Skip to main content

Uninstall endpoints in OneView

Administrators can delete endpoints from their console to free up a seat from a site subscription and remove the software from the endpoint. If the removal fails, there are workarounds to manually remove the endpoint agent from the device. This article explains how to remove endpoints from your console and how to manually uninstall the endpoint agent from the device if necessary.

Delete endpoints in OneView

To delete endpoints from the console:

  1. In the left-side navigation pane, click Manage > Endpoints.
  2. Check the boxes for endpoints you want to delete.
  3. Click the ellipsis icon 2022-01-04_17-40-44.png, then click Delete Endpoints.
  4. In the confirmation window, click Accept.

When you delete an endpoint from the console, the following happens:

  • The console flags the endpoint for uninstall.
    • The console removes the endpoint from the user interface. This frees up one of your seat licenses in the site.
    • A hidden task is created to delete the endpoint.
  • If the endpoint is online, the uninstall task is executed immediately.
  • If the endpoint is offline but checks in within 90 days, the uninstall task is executed upon check in.
  • If the endpoint is offline and checks in after 90 days:
    • The Delete task is expired since the endpoint did not check in within the 90 day period.
    • Malwarebytes remains installed on the endpoint and the endpoint re-registers and appears in the console again. You must re-initiate the Delete task in the console.

Additionally, you can automate the removal of inactive and obsolete endpoints by enabling a policy setting. For more information, refer to the article Configure Endpoint agent settings in OneView.

Manually remove endpoint agent

If the endpoint agent remains installed on an endpoint after deleting it from the console, try manually removing it. 

See the options below for each operating system:

An uninstall password may be required when manually removing the endpoint agent if Uninstall Protection is enabled in the policy associated with the endpoint's group. For help with locating the uninstall password, see Configure Tamper protection options in OneView.

Windows

To manually remove the endpoint on Windows, log in to the device with administrative privileges and use one of the following methods:

  • Option 1 - Use the Control Panel Programs and Features or Apps & Features.
  • Option 2 - Launch the installer with the uninstall switch from Windows command line as an administrator: 
    MSIEXEC.exe /x "<fullpath1>\Setup.MBEndpointAgent.x64.msi" /qn
    • If Uninstall Protection is enabled, you must use the following syntax and input the password from the policy associated with the endpoint's group: 
      MSIEXEC.exe /X {949D1792-E377-4348-8BC4-6D643EF49B21} /qn Password="$ecure Password 1234!"
  • Option 3 - For endpoints which may be corrupted or cannot be uninstalled, use the Discovery and Deployment tool.

macOS

To manually remove the endpoint on macOS, use one of the following methods: 

Option 1

  • Option 1 - Launch EndpointAgentDaemon with the -uninstall option.
    • Use single quotes for literal string, or blanks should be escaped with \ if the command is scripted. 
      sudo '/Library/Application Support/Malwarebytes/Malwarebytes Endpoint Agent/EndpointAgentDaemon.app/Contents/MacOS/EndpointAgentDaemon' -uninstall
    • If Uninstall Protection is enabled, include the password in the uninstall command. Use single quotes or escape characters if the Uninstall Password has special characters. 
      sudo '/Library/Application Support/Malwarebytes/Malwarebytes Endpoint Agent/EndpointAgentDaemon.app/Contents/MacOS/EndpointAgentDaemon' -uninstall 'UninstallPassword1234!'
  • Option 2 - For endpoints which may be corrupted or cannot otherwise be uninstalled, run the following commands:
    sudo rm -r /Library/LaunchDaemons/com.malwarebytes.EndpointAgent.plist
    sudo rm -r /Library/LaunchDaemons/com.malwarebytes.agent.daemon.plist
    sudo rm -r /Library/LaunchAgents/com.malwarebytes.UserAgent.plist
    sudo rm -r /Library/LaunchDaemons/com.malwarebytes.ncep.rtprotection.daemon.plist
    sudo rm -r /Library/LaunchDaemons/com.malwarebytes.ncep.settings.daemon.plist
    sudo rm -r '/Library/Application Support/Malwarebytes/'

Linux

To manually remove the endpoint on Linux, run the proper command for your Linux distribution:

  • DPKG distros: 
    sudo apt remove mblinux
  • RPM distros: 
    sudo yum remove mblinux

iOS, Android, and ChromeOS

To manually remove the software from a mobile device, refer to the documentation for the corresponding operating system:

Return to the Malwarebytes OneView User Guide.

Related articles