Document ways to provide multiple Agent uninstall tokens (#6300)

* Document ways to provide multiple Agent uninstall tokens * Apply suggestions from code review Co-authored-by: Benjamin Ironside Goldstein <[email protected]> --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
elastic · Dec 17, 2024 · 87e3acb · 87e3acb
1 parent ad10bd8
commit 87e3acb
Show file tree

Hide file tree

Showing 4 changed files with 64 additions and 1 deletion.
diff --git a/docs/getting-started/agent-tamper-protection.asciidoc b/docs/getting-started/agent-tamper-protection.asciidoc
@@ -48,3 +48,5 @@ If you need the uninstall token to remove {agent} from an endpoint, you can find
 
 ** Click the *Show token* icon in the *Token* column to reveal a specific token.
 ** Click the *View uninstall command* icon in the *Actions* column to open the *Uninstall agent* flyout, containing the full uninstall command with the token.
+
+TIP: If you have many tamper-protected {agent} policies, you may want to <<multiple-uninstall-tokens>> in a single command.
diff --git a/docs/getting-started/uninstall-agent.asciidoc b/docs/getting-started/uninstall-agent.asciidoc
@@ -5,14 +5,43 @@ To uninstall {agent} from a host, run the `uninstall` command from the directory
 
 If <<agent-tamper-protection,Agent tamper protection>> is enabled on the Agent policy for the host, you'll need to include the uninstall token in the command, using the `--uninstall-token` flag. You can <<fleet-uninstall-tokens,find the uninstall token>> on the Agent policy. Alternatively, find *{fleet}* in the navigation menu or by using the {kibana-ref}/introduction.html#kibana-navigation-search[global search field], and select *Uninstall tokens*.
 
-
 For example, to uninstall {agent} on a macOS or Linux host:
 
 [source,shell]
 ----------------------------------
 sudo elastic-agent uninstall --uninstall-token 12345678901234567890123456789012
 ----------------------------------
 
+[discrete]
+[[multiple-uninstall-tokens]]
+== Provide multiple uninstall tokens
+
+If you have multiple tamper-protected {agent} policies, you may want to provide multiple uninstall tokens in a single command. There are two ways to do this:
+
+* The `--uninstall-token` command can receive multiple uninstall tokens separated by a comma, without spaces.
++
+[source,shell]
+----------------------------------
+sudo elastic-agent uninstall -f --uninstall-token 7b3d364db8e0deb1cda696ae85e42644,a7336b71e243e7c92d9504b04a774266
+----------------------------------
+
+* `--uninstall-token`'s argument can also be a path to a text file with one uninstall token per line. 
++
+NOTE: You must use the full file path, otherwise the file may not be found.
++
+[source,shell]
+----------------------------------
+sudo elastic-agent uninstall -f --uninstall-token /tmp/tokens.txt
+----------------------------------
++
+In this example, `tokens.txt` would contain:
++
+[source,txt]
+----------------------------------
+7b3d364db8e0deb1cda696ae85e42644
+a7336b71e243e7c92d9504b04a774266
+----------------------------------
+
 [discrete]
 [[uninstall-endpoint]]
 == Uninstall {elastic-endpoint}

diff --git a/docs/serverless/edr-install-config/agent-tamper-protection.asciidoc b/docs/serverless/edr-install-config/agent-tamper-protection.asciidoc
@@ -50,3 +50,5 @@ If you need the uninstall token to remove {agent} from an endpoint, you can find
 +
 ** Click the **Show token** icon in the **Token** column to reveal a specific token.
 ** Click the **View uninstall command** icon in the **Actions** column to open the **Uninstall agent** flyout, containing the full uninstall command with the token.
+
+TIP: If you have many tamper-protected {agent} policies, you may want to <<multiple-uninstall-tokens>> in a single command.
diff --git a/docs/serverless/edr-install-config/uninstall-agent.asciidoc b/docs/serverless/edr-install-config/uninstall-agent.asciidoc
@@ -54,6 +54,36 @@ C:\"Program Files"\Elastic\Agent\elastic-agent.exe uninstall --uninstall-token 1
 </div>
 ++++
 
+[discrete]
+[[multiple-uninstall-tokens]]
+== Provide multiple uninstall tokens
+
+If you have multiple tamper-protected {agent} policies, you may want to provide multiple uninstall tokens in a single command. There are two ways to do this:
+
+* The `--uninstall-token` command can receive multiple uninstall tokens separated by a comma, without spaces.
++
+[source,shell]
+----------------------------------
+sudo elastic-agent uninstall -f --uninstall-token 7b3d364db8e0deb1cda696ae85e42644,a7336b71e243e7c92d9504b04a774266
+----------------------------------
+
+* `--uninstall-token`'s argument can also be a path to a text file with one uninstall token per line. 
++
+NOTE: You must use the full file path, otherwise the file may not be found.
++
+[source,shell]
+----------------------------------
+sudo elastic-agent uninstall -f --uninstall-token /tmp/tokens.txt
+----------------------------------
++
+In this example, `tokens.txt` would contain:
++
+[source,txt]
+----------------------------------
+7b3d364db8e0deb1cda696ae85e42644
+a7336b71e243e7c92d9504b04a774266
+----------------------------------
+
 [discrete]
 [[uninstall-endpoint]]
 == Uninstall {elastic-endpoint}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -48,3 +48,5 @@ If you need the uninstall token to remove {agent} from an endpoint, you can find

		** Click the Show token icon in the Token column to reveal a specific token.
		** Click the View uninstall command icon in the Actions column to open the Uninstall agent flyout, containing the full uninstall command with the token.

		TIP: If you have many tamper-protected {agent} policies, you may want to <<multiple-uninstall-tokens>> in a single command.