How to uninstall Capture Client and Sentinel One?

This article covers how to Uninstall Capture Client and SentinelOne from both Windows and MAC

Method 1: Uninstalling Capture Client from the CMC dashboard

1. Login to captureclient-36.Sonicwall.com
2. Under Assets>Devices, search for the device that you want to Uninstall. Select the device and click on icon
   
3. Click on Uninstall Client and wait until the status turns red
4. Reboot the device
5. Decommission the device if it still shows commissioned after reboot to release the license.

NOTE: It is the best practice to export the device details .csv file before uninstalling the Capture Client or Sentinel One.

To download the device details, click the download devices  icon as shown below:

The downloaded .csv file will have all the details and passphrases/passwords of both Capture Client and SentinelOne.

Method 2: Uninstalling Capture Client manually from Windows Machine

If method 1 fails to Uninstall CC and S1, try manual uninstallation. This method also works for offline clients.

1. Uninstall Capture Client from Programs and features.

2. For uninstallation, it will prompt for authorization key.

Authorization key is unique for every device, it can be found under the device details. Click on Show to view the Authorization code as shown below. Alternatively, you can refer to the downloaded .csv file.

3. Reboot the device after uninstalling Capture Client [With this both CC and S1 should be removed] If S1 is still present post reboot then follow the “Uninstalling S1 method”.
   
   

Method 3: Uninstalling manually from MAC devices via terminal

Run the following commands on the terminal as root/Administrator:

> cd /library/Sonicwall/CaptureClient/

> ./uninstaller password=authorization key [This can be obtained from the csv file as described above]

With this both CC and S1 will get uninstalled

Uninstalling S1:

1. To Uninstall SentinelOne if it fails to Uninstall along with Capture Client. Then, Uninstall manually from Programs and features.

2. For S1 uninstallation, it will prompt with two options: Online and Offline
   Online will have uninstallation command pushed via CMC whereas Offline will require manual entry of S1 passphrase.
   
   Select offline to manually remove SentinelOne.
   
   Enter SentinelOne passphrase obtained from the “download device” file and click Uninstall.
3. Reboot the device. If SentinelOne appears on the CMC console under the Unmanaged SentinelOne section:
   Search for the device which you want to Uninstall. Select the device and click on icon. Click on “Uninstall”
   

CAUTION:It is necessary to do clean uninstallation to avoid any Capture Client or SentinelOne files/registry traces left behind which will create issues later during the re-installation of Capture Client or SentinelOne. Please reach out to support if the uninstallation is incomplete It is imperative to do clean uninstallation to avoid any Capture Client or SentinelOne files/registry traces left behind which will create issues later during the re-installation of Capture Client or SentinelOne..

Please reach out to support if the uninstallation does not happen.