1. Code42 Support
  2. Incydr
  3. Incydr administration
  4. Planning and installing
  5. Manage agent installations in your Code42 environment

Uninstall the insider risk agent from user devices

Updated

Overview

This article explains how to uninstall the insider risk agent from user devices. Uninstalling the insider risk agent deletes all Code42 application and data files from the device.

Insider risk agent only
This article applies to the insider risk agent only. For the backup agent, see Uninstall the backup agent.

Considerations

Uninstalling the insider risk agent removes the Code42 log files. If you are uninstalling as part of a troubleshooting process, retrieve the logs before uninstalling.

Windows

Manual uninstall

To uninstall the insider risk agent from a single device:

  1. Sign in to the Windows device as a user with administrator permissions.
  2. From the Windows menu, select Settings  > Apps > Apps & features.
  3. Select Code42 Incydr Agent and select Uninstall.

MDM uninstall

You can also use a mobile device management (MDM) tool like SCCM to remove the app remotely from one or more devices. From your MDM, run the insider risk agent uninstaller with this command:

  • Insider risk agent version 1.10.0 and later: "C:\Program Files\Code42-AAT\code42-aat-cli.exe" uninstall
  • Insider risk agent version 1.10.0 and later with uninstall secrets enabled: "C:\Program Files\Code42-AAT\code42-aat-cli.exe" uninstall /s <secret>
  • Insider risk agent version 1.9.x and earlier: "C:\Program Files\Code42-AAT\Code42-AAT.exe" /uninstall

PowerShell uninstall

To use PowerShell to uninstall the insider risk agent, run the uninstaller with this command:

  • Insider risk agent version 1.10.0 and later: Start-Process -FilePath "C:\Program Files\Code42-AAT\code42-aat-cli.exe" -ArgumentList "uninstall"
  • Insider risk agent version 1.10.0 and later with uninstall secrets enabled: Start-Process -FilePath "C:\Program Files\Code42-AAT\code42-aat-cli.exe" -ArgumentList "uninstall /s <secret>"
  • Insider risk agent version 1.9.x and earlier: Start-Process -FilePath "C:\Program Files\Code42-AAT\Code42-AAT.exe" -ArgumentList "/uninstall"

Mac

The insider risk agent can only be removed via the command line or a mobile device management (MDM) tool like Jamf.

Uninstall permissions
Some versions of macOS may require you to grant additional permissions to the application you use to uninstall the agent (for example, Terminal). To add permissions:
  1. Go to System Settings > Privacy & Security > App Management.
  2. Click the plus + icon.
  3. Select the application you're using to perform the uninstall (for example, Terminal).
  4. Go to System Settings > Privacy & Security > Full Disk Access.
  5. Click the plus + icon.
  6. Select the application you're using to perform the uninstall (for example, Terminal).
  7. After completing the uninstall steps below, you can remove these permissions.

macOS Sonoma, Ventura, and Monterey

  1. Configure Code42 as a Removable System Extension in your computer configuration profile. (MDM uninstall only)
  2. From the command line or your MDM, run the insider risk agent uninstaller with this command:
    • Insider risk agent feature pack version 1.10.0 and later: sudo /Applications/Code42-AAT.app/Contents/MacOS/code42-aat-cli uninstall
    • Insider risk agent feature pack version 1.10.0 and later with uninstall secrets enabled: sudo /Applications/Code42-AAT.app/Contents/MacOS/code42-aat-cli uninstall -s <secret>
    • Insider risk agent feature pack version 1.7.0 and later: sudo /Applications/Code42-AAT.app/Contents/MacOS/code42-aat-cli --uninstall
    • Insider risk agent feature pack version 1.6.0 - 1.6.2: sudo /Applications/Code42-AAT.app/code42-aat --uninstall
    • Insider risk agent feature pack version 1.5.1 and earlier: sudo /Library/Application\ Support/Code42-AAT/code42ctl uninstall
Identify the insider risk agent feature pack version number
To find the version number of the agent you're uninstalling, go to Administration > Environment > Agents. Find the agent and note the Version column. The version number includes two values, for example: 1.6.2 (1.7.0). The second number (in parenthesis) is the Feature pack version.

macOS Big Sur

Requires insider risk agent version 1.4.0 or later

  1. From your MDM, remove the Code42 computer configuration profile. (MDM uninstall only)
  2. From the command line or your MDM, run the insider risk agent uninstaller with this command:
    • Insider risk agent feature pack version 1.10.0 and later: sudo /Applications/Code42-AAT.app/Contents/MacOS/code42-aat-cli uninstall
    • Insider risk agent feature pack version 1.10.0 and later with uninstall secrets enabled: sudo /Applications/Code42-AAT.app/Contents/MacOS/code42-aat-cli uninstall -s <secret>
    • Version 1.7.0 and later: sudo /Applications/Code42-AAT.app/Contents/MacOS/code42-aat-cli --uninstall
    • Version 1.6.0 - 1.6.2: sudo /Applications/Code42-AAT.app/code42-aat --uninstall
    • Version 1.5.1 and earlier: sudo /Library/Application\ Support/Code42-AAT/code42ctl uninstall

This method only works if the device is not restarted between steps. If the device does restart between steps 1 and 2, you must manually run the uninstaller or drag the app to the Trash as described in the Manual uninstall steps above.