> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/mdr/management/uninstall.md).

# Uninstalling a host

Remove the EDR agent from a monitored host: from Stoïk Protect on a workstation or server, or directly on a mobile device.

## Prerequisites

* **Managed services permission**: `View and edit managed services tools` must be enabled on your account. See [User access management](/onboarding/account/users.md).
* **MFA enabled for at least 2 weeks**: set it up from `User settings` > `Security`, in the menu in the lower-left corner of the app. See [Securing your account](/onboarding/account/mfa.md).

## Uninstall on a workstation or server

Go to `MDR` > `Monitored Assets` > `Hosts`. Locate the host and click the **Uninstall** icon on its row.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2Fgit-blob-e68f0edc93c96262237fea34f9f3b3f74e529f73%2FCapture%20d%E2%80%99%C3%A9cran%202026-05-07%20%C3%A0%2015.39.46.png?alt=media" alt=""><figcaption></figcaption></figure>

The next steps depend on the EDR provider running on the host.

### CrowdStrike

With CrowdStrike, the uninstall runs on the device. Clicking **Uninstall** opens a modal with a one-time **maintenance token** you'll need to remove the agent locally.

{% stepper %}
{% step %}

#### Get the maintenance token

The modal displays the token automatically. Keep this modal open during the uninstall.
{% endstep %}

{% step %}

#### Uninstall on the device

{% tabs %}
{% tab title="Windows" %}

1. Download the [**CrowdStrike Falcon uninstall tool**](https://drive.google.com/file/d/1a5RD8HvwsSl26viCYw_QWhoKRn9JfRD-/view?usp=sharing) linked in the modal.
2. Run the tool. When prompted, enter the monitored asset name and maintenance key shown in the modal.
3. Wait for the tool to confirm removal.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2FtxXFyLc9VfwvO8HR9Ag0%2FScreenshot%202026-05-18%20at%2018.46.10.png?alt=media&amp;token=9658ae55-c87f-429b-b43f-7a63569b9736" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="macOS" %}

1. Open Terminal and run:

```bash
sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall -t
```

2. When prompted, enter the monitored asset name and maintenance key shown in the modal.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2FPiP5v7VYwNp1eyUcWVpy%2FScreenshot%202026-05-18%20at%2018.45.22.png?alt=media&amp;token=40cbe5d7-d329-4d10-8d33-8237587a46c4" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="Linux" %}

1. Open a terminal.
2. Apply the maintenance token:

```bash
sudo /opt/CrowdStrike/falconctl -s --maintenance-token=<maintenance_token>
```

3. Uninstall the Falcon sensor:

   Debian / Ubuntu:

   ```bash
   sudo apt-get purge falcon-sensor
   ```

   RHEL / CentOS / Fedora:

   ```bash
   sudo yum remove falcon-sensor
   ```

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2FvJzzsFTWTgYVcAEbAQP7%2FScreenshot%202026-05-18%20at%2017.55.40.png?alt=media&amp;token=4db7f351-984d-46e9-840d-b95f3d955995" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}
{% endstep %}

{% step %}

#### Confirm in Stoïk Protect

Return to the modal, tick "I have completed the uninstallation on the device using the token above" and click **Confirm**.

The host moves to `Uninstalling`. See [After uninstallation](#after-uninstallation).

<details>

<summary>View token / Cancel uninstallation</summary>

Once an uninstall is in progress, two additional icons appear on the host's row:

* **View token**: reopens the modal in read-only mode so you can copy the maintenance token again if needed.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2FlVfiiScfqZYmaiMXJHtc%2FScreenshot%202026-05-18%20at%2020.02.25.png?alt=media&amp;token=4dfde0f7-8673-4b61-91e1-dd4b9736706c" alt=""><figcaption></figcaption></figure>

* **Cancel uninstallation**: clears the `Uninstalling` status in Stoïk Protect.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2FVa3ttr1lpX3UcLYxOHtJ%2FScreenshot%202026-05-18%20at%2020.02.32.png?alt=media&amp;token=6a3ce76c-b131-470f-b88f-72def022bf4f" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
Cancelling does not reinstall the agent on the device. If you've already run the uninstall command, the agent is already gone: cancelling simply brings the host back to `Active` in the table until CrowdStrike marks it `Inactive`.
{% endhint %}

</details>
{% endstep %}
{% endstepper %}

### SentinelOne

With SentinelOne, the uninstall is fully managed by Stoïk Protect. No command to run on the device. The flow is the same on Windows, macOS and Linux.

1. Click the **Uninstall** icon on the host's row.
2. Check the asset name in the modal and click **Confirm**. The host moves to `Uninstalling` immediately, then to `Inactive` once SentinelOne stops reporting the agent.

{% hint style="warning" %}
SentinelOne uninstalls cannot be cancelled. The order is sent to SentinelOne the moment you click **Confirm** and there is no Cancel button on the row afterwards. Double-check the host name before confirming.
{% endhint %}

## Uninstall on a mobile device

The mobile flow doesn't use Stoïk Protect. The EDR is removed directly on the device.

{% tabs %}
{% tab title="Android" %}
Remove the EDR app from the device's app management or Settings, like any other app.
{% endtab %}

{% tab title="iOS" %}
Open `Settings` > `General` > `VPN & Device Management` and delete the EDR profile, then delete the EDR app.
{% endtab %}
{% endtabs %}

## After uninstallation

The agent is removed from the device immediately, but the host record stays visible in Stoïk Protect for a while longer. How long depends on the EDR.

{% tabs %}
{% tab title="CrowdStrike" %}
The host stays in CrowdStrike for 45 days after uninstallation. During that window, its status in Stoïk Protect is `Uninstalling`. After 45 days, CrowdStrike purges the host and the status becomes `Inactive`.
{% endtab %}

{% tab title="SentinelOne" %}
The host stays in SentinelOne until the device next comes online. While it's offline, its status in Stoïk Protect is `Uninstalling`; when it reconnects, SentinelOne removes the host and the status becomes `Inactive`. If the device never reconnects (lost, stolen, decommissioned), the host stays `Uninstalling` indefinitely.
{% endtab %}
{% endtabs %}

For host statuses, see [Statuses](/mdr/management/hosts.md#statuses).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/mdr/management/uninstall.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.