Uninstalling the agent

This article explains how to uninstall the RocketCyber agent from supported operating systems used with Kaseya MDR.

Uninstalling the agent permanently removes endpoint telemetry from the affected device. Use these procedures when decommissioning systems, re‑imaging devices, correcting erroneous installations, or removing MDR coverage from an endpoint.

This article does not describe agent deployment or troubleshooting workflows.

Supported uninstall methods

The RocketCyber agent can be uninstalled silently or interactively, and the commands can be scripted using RMM tools or other automation platforms.

Windows

Powershell uninstall

A PowerShell script is available for automated uninstallation: rocketagent_uninstall.ps1

This method is suitable for bulk removal via automation or RMM tools.

Command-line uninstall

The Windows uninstaller is located at C:\Program Files\RocketAgent\uninstall.exe

  • Running the executable without parameters launches an interactive uninstaller that requires user input.

  • To perform a silent uninstall, use the /S parameter. Example: : C:\Program Files\RocketAgent\uninstall.exe /S

Silent uninstalls do not display a user interface and require no user interaction.

macOS

Command-line uninstall

The macOS uninstaller is located at /usr/local/rocketcyber/mac-agent-updater

To uninstall the agent, run the following command: sudo /usr/local/rocketcyber/mac-agent-updater UNINSTALL "" "" ""

The command is case-sensitive and must be entered exactly as shown. This uninstall runs silently and can be scripted using any RMM tool or other automation tool that can execute commands on an endpoint.

Linux

Uninstall using the agent updater

To uninstall the RocketCyber agent using the updater application, run: sudo /usr/local/rocketcyber/linux-agent-updater UNINSTALL "" "" ""

This command removes the agent from the service manager (systemctl) and deletes the agent installation directory at /usr/local/rocketcyber.

Manual uninstall (advanced)

If manual removal is required, perform the following steps from a terminal:

  1. Stop the agent: 
sudo systemctl stop rocketcyber.service
  1. Verify the agent is stopped:
sudo systemctl status rocketcyber.service

Confirm the Active and Main PID entries indicate the agent is not running.

  1. Remove the agent configuration file:
  sudo rm /etc/systemd/system/rocketcyber.service
  1. Remove the agent from Linux service management:
  sudo systemctl daemon-reload
  1. Remove agent files:
  sudo rm -rf /usr/local/rocketcyber