Uninstall endpoints in Nebula – ThreatDown, powered by Malwarebytes, Support Site

Administrators can delete endpoints from their console to free up a seat from the subscription and remove the software from the endpoint. If the removal fails, there are workarounds to remove the endpoint agent from the device manually. This article explains how to remove endpoints from your console or manually uninstall the endpoint agent from the device if necessary.

Delete endpoint in Nebula

To delete an endpoint from the Nebula console:

On the left navigation pane, go to Manage > Endpoints.
Check the boxes next to endpoints you want to delete.
Click Actions.
In the drop down menu, click Delete.
A confirmation window displays. Enter the number of displayed endpoints and click Delete endpoint.

When you delete an endpoint from the console, the following happens:

The console flags the endpoint for uninstall.
- The console removes the endpoint from the user interface. This frees up one of your seat licenses.
- A hidden task is created to delete the endpoint.
If the endpoint is online, the uninstall task is executed immediately.
If the endpoint is offline but checks in within 90 days, the uninstall task is executed upon check-in.
If the endpoint is offline and checks in after 90 days:
- The Delete task is expired since the endpoint did not check in within the 90 day period.
- The software remains installed on the endpoint and the endpoint re-registers and appears in the console again. You must re-initiate the Delete task in the console.

You can also automate removing inactive and obsolete endpoints by enabling a policy setting. For more information, refer to the article Configure Inactive Endpoint Removal option in Nebula.

Manually remove endpoint agent

If the Endpoint Agent remains installed on an endpoint after deleting it from the console, try manually removing it.

An uninstall password may be required when manually removing the endpoint agent if Uninstall Protection is enabled in the policy associated with the endpoint's group. For help with locating the uninstall password, see Configure Tamper protection options in Nebula.

Windows

To manually remove the endpoint on Windows, log in to the device with administrative privileges and use one of the following methods:

Option 1 - Use the Control Panel Programs and Features or Apps & Features.
Option 2 - Launch the installer with the uninstall switch from Windows command line as an administrator:
```
MSIEXEC.exe /x "<fullpath1>\[setupfile].msi" /qn
```
- If Uninstall Protection is enabled, you must use the following syntax and input the password from the policy associated with the endpoint's group:
```
MSIEXEC.exe /X {949D1792-E377-4348-8BC4-6D643EF49B21} /qn Password="$ecure Password 1234!" 
```
Option 3 - For endpoints that may be corrupted or cannot be uninstalled, use one of the following tools:
- If Uninstall Protection is enabled, use the Discovery and Deployment tool.

If the above options fail, use the Support Tool for business environments.

macOS

To manually remove the endpoint on macOS, use one of the following methods:

Option 1

Option 1 - Launch EndpointAgentDaemon with the -uninstall option.
- Use single quotes for literal strings, or blanks should be escaped with \ if the command is scripted.
```
sudo '/Library/Application Support/Malwarebytes/Malwarebytes Endpoint Agent/EndpointAgentDaemon.app/Contents/MacOS/EndpointAgentDaemon' -uninstall
```
- If Uninstall Protection is enabled, include the password in the uninstall command. Use single quotes or escape characters if the Uninstall Password has special characters.
```
sudo '/Library/Application Support/Malwarebytes/Malwarebytes Endpoint Agent/EndpointAgentDaemon.app/Contents/MacOS/EndpointAgentDaemon' -uninstall 'UninstallPassword1234!'
```

Option 2 - For endpoints that may be corrupted or cannot otherwise be uninstalled, run the following commands:

sudo rm -r /Library/LaunchDaemons/com.malwarebytes.EndpointAgent.plist
sudo rm -r /Library/LaunchDaemons/com.malwarebytes.agent.daemon.plist
sudo rm -r /Library/LaunchAgents/com.malwarebytes.UserAgent.plist
sudo rm -r /Library/LaunchDaemons/com.malwarebytes.ncep.rtprotection.daemon.plist
sudo rm -r /Library/LaunchDaemons/com.malwarebytes.ncep.settings.daemon.plist
sudo rm -r '/Library/Application Support/Malwarebytes/'

Linux

To manually remove the endpoint on Linux, run the proper command for your Linux distribution:

DPKG distros:
```
sudo apt remove mblinux
```
RPM distros:
```
sudo yum remove mblinux
```

iOS, Android, and ChromeOS

To manually remove the software from a mobile device, refer to the documentation for the corresponding operating system: