diff --git a/docs/getting-started/agent-tamper-protection.asciidoc b/docs/getting-started/agent-tamper-protection.asciidoc index 5728169a87..423c5c4cae 100644 --- a/docs/getting-started/agent-tamper-protection.asciidoc +++ b/docs/getting-started/agent-tamper-protection.asciidoc @@ -48,3 +48,5 @@ If you need the uninstall token to remove {agent} from an endpoint, you can find ** Click the *Show token* icon in the *Token* column to reveal a specific token. ** Click the *View uninstall command* icon in the *Actions* column to open the *Uninstall agent* flyout, containing the full uninstall command with the token. + +TIP: If you have many tamper-protected {agent} policies, you may want to <> in a single command. \ No newline at end of file diff --git a/docs/getting-started/uninstall-agent.asciidoc b/docs/getting-started/uninstall-agent.asciidoc index 25f940d8e2..1b00a45d00 100644 --- a/docs/getting-started/uninstall-agent.asciidoc +++ b/docs/getting-started/uninstall-agent.asciidoc @@ -5,7 +5,6 @@ To uninstall {agent} from a host, run the `uninstall` command from the directory If <> is enabled on the Agent policy for the host, you'll need to include the uninstall token in the command, using the `--uninstall-token` flag. You can <> on the Agent policy. Alternatively, find *{fleet}* in the navigation menu or by using the {kibana-ref}/introduction.html#kibana-navigation-search[global search field], and select *Uninstall tokens*. - For example, to uninstall {agent} on a macOS or Linux host: [source,shell] @@ -13,6 +12,36 @@ For example, to uninstall {agent} on a macOS or Linux host: sudo elastic-agent uninstall --uninstall-token 12345678901234567890123456789012 ---------------------------------- +[discrete] +[[multiple-uninstall-tokens]] +== Provide multiple uninstall tokens + +If you have multiple tamper-protected {agent} policies, you may want to provide multiple uninstall tokens in a single command. There are two ways to do this: + +* The `--uninstall-token` command can receive multiple uninstall tokens separated by a comma, without spaces. ++ +[source,shell] +---------------------------------- +sudo elastic-agent uninstall -f --uninstall-token 7b3d364db8e0deb1cda696ae85e42644,a7336b71e243e7c92d9504b04a774266 +---------------------------------- + +* `--uninstall-token`'s argument can also be a path to a text file with one uninstall token per line. ++ +NOTE: You must use the full file path, otherwise the file may not be found. ++ +[source,shell] +---------------------------------- +sudo elastic-agent uninstall -f --uninstall-token /tmp/tokens.txt +---------------------------------- ++ +In this example, `tokens.txt` would contain: ++ +[source,txt] +---------------------------------- +7b3d364db8e0deb1cda696ae85e42644 +a7336b71e243e7c92d9504b04a774266 +---------------------------------- + [discrete] [[uninstall-endpoint]] == Uninstall {elastic-endpoint} diff --git a/docs/serverless/edr-install-config/agent-tamper-protection.asciidoc b/docs/serverless/edr-install-config/agent-tamper-protection.asciidoc index 56a1342d1e..07031a4696 100644 --- a/docs/serverless/edr-install-config/agent-tamper-protection.asciidoc +++ b/docs/serverless/edr-install-config/agent-tamper-protection.asciidoc @@ -50,3 +50,5 @@ If you need the uninstall token to remove {agent} from an endpoint, you can find + ** Click the **Show token** icon in the **Token** column to reveal a specific token. ** Click the **View uninstall command** icon in the **Actions** column to open the **Uninstall agent** flyout, containing the full uninstall command with the token. + +TIP: If you have many tamper-protected {agent} policies, you may want to <> in a single command. \ No newline at end of file diff --git a/docs/serverless/edr-install-config/uninstall-agent.asciidoc b/docs/serverless/edr-install-config/uninstall-agent.asciidoc index f07443259d..a1051813f7 100644 --- a/docs/serverless/edr-install-config/uninstall-agent.asciidoc +++ b/docs/serverless/edr-install-config/uninstall-agent.asciidoc @@ -54,6 +54,36 @@ C:\"Program Files"\Elastic\Agent\elastic-agent.exe uninstall --uninstall-token 1 ++++ +[discrete] +[[multiple-uninstall-tokens]] +== Provide multiple uninstall tokens + +If you have multiple tamper-protected {agent} policies, you may want to provide multiple uninstall tokens in a single command. There are two ways to do this: + +* The `--uninstall-token` command can receive multiple uninstall tokens separated by a comma, without spaces. ++ +[source,shell] +---------------------------------- +sudo elastic-agent uninstall -f --uninstall-token 7b3d364db8e0deb1cda696ae85e42644,a7336b71e243e7c92d9504b04a774266 +---------------------------------- + +* `--uninstall-token`'s argument can also be a path to a text file with one uninstall token per line. ++ +NOTE: You must use the full file path, otherwise the file may not be found. ++ +[source,shell] +---------------------------------- +sudo elastic-agent uninstall -f --uninstall-token /tmp/tokens.txt +---------------------------------- ++ +In this example, `tokens.txt` would contain: ++ +[source,txt] +---------------------------------- +7b3d364db8e0deb1cda696ae85e42644 +a7336b71e243e7c92d9504b04a774266 +---------------------------------- + [discrete] [[uninstall-endpoint]] == Uninstall {elastic-endpoint}