Removing the agent cleanly

Removal has two halves — stopping the agent on the machine, and resolving the record in the console — and doing only one of them is the source of most decommissioning confusion.

On the machine, run the uninstall subcommand with elevated privileges. This stops the service, deregisters it and removes the binary.

# Linux / macOS
sudo aegisone-agent uninstall

# Windows, from an elevated PowerShell session
& "C:\Program Files\AegisOne\aegisone-agent.exe" uninstall

On macOS, machines installed from the .pkg support managed uninstall through your device-management platform, which is the cleaner route when you have one.

In the console, resolve the endpoint record deliberately. An endpoint whose agent has been removed will simply go offline and stay offline, which is indistinguishable at a glance from a machine that has failed. If you leave decommissioned endpoints in that state, your offline count becomes noise and eventually gets ignored — at which point a genuinely failed machine hides inside it.

The asset record is a separate decision from the endpoint record. If the hardware is being redeployed, keep the asset and its timeline; the history of a machine is often more useful after redeployment than before. If the hardware is being disposed of, close the asset so it stops appearing in inventory counts and warranty reporting.

Finally, check the commercial side. A decommissioned endpoint that remains on a contract is the mirror image of the leakage problem — you are billing for something you no longer deliver, which is a worse conversation to have with a customer than the one where you under-billed.