Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Uninstall an EDR host

Prerequisistes

Before you can uninstall an EDR agent, make sure you have:

  • Managed services permission: View and edit managed services tools must be enabled on your account. See User access management.

  • MFA enabled for at least 2 weeks: set it up from User settings > Security, in the menu in the lower-left corner of the app. See Securing your account.

Uninstall on a workstation or server

Go to MDR > Monitored Assets > Hosts. Locate the host and click the Uninstall icon on its row.

The next steps depend on the EDR provider running on the host.

CrowdStrike

With CrowdStrike, the uninstall runs on the device. Clicking Uninstall opens a modal with a one-time maintenance token you'll need to remove the agent locally.

1

Get the maintenance token

The modal displays the token automatically. Keep this modal open during the uninstall.

2

Uninstall on the device

  1. Download the CrowdStrike Falcon uninstall tool linked in the modal.

  2. Run the tool. When prompted, enter the monitored asset name and maintenance key shown in the modal.

  3. Wait for the tool to confirm removal.

  1. Open Terminal and run:

  1. When prompted, enter the monitored asset name and maintenance key shown in the modal.

  1. Open a terminal.

  2. Apply the maintenance token:

  1. Uninstall the Falcon sensor:

    Debian / Ubuntu:

    RHEL / CentOS / Fedora:

3

Confirm in Stoïk Protect

Return to the modal, tick "I have completed the uninstallation on the device using the token above" and click Confirm.

The host moves to Uninstalling, see After uninstallation.

View token / Cancel uninstallation

Once an uninstall is in progress, two additional icons appear on the host's row:

  • View token: reopens the modal in read-only mode so you can copy the maintenance token again if needed.

  • Cancel uninstallation: clears the Uninstalling status in Stoïk Protect.

"Cancel uninstallation" only clears the status in Stoïk Protect. It does not reinstall the agent on the device. If you've already run the uninstall command, the agent is already gone. Cancelling will simply bring the host back to Active in the table until CrowdStrike marks it Inactive.

SentinelOne

With SentinelOne, the uninstall is fully managed by Stoïk Protect. No command to run on the device. The flow is the same on Windows, macOS and Linux.

1

Click the Uninstall icon on the host's row.

2

Check the asset name in the modal and click Confirm.

The host moves to Uninstalling immediately, then to Inactive once SentinelOne stops reporting the agent.

SentinelOne uninstalls cannot be cancelled. The order is sent to SentinelOne the moment you click Confirm and there is no Cancel button on the row afterwards. Double-check the host name before confirming.

Uninstall on a mobile device

The mobile flow doesn't use Stoïk Protect. The EDR is removed directly on the device.

Remove the EDR app from the device's app management or Settings, like any other app.

Open Settings > General > VPN & Device Management and delete the EDR profile, then delete the EDR app.

After uninstallation

The agent is removed from the device immediately, but the host record stays visible in Stoïk Protect for a while longer. How long depends on the EDR.

The host stays in CrowdStrike for 45 days after uninstallation. During that window, its status in Stoïk Protect is Uninstalling. After 45 days, CrowdStrike purges the host and the status becomes Inactive.

The host stays in SentinelOne until the device next comes online. While it's offline, its status in Stoïk Protect is Uninstalling; when it reconnects, SentinelOne removes the host and the status becomes Inactive. If the device never reconnects (lost, stolen, decommissioned), the host stays Uninstalling indefinitely.

For questions about host statuses, see How to read the hosts table.

PreviousMDR results
NextPriority contacts

Last updated

Was this helpful?