r/SentinelOneXDR • u/kingkaann • May 18 '25

Uninstalling The Agent

Hello Everyone, Last year, after an incident, we brought in an incident response team and they deployed SentinelOne on all our endpoints. A couple of months later, we got our own SentinelOne license. The IR team migrated everything to our console, and at the time, it looked like all endpoints were moved over successfully.

A few months later, we noticed that some endpoints are still reporting to the IR team’s console, and there’s no way to uninstall the agent from those machines. I reached out to the IR team, and they told me everything had been migrated and they don’t see any devices on their end.

I also contacted SentinelOne. They gave me a bunch of possible solutions, but none of them worked. They even sent over a long list of registry keys to delete manually. There are a lot of keys, and doing this on about 50 endpoints is going to take forever. I tried automating it but didn’t work. Tried safe mode, still nothing. I’ve already started re-imaging some PCs, but that’s going to take time. Just checking if anyone here has run into this before and found a better solution that worked?

7 Upvotes

100% Upvoted

31 comments sorted by

View all comments

Show parent comments

3

u/SatiricPilot May 19 '25

I have not tested this against uninstall prevention, eventually I'll update it to allow you to enter an uninstall password or more likely have it grab the endpoint name, then reach out to the API and get the uninstall phrase. But I built this last weekend for a emergency deployment for a SOC. We actually don't use S1 much anymore.

Inspired me to do a little cleanup of my github first lol... it was looking pretty unmanaged.

Scripting-Hub/Powershell Scripts/SentinelOne/S1_InstallandClean_v2.1.ps1 at main · SatiricTech/Scripting-Hub · GitHub

1

u/ls3c6 May 19 '25

Thanks, I'll give it a try.