Uninstall the insider risk agent from user devices

Overview

This article explains how to uninstall the insider risk agent from user devices. Uninstalling the insider risk agent deletes all Incydr application and data files from the device.

Insider risk agent only
This article applies to the insider risk agent only. For the backup agent, see Uninstall the backup agent.

Considerations

Uninstalling the insider risk agent removes the Incydr log files. If you are uninstalling as part of a troubleshooting process, retrieve the logs before uninstalling.

Windows

Manual uninstall

To uninstall the insider risk agent from a single device:

1. Sign in to the Windows device as a user with administrator permissions.
2. From the Windows menu, select Settings  > Apps > Apps & features.
3. Select Code42 Incydr Agent and select Uninstall.

MDM uninstall

You can also use a mobile device management (MDM) tool like SCCM to remove the app remotely from one or more devices. From your MDM, run the insider risk agent uninstaller with this command:

• Without uninstall secrets: "C:\Program Files\Code42-AAT\code42-aat-cli.exe" uninstall
• With uninstall secrets enabled: "C:\Program Files\Code42-AAT\code42-aat-cli.exe" uninstall /s <secret>

PowerShell uninstall

To use PowerShell to uninstall the insider risk agent, run the uninstaller with this command:

• Without uninstall secrets: Start-Process -FilePath "C:\Program Files\Code42-AAT\code42-aat-cli.exe" -ArgumentList "uninstall"
• With uninstall secrets enabled: Start-Process -FilePath "C:\Program Files\Code42-AAT\code42-aat-cli.exe" -ArgumentList "uninstall /s <secret>"

Mac

The insider risk agent can only be removed via the command line or a mobile device management (MDM) tool like Jamf.

Uninstall permissions
Some versions of macOS may require you to grant additional permissions to the application you use to uninstall the agent (for example, Terminal). To add permissions: Go to System Settings > Privacy & Security > App Management. Click the plus + icon. Select the application you're using to perform the uninstall (for example, Terminal). Go to System Settings > Privacy & Security > Full Disk Access. Click the plus + icon. Select the application you're using to perform the uninstall (for example, Terminal). After completing the uninstall steps below, you can remove these permissions.

1. Configure Incydr as a Removable System Extension in your computer configuration profile. (MDM uninstall only)
2. From the command line or your MDM, run the insider risk agent uninstaller with this command:
   • Without uninstall secrets: sudo /Applications/Code42-AAT.app/Contents/MacOS/code42-aat-cli uninstall
   • With uninstall secrets enabled: sudo /Applications/Code42-AAT.app/Contents/MacOS/code42-aat-cli uninstall -s <secret>

Linux

From a Terminal window on the endpoint, use the following command to uninstall the insider risk agent:

• Ubuntu: sudo dpkg --purge code42-aat
• Red Hat: sudo rpm -e code42-aat

Next steps

If you uninstalled as part of a troubleshooting step and are ready to reinstall, see our Install the insider risk agent article.

Related topics

• Incydr agent software processes
• Incydr hardware and software requirements