Before you begin
- An administrator account in Atlas AVD, to revoke or delete the device on the Devices tab of Atlas Reach
- Local administrator rights on Windows (an elevated PowerShell or Command Prompt), or root / sudo on macOS and Linux
Step 1: Revoke or delete the device in Atlas Reach
Open Atlas Reach (Atlas Operations → Reach in the sidebar) and go to the Devices tab. Find the device and choose one of these:
- Revoke: invalidates the device's credential. Its next report is rejected and it stops reporting, but its record, tags, and group memberships stay in the list. Revoke also stops the device counting toward future months' Reach usage.
- Delete device: removes the device from the fleet for good, including its enrollment, tags, and group memberships. This cannot be undone. Deleting tidies the list; it does not lower this month's Reach usage.
Revoke first, then uninstall. If you uninstall without revoking, the device simply goes offline and stays on the Devices tab until you revoke or delete it. To bring the machine back later, install the agent again with a valid enrollment token; it re-enrolls with a fresh credential.
Step 2 (Windows): Uninstall from Settings
On a single Windows 10 / 11 or Windows Server machine, open Settings → Apps → Installed apps (or Control Panel → Programs and Features), find Atlas AVD Endpoint Agent, and click Uninstall. The uninstaller stops the AtlasAvdAgent service, removes it, and deletes the program files and the agent's settings under HKLM\SOFTWARE\AtlasAVD\Agent.
Step 2 (Windows): Uninstall from the command line
For a silent uninstall, run one of these from an elevated prompt. If you still have the installer file, point msiexec at it. Otherwise, the PowerShell version looks the agent up by name, so it works whatever version or install folder is on the machine:
msiexec /x AtlasAvdAgent.msi /qn /norestart$keys = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
$agent = Get-ItemProperty $keys -ErrorAction SilentlyContinue |
Where-Object DisplayName -eq "Atlas AVD Endpoint Agent"
foreach ($a in $agent) {
Start-Process msiexec.exe -ArgumentList "/x $($a.PSChildName) /qn /norestart" -Wait
}
# Confirm the service is gone (this should return nothing)
Get-Service AtlasAvdAgent -ErrorAction SilentlyContinueDeployed the agent with Intune? Change the app's assignment for the device group from Required to Uninstall. Intune runs the same silent uninstall on each device the next time it checks in.
Step 3 (Windows): Remove what the uninstaller keeps
By design, the uninstaller leaves two things behind so a reinstall or upgrade does not disrupt the machine: the agent's data folder (logs, the device credential, and downloaded updates), and the Windows policy that lets Atlas Reach send Ctrl+Alt+Del in a remote session. To remove everything, run this from an elevated PowerShell prompt after the uninstall:
# Agent data: logs, device credential, staged updates
Remove-Item "C:\ProgramData\AtlasAVD\Agent" -Recurse -Force -ErrorAction SilentlyContinue
# Remove the parent folder only if nothing else is in it
if (-not (Get-ChildItem "C:\ProgramData\AtlasAVD" -ErrorAction SilentlyContinue)) {
Remove-Item "C:\ProgramData\AtlasAVD" -Force -ErrorAction SilentlyContinue
}
# Optional: the Ctrl+Alt+Del (software SAS) policy the installer turned on
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" `
-Name SoftwareSASGeneration -ErrorAction SilentlyContinueOnly remove the SoftwareSASGeneration value if nothing else relies on it. If your Group Policy or another remote-support tool sets it, leave it in place, or change it through that policy instead.
Windows: Quick Support
Quick Support, used for attended one-off sessions, does not need to be uninstalled. The Quick Support MSI removes itself when the session ends, and the standalone executable runs from the Downloads folder without installing anything, so you can just delete the file. If a Quick Support install was ever left behind, remove Atlas Reach Quick Support from Settings → Apps under that user's account.
Step 2 (macOS): Uninstall the agent
The macOS .pkg has no uninstaller of its own, so remove it with these commands in Terminal. They stop the background service, delete the agent and its launch daemon, remove its config, state, and logs, delete its device credential from the System keychain, and clear the package receipt:
# Stop the agent and remove its launch daemon
sudo launchctl bootout system /Library/LaunchDaemons/com.atlasavd.reach-agent.plist 2>/dev/null
sudo rm -f /Library/LaunchDaemons/com.atlasavd.reach-agent.plist
# Remove the agent, its config and state, and its log
sudo rm -rf /usr/local/atlas-reach-agent
sudo rm -rf "/Library/Application Support/AtlasAVD/ReachAgent"
sudo rm -f /Library/Logs/AtlasAVD/reach-agent.log*
# Remove the device credential from the System keychain
sudo security delete-generic-password -a device-credential -s AtlasAVD.ReachAgent \
/Library/Keychains/System.keychain 2>/dev/null
# Forget the package receipt
sudo pkgutil --forget com.atlasavd.reach-agent 2>/dev/null
# Confirm it is gone (exits non-zero only if the agent is still loaded)
if sudo launchctl list | grep -q com.atlasavd.reach-agent; then
echo "Atlas Reach agent is still loaded" >&2; false
else
echo "Atlas Reach agent removed"
fiManaging Macs with Jamf or Intune? Run the same commands as a script on the devices, and remove any PPPC profile you pushed for the agent's Screen Recording and Accessibility permissions. If you approved those permissions by hand, you can also remove the agent from System Settings → Privacy & Security.
Step 2 (Linux): Uninstall on Debian / Ubuntu
Removing the package stops and disables the atlas-reach-agent service first. Purge it, then delete the config and state folders the package leaves behind:
sudo apt-get purge -y atlas-reach-agent
sudo rm -rf /etc/atlas-reach-agent /var/lib/atlas-reach-agent /var/tmp/AtlasReachStep 2 (Linux): Uninstall on RHEL / Fedora or SUSE
Remove the package with dnf (or zypper on SUSE), then delete the same folders:
sudo dnf remove -y atlas-reach-agent
# SUSE / openSUSE:
# sudo zypper --non-interactive remove atlas-reach-agent
sudo rm -rf /etc/atlas-reach-agent /var/lib/atlas-reach-agent /var/tmp/AtlasReachLinux: What the folders are, and checking it worked
Your package manager deliberately keeps the agent's credential and config on a plain remove, so that reinstalling the same package keeps the machine enrolled. Deleting the folders above finishes the job:
- /etc/atlas-reach-agent: config.json and agent.env, which hold your server address and any enrollment token.
- /var/lib/atlas-reach-agent: the device credential and the agent's saved state.
- /var/tmp/AtlasReach: the inbox for files an operator sent to the device. Copy out anything you want to keep before deleting it.
# If the libsecret tools are installed, also clear any keyring copy of the credential
if command -v secret-tool >/dev/null; then
sudo secret-tool clear service AtlasAVD.ReachAgent account device-credential || true
fi
# Confirm it is gone (exits non-zero only if the agent is still installed)
if systemctl cat atlas-reach-agent >/dev/null 2>&1 || [ -e /usr/lib/atlas-reach-agent ]; then
echo "Atlas Reach agent is still installed" >&2; false
else
echo "Atlas Reach agent removed"
fiReinstalling later
To bring a machine back into Atlas Reach, mint or copy an enrollment token on the Enrollment tab and install the agent again as described in Install the Atlas Reach Agent on Windows, on macOS, or on Linux. A revoked device re-enrolls with a fresh credential and, if your tenant does not auto-approve devices, waits as Pending approval until an administrator approves it.
Something left over or still reporting? Check that the device shows as Revoked on the Devices tab, then send the device name and its operating system to support@atlasavd.com.