SentinelOne Uninstall

Software, Tasks & Script Requests
1

Looking for any tips on getting the s1 uninstall working properly if anyone has any advice.

2

I ended up modifying the dynamic integration script that’s floating around global to do this.
Fair warning, the whole integration is a bit wonk still, which is likely why it’s not published yet.
Let me know if you make any tweaks :slight_smile:

Integration Snippet:

# supports retrieving a tenant uninstall token
$Integration |  Add-DynamicIntegrationCapability -Interface ISupportsAgentUninstallToken -GetAgentUninstallToken {
    [CmdletBinding()]
    [OutputType([string])]
    param(
        [Parameter(Mandatory)]
        [string]$agentId
    )
    Import-Module SentinelOne-Local
    Write-Host "Agent ID: " $agentId
    $response = Invoke-S1RestMethod -Endpoint "agents/passphrases?uuids=`"$agentId`""
    Write-Host "Agent: " $response
    Write-Host "Passphrase: " $response.passphrase
    return $response.passphrase
}

Integration Agent Uninstall Script:

$Passphrase = Get-IntegrationAgentUninstallToken
$Uninstallers = Invoke-ImmyCommand { Resolve-Path "$($env:ProgramFiles)*\SentinelOne\Sentinel Agent *\uninstall.exe" }
Write-Host "Found:" $Uninstallers
$Arguments = @"
/uninstall /norestart /q /k `"$Passphrase`"
"@
$Logfile = New-TempLogFile
foreach($Uninstaller in $Uninstallers) {
    $Process = Start-ProcessWithLogTail $Uninstaller -ArgumentList $Arguments -LogFilePath $Logfile
    Write-Host "ExitCode: $($Process.ExitCode)"
}