Uninstall endpoints in OneView – ThreatDown, powered by Malwarebytes, Support Site

Administrators can delete endpoints from their console to free up a seat from a site subscription and remove the software from the endpoint. If the removal fails, there are workarounds to manually remove the endpoint agent from the device. This article explains how to remove endpoints from your console and how to manually uninstall the endpoint agent from the device if necessary.

Delete endpoints

In the left-side navigation pane, click Manage > Endpoints.
Check the boxes for endpoints you want to delete.
Click the ellipsis icon , then click Delete Endpoints.
In the confirmation window, click Accept.

When you delete an endpoint from the console, the following happens:

The console flags the endpoint for uninstallation.
- The console removes the endpoint from the user interface. This frees up one of your seat licenses on the site.
- A hidden task is created to delete the endpoint.
If the endpoint is online, the uninstall task is executed immediately.
If the endpoint is offline but checks in within 90 days, the uninstall task is executed upon check-in.
If the endpoint is offline and checks in after 90 days:
- The Delete task is expired since the endpoint did not check in within the 90-day period.
- The Endpoint Agent remains installed, and the endpoint re-registers and appears in the console again. You must re-initiate the Delete task in the console.

Additionally, you can automate the removal of inactive and obsolete endpoints by enabling a policy setting. For more information, refer to the article Configure Endpoint agent settings in OneView.

Manually remove endpoint agent

If the endpoint agent remains installed on an endpoint after deleting it from the console, try manually removing it.

See the options below for each operating system:

Windows
macOS
Linux

An uninstall password may be required when manually removing the endpoint agent if Uninstall Protection is enabled in the policy associated with the endpoint's group. For help with locating the uninstall password, see Configure Tamper protection options in OneView.

Windows

To manually remove the endpoint on Windows, log in to the device with administrative privileges and use one of the following methods:

Option 1 - Use the Control Panel Programs and Features or Apps & Features.
Option 2 - Launch the installer with the uninstall switch from Windows command line as an administrator:
```
MSIEXEC.exe /x "<fullpath1>\Setup.MBEndpointAgent.x64.msi" /qn
```
- If Uninstall Protection is enabled, you must use the following syntax and input the password from the policy associated with the endpoint's group:
```
MSIEXEC.exe /X {949D1792-E377-4348-8BC4-6D643EF49B21} /qn Password="$ecure Password 1234!" 
```
Option 3 - For endpoints which may be corrupted or cannot be uninstalled, use the Discovery and Deployment tool.

macOS

To manually remove the endpoint on macOS, use one of the following methods:

Option 1

Option 1 - Launch EndpointAgentDaemon with the -uninstall option.
- Use single quotes for literal string, or blanks should be escaped with \ if the command is scripted.
```
sudo '/Library/Application Support/Malwarebytes/Malwarebytes Endpoint Agent/EndpointAgentDaemon.app/Contents/MacOS/EndpointAgentDaemon' -uninstall
```
- If Uninstall Protection is enabled, include the password in the uninstall command. Use single quotes or escape characters if the Uninstall Password has special characters.
```
sudo '/Library/Application Support/Malwarebytes/Malwarebytes Endpoint Agent/EndpointAgentDaemon.app/Contents/MacOS/EndpointAgentDaemon' -uninstall 'UninstallPassword1234!'
```

Option 2 - For endpoints which may be corrupted or cannot otherwise be uninstalled, run the following commands:

sudo rm -r /Library/LaunchDaemons/com.malwarebytes.EndpointAgent.plist
sudo rm -r /Library/LaunchDaemons/com.malwarebytes.agent.daemon.plist
sudo rm -r /Library/LaunchAgents/com.malwarebytes.UserAgent.plist
sudo rm -r /Library/LaunchDaemons/com.malwarebytes.ncep.rtprotection.daemon.plist
sudo rm -r /Library/LaunchDaemons/com.malwarebytes.ncep.settings.daemon.plist
sudo rm -r '/Library/Application Support/Malwarebytes/'

Linux

To manually remove the endpoint on Linux, run the proper command for your Linux distribution:

DPKG distros:
```
sudo apt remove mblinux
```
RPM distros:
```
sudo yum remove mblinux
```

iOS, Android, and ChromeOS

To manually remove the software from a mobile device, refer to the documentation for the corresponding operating system: