Skip to content

Endpoint Agent Uninstallation

There are multiple options available to uninstall the LimaCharlie Sensor, depending on the operating system and/or method of installation. macOS and Windows systems allow for easy uninstallation via sensor commands or rules. Linux systems may require additional steps, as detailed below.

Manually Uninstalling the Endpoint Agent

When uninstalling macOS and Windows Sensors, please attempt to utilize a method similar to sensor deployment. For example, if sensors were deployed via a package manager, then the same package manager may have uninstall options as well. This will help keep software inventories up to date.

Details on manual uninstallation is found at the bottom of each respective OS' installation procedures.

Uninstalling Endpoint Agents from the Platform

Sensor Commands

For macOS and Windows operating systems, you can uninstall a sensor with the uninstall command. See the endpoint commands reference for more detail.

On Windows, the command defaults to uninstalling the sensor as if installed from the direct installer exe. If an MSI was used for installation, you can add a --msi flag to the uninstall command to trigger an uninstallation that is compatible with MSI.

Native vs Legacy Uninstall

By default, the uninstall command uses the legacy procedure: the sensor runs a shell command that invokes the on-disk agent's own uninstaller. This works on every sensor version.

Adding the --native flag instead instructs the sensor to uninstall itself using its built-in (native) uninstall procedure, without spawning a shell command:

uninstall --is-confirmed --native

Note

The --native flag requires sensor version 5.3.3 or later. Sensors running an older version silently ignore the native uninstall request — the task appears to be sent successfully, but nothing happens on the endpoint. If you are unsure of a sensor's version, omit --native to use the legacy procedure.

The --msi flag takes precedence over --native: the native procedure does not unregister the MSI product, so sensors installed via MSI should continue to use --msi.

SDK

To run the uninstall command against all Sensors, a simple loop with the SDK in Python would work:

from limacharlie.client import Client
from limacharlie.sdk.organization import Organization
from limacharlie.sdk.sensor import Sensor

client = Client()
org = Organization(client)
for sensor_info in org.list_sensors():
    sensor = Sensor(org, sensor_info["sid"])
    sensor.task("uninstall")

Using a D&R Rule

As an alternative approach, you can also use a Detection & Response (D&R) rule to automatically trigger an uninstall of the LimaCharlie sensor when a sensor connects to the LimaCharlie cloud. Below is an example of the rule you can use for this purpose. This example is specific to Windows-based endpoints, but can be modified based on your needs:

# Detect
event: SYNC
op: is windows

# Respond
- action: task
  command: uninstall --is-confirmed
- action: add tag
  tag: uninstalled

Package Management Tools

For Package Management tools, and other enterprise application-management tools, we recommend utilizing the integrated program removal options, rather than installing from LimaCharlie. This will help keep software inventories up to date.