This article covers how to remove the Secureframe Agent from your device. If you are a Secureframe administrator removing the integration from your organization, skip to For admins: Archive the Secureframe Agent integration at the bottom of this page.
Uninstall Secureframe Agent from your device
Important: Your device may remain in Asset Inventory for up to 30 days after uninstalling the agent. This is expected. Deleting the device from Asset Inventory before 30 days will cause it to reappear. If you cannot wait for automatic removal, contact [email protected].
Windows
Open Add or remove programs and uninstall Fleet osquery. Older agent versions may appear as Orbit Osquery.
Mac
Download the script attached at the bottom of this help article, named cleanup_macos.sh. Review the script before running it to confirm it does not interfere with your environment.
Open Terminal, go to the folder with the cleanup script, and run:
chmod +x cleanup_macos.sh
Then run the script:
sudo ./cleanup_macos.sh
It is normal to be prompted for your password when using sudo.
Alternatively, run these commands in Terminal (run the first two lines together, then the remaining lines):
sudo launchctl stop com.fleetdm.orbit
sudo launchctl unload /Library/LaunchDaemons/com.fleetdm.orbit.plist
sudo pkill fleet-desktop || true
sudo rm -rf /Library/LaunchDaemons/com.fleetdm.orbit.plist /var/lib/orbit /usr/local/bin/orbit /var/log/orbit /opt/orbit/
Linux
Uninstall the package with the corresponding package manager:
Ubuntu
sudo apt remove fleet-osquery -y
CentOS / RHEL
sudo rpm -e fleet-osquery
Confirm the agent is no longer running
After uninstalling, use the steps below to verify the Secureframe Agent has stopped on your device.
Windows
Open the Start menu and go to Services. Fleet osquery should no longer appear, or it should not show a status of Running. If the service is still running, restart your device and check again.
Mac
Open Terminal and run:
sudo launchctl list com.fleetdm.orbit
If you do not see a PID in the output, the agent is not running. You may be prompted for your password when using sudo.
Linux
Open Terminal and run:
sudo systemctl status orbit.service
If the service is not active (running), the agent has been removed successfully.
Frequently Asked Questions (FAQ)
I switched to a new work laptop and need to remove the agent from my personal device.
Uninstall the Secureframe Agent from your personal laptop using the steps above for your operating system.
Install the agent only on your current work-issued device by downloading a fresh package from your Employee Onboarding page. Each user gets a unique installer, so do not reuse the package from your personal device.
Your personal device may remain in Asset Inventory for up to 30 days after uninstall. This is expected and does not mean the agent is still active on that device.
Use Confirm the agent is no longer running above if you want to verify removal before the device drops from inventory.
I switched laptops and uninstalled the Secureframe Agent from the old laptop weeks ago, but it is still listed in Asset Inventory?
A device without the agent can remain in the device list for up to 30 days after uninstall.
After 30 days, it is automatically removed. This allows us to better troubleshoot issues with devices.
I have an employee who is no longer with my company. I marked them inactive on the Personnel page, but I still see their notebook in Asset Inventory?
One common scenario is that the user still has the Secureframe Agent installed on their device.
To remove the asset, ensure the Secureframe Agent is uninstalled from that computer.
Once uninstalled, the asset is automatically removed from Asset Inventory after 30 days.
If the person is no longer an employee and unable to uninstall the device, mark the device as out of scope in Asset Inventory.
For admins: Archive the Secureframe Agent integration
The Secureframe Agent is a read-only agent designed to help smaller organizations be secure by reporting on key device settings. If your organization decides to remove the Agent or upgrade to a more robust MDM, you can archive the integration in Secureframe.
Navigate to Integrations > Secureframe Agent.
Click the three vertical dots on the right-hand side, then Archive. A popup will confirm you want to archive the integration.
Click Archive.
Once archived, Secureframe stops receiving information from installed agents. We recommend asking users to uninstall the agent from their devices using the steps at the top of this article.
If you need additional help removing the Secureframe Agent integration, contact your Customer Success representative or [email protected].