For Windows and macOS Agents, if Anti-Tampering is enabled, you must have the Agent passphrase to uninstall the Agent with the CLI. In the Endpoint Details of the endpoint, click ACTIONS and select Show passphrase. Copy the passphrase to a side note.
Note: If you are not able to uninstall the Agent with the steps in this article, please contact Support.
Expand All
To uninstall an Agent with CLI
To uninstall a local macOS Agent with CLI
To uninstall the Linux Agent with sentinelctl CLI
Note: A reboot is not required. You can install the Agent again immediately after the uninstallation.
- Log in as root (sudo is not enough).
- Run the sentinelctl command with this syntax:
sudo /opt/sentinelone/bin/sentinelctl control uninstall –passphrase "string" [–output] [–unquarantine]
If you use the –unquarantine flag, quarantined files are restored. If you do not use this flag, quarantined files are deleted.
To Uninstall the Linux Agent with Linux OS commands
Important: Use these commands only with Support assistance, only if the sentinelctl command does not successfully uninstall the Agent.
- Log in as root (sudo is not enough).
- Get the OS version of the endpoint:
cat /etc/redhat-release 2> /dev/null ; cat /etc/lsb-release 2> /dev/null ; cat /etc/system-release 2> /dev/null ; cat /etc/os-release 2> /dev/null
- Run the commands of the OS version of the endpoint:
- Systemdon Ubuntu 15.04+ and Debian 8+:
- cd ~
- systemctl stop sentinelone.service
- systemctl disable sentinelone.service
- rm -rf /usr/lib/systemd/system/sentinelone.service
- rm -rf /lib/systemd/system/sentinelone.service
- systemctl daemon-reload
- systemctl reset-failed
- ps aux | grep 's1-\|sentinelone-watchdog' | awk '{print $2}' | xargs kill -9
- umount -l /opt/sentinelone/mount
- umount -l /opt/sentinelone/cgroups/memory
- rm -rf /opt/sentinelone
- userdel -f sentinelone
- rm -rf /var/lib/dpkg/info/sentinelagent.*
dpkg –purge –force-all sentinelagent
One line command:
cd ~ ; systemctl stop sentinelone.service ; systemctl disable sentinelone.service ; rm -rf /usr/lib/systemd/system/sentinelone.service ; rm -rf /lib/systemd/system/sentinelone.service ; systemctl daemon-reload ; systemctl reset-failed ; ps aux | grep 's1-\|sentinelone-watchdog' | awk '{print $2}' | xargs kill -9 2> /dev/null ; umount -l /opt/sentinelone/mount ; umount -l /opt/sentinelone/cgroups/memory ; rm -rf /opt/sentinelone ; userdel -f sentinelone ; rm -rf /var/lib/dpkg/info/sentinelagent.* ; dpkg –purge –force-all sentinelagent ; echo "SentinelOne Agent Successfully Uninstalled"
- Systemdon Red Hat 7+, CentOS 7+, Oracle 7+, SUSE 12 and 15, Fedora 25 – 30, Amazon Linux 2:
- cd ~
- systemctl stop sentinelone.service
- systemctl disable sentinelone.service
- rm -rf /usr/lib/systemd/system/sentinelone.service
- rm -rf /lib/systemd/system/sentinelone.service
- systemctl daemon-reload
- systemctl reset-failed
- ps aux | grep 's1-\|sentinelone-watchdog' | awk '{print $2}' | xargs kill -9
- umount -l /opt/sentinelone/mount
- umount -l /opt/sentinelone/cgroups/memory
- rm -rf /opt/sentinelone
- userdel -f sentinelone
rpm -ev –noscripts SentinelAgent
One line command:
cd ~ ; systemctl stop sentinelone.service ; systemctl disable sentinelone.service ; rm -rf /usr/lib/systemd/system/sentinelone.service ; rm -rf /lib/systemd/system/sentinelone.service ; systemctl daemon-reload ; systemctl reset-failed ; ps aux | grep 's1-\|sentinelone-watchdog' | awk '{print $2}' | xargs kill -9 2> /dev/null ; umount -l /opt/sentinelone/mount ; umount -l /opt/sentinelone/cgroups/memory ; rm -rf /opt/sentinelone ; userdel -f sentinelone ; rpm -ev –noscripts SentinelAgent 2> /dev/null ; echo "SentinelOne Agent Successfully Uninstalled"
- Non-systemdon Ubuntu 14.04:
- cd ~
- /etc/init.d/sentineld stop
- ps aux | grep 's1-\|sentinelone-watchdog' | awk '{print $2}' | xargs kill -9
- chkconfig –del sentineld
- rm -f /etc/init.d/sentineld
- umount -l /opt/sentinelone/mount
- umount -l /opt/sentinelone/cgroups/memory
- rm -rf /opt/sentinelone
- userdel -f sentinelone
- rm -rf /var/lib/dpkg/info/sentinelagent.*
dpkg –purge –force-all sentinelagent
One line command:
cd ~ ; /etc/init.d/sentineld stop 1> /dev/null ; ps aux | grep 's1-\|sentinelone-watchdog' | awk '{print $2}' | xargs kill -9 2> /dev/null ; chkconfig –del sentineld ; rm -f /etc/init.d/sentineld ; umount -l /opt/sentinelone/mount ; umount -l /opt/sentinelone/cgroups/memory ; rm -rf /opt/sentinelone ; userdel -f sentinelone ; rm -rf /var/lib/dpkg/info/sentinelagent.* ; dpkg –purge –force-all sentinelagent 2> /dev/null ; echo "SentinelOne Agent Successfully Uninstalled"
- Non-systemdon Red Hat 6.4 – 6.10, CentOS 6.4 – 6.10, Oracle 6.4 – 6.10, Amazon Linux:
- cd ~
- /etc/init.d/sentineld stop
- ps aux | grep 's1-\|sentinelone-watchdog' | awk '{print $2}' | xargs kill -9
- chkconfig –del sentineld
- rm -f /etc/init.d/sentineld
- umount -l /opt/sentinelone/mount
- umount -l /opt/sentinelone/cgroups/memory
- rm -rf /opt/sentinelone
- userdel -f sentinelone
rpm -ev –noscripts SentinelAgent
One line command:
cd ~ ; /etc/init.d/sentineld stop 1> /dev/null ; ps aux | grep 's1-\|sentinelone-watchdog' | awk '
