the agent.

Uninstall from the asset's UI

If you are a GUI user, you can uninstall agents from the assets' native Application management tools. For example, from the Control Panel on Windows or the System Preferences on macOS.

Currently, you cannot uninstall agents from the assets' UI if the instance is using an uninstall password.

Decommission assets from Xshield

This is by far the easiest way to uninstall agents because multiple assets can be decommissioned simultaneously.

Go to Assets & Groups > Assets.
Select one or more assets.
Click Decommission selected in the fly panel.
Confirm that you want to decommission; click Decommission.
The agents are uninstalled in a few minutes.

Currently, you cannot use this workflow if the instance is using an uninstall password.