Starting from XDR Version 2.03.23, the CYFOX Agent can be uninstalled directly from the XDR Server, simplifying the process of managing company inventory.
As of today, only Windows Agents support direct installation from the server. For macOS and Linux deployments, manual installation is required, which can be facilitated through scripts provided by the CYFOX support team.
The following guide outlines the steps to remotely uninstall the agent from any connected device without the need for third-party distribution tools or local access to the device.
Prerequisites
Before you begin, ensure the following:
Administrative access to the XDR server is available.
For agent uninstallation, it is recommended to verify that the target device is online and has the CYFOX Agent installed with a minimum version of 2.5.0.0. (Refer to the steps below for instructions on how to check this.)
Step 1: Access to the XDR Management Console
Log in to the XDR server using administrator credentials.
Navigate to the Inventory tab, where all devices can be viewed under the Managed Devices submenu.
Note that upon navigating to the Inventory tab, the Managed Devices submenu will be displayed by default.
Step 2: Choosing the device(s) to remove
Devices can be removed whether they operate via an installed Agent or use WMI.
When removing a device with an installed Agent:
The system will send a removal request and await a response. If successful, the agent will be uninstalled, and the license will be returned to the license pool, allowing it to be reassigned to another device.
When removing a device using WMI:
The system will immediately stop WMI communication with the device.
To remove a single device:
Locate the relevant row for the device to be removed.
On the right side, click on the pencil icon to open the actions list.
Select the Remove Device option.
To remove multiple devices:
On the right side, use the multi-select option to choose the devices to be removed.
To select all devices, click the checkbox next to the All column title, which will select all devices, not just those on the current page.
Once devices are selected, the system will automatically enable the update button. Click it to present the actions list, then choose the last option, Remove Device.
Step 3: Monitoring the progress
Once the user approves the removal of the device(s), the procedure will begin immediately.
As a reminder, each management type has its own removal process, which may affect the time required to complete the request.
WMI Device Removal
After selection, an immediate response will be displayed, typically indicating a successful removal within seconds.
Agent Removal
Removing an agent may take up to 10 minutes to complete.
Unlike WMI removal, this process is not immediate. Notifications will be sent to the user in three stages:
Removal Initiated: This notification confirms that the agent has received the removal request and has begun the process
Removal in progress: During the uninstallation of the Agent, a small loader icon will temporarily replace the regular actions button, indicating that the process is still in progress. This icon appears on the right side of the Inventory page, where the actions button is typically located. Below, you can see the difference between an active agent and one with the uninstallation in progress.
Removal Completed: This final notification confirms that the agent has been successfully removed (Refer to the next section for more details)
Step 4: Removal Confirmation
Once the action is officially completed, the system will display an indication on the Inventory page.
Note that devices that have been removed will not be entirely hidden from the inventory. Instead, they will be marked as "Removed," allowing continued access to the device's data while clearly differentiating them from active devices.
To refine the view, use the licensing filter to display only the endpoints that meet specific criteria:
Licensed
Unlicensed
Removed
Troubleshooting
If a device’s status doesn’t update as expected, try refreshing the Inventory page.
If the issue persists, ensure the network connection is stable and the XDR server is fully operational.
Please note that agent removal is only supported for versions 2.5 and above. Attempts to remove agents running older versions will not be successful.
If the problem continues, contact support at [email protected] or submit a request through the contact form.