Secureframe Agent: Unenrolling & Uninstall Secureframe Agent

The Secureframe Agent is a read-only agent designed to help smaller organizations be secure by reporting on key device settings.

Un-enroll your organization and archive the integration

In some cases an organization may decide to remove the Agent or upgrade to a more robust MDM. In this scenario you can remove the Secureframe Agent from your Secureframe instance by following the instructions below.

  1. Navigate to Integrations > Secureframe Agent.
  2. Click the three vertical dots on the right hand side, then Archive.  A pop up will appear confirming you want to archive the integration.
  3. Click Archive.

Screenshot_2023-02-01_at_12.14.45_PM.pngScreenshot_2023-02-01_at_12.14.54_PM.png 

Once disconnected, Secureframe will stop receiving information from installed agents. If you need additional help removing the Secureframe Agent integration, please contact your Customer Success representative or Customer Support at support@secureframe.com. 

In addition, we recommend users uninstall the agent from their devices. Further information on how users can uninstall the Secureframe Agent from their devices can be found within this article.

 

Uninstall Secureframe Agent From Your Device

Devices will automatically de-register 30 days after being uninstalled. Deleting the device from Asset Inventory before 30 days will result in the device re-populating. If you cannot wait for the automatic expiration, please contact support.

Windows

Use the "Add or remove programs" dialog to remove “Fleet osquery." It might also be named "Orbit Osquery" for older versions of the agent.

Mac

Download the cleanup script attached to this help article. It is named "cleanup_macos.sh".

Open the Terminal App, go to the folder with the cleanup script, and run:

chmod +x cleanup_macos.sh

That makes the script executable. Now run the script with:

sudo ./cleanup_macos.sh

It is normal to be prompted for your password when using sudo.

Alternatively you can run the following commands in Terminal:

sudo launchctl stop com.fleetdm.orbit
sudo launchctl unload /Library/LaunchDaemons/com.fleetdm.orbit.plist

sudo pkill fleet-desktop || true
sudo rm -rf /Library/LaunchDaemons/com.fleetdm.orbit.plist /var/lib/orbit /usr/local/bin/orbit /var/log/orbit /opt/orbit/


Linux

Uninstall the package with the corresponding package manager:

  • Ubuntu
sudo apt remove fleet-osquery -y
  • CentOS
sudo rpm -e fleet-osquery

Frequently Asked Questions (FAQ)

I switched laptops and uninstalled the SF Agent from the old laptop weeks ago, but it is still listed in my Asset Inventory?

  • At this time, a device without the agent can remain in the device list for up to 30 days. After the 30 days, it is automatically removed. This allows us to better troubleshoot issues with devices.

Was this article helpful?

Have more questions? Submit a request

Comments

0 comments

Article is closed for comments.