Uninstalling Windows and Linux Agents

LAST UPDATED: DECEMBER 12, 2025

PREREQUISITES

Identified the agents to uninstall.
Obtained administrative or root access to the host where the agent is installed.
Possess valid credentials to log in to the vSOC application.
Possess permissions to manage agents in the vSOC application.

Overview

Uninstalling agents from Windows and Linux hosts involves two phases: stopping the agent service or container on the host, and removing the agent registration from the vSOC application.

Uninstalling Windows Agents

Phase 1 - Stopping the Agent Service

Log in to the Windows host where the agent is installed.
Press Windows + R to open the Run dialog box.
Enter services.msc and click OK to open the Windows Services management console.
Locate the D3 agent service, right-click the service, and select Stop from the context menu.

READER NOTE

If the service fails to stop, end the agent process using Task Manager.

Phase 2 - Removing Agent from D3 vSOC

Log in to the D3 vSOC application.
Navigate to the Configurations > Agent Management module.
Locate the agent, verify that the status is Disconnected, then select the agent record.
Click on the Delete () button, then the Yes button in the confirmation dialog.
(Optional) Remove the agent installation files from the host.
1. Navigate to the agent installation directory, typically C:\Program Files\D3Security\Agent\ or a similar path.
2. Delete the agent directory and its contents.
3. Remove agent-related Windows Registry entries, if applicable.

Uninstalling Linux Agents

Phase 1 - Stopping the Docker Container

Run the following command to connect to the Linux host where the agent is installed.
BASH
```
ssh username@hostname 
```
Navigate to the directory containing the agent Docker Compose file.
BASH
```
cd /<agent directory path>
```
Replace <agent directory path> with the actual path containing the agent directory.
Run the following command to stop and remove the agent container.
BASH
```
docker compose down <agent name>
```
Replace <agent-name> with the actual name of the agent container.
Run the following command to stop all agents defined in the Docker Compose file.
BASH
```
docker compose down
```
Run the following command to verify that the container has stopped.
BASH
```
docker ps -a | grep <agent name>
```
The container should no longer appear in the container list.

Phase 2 - Removing Agent from D3 vSOC

Follow steps 1-4 from above.

(Optional) Clean up Docker resources.
1. Run the following command to remove the stopped container.
  BASH
```
docker rm <agent name>
```
2. Run the following command to remove the agent image and free disk space.
  BASH
```
docker rmi <agent image name>
```
3. Run the following command to remove unused volumes.
  BASH
```
docker volume prune
```
4. Run the following command to delete the agent configuration files.
  BASH
```
rm -rf /<agent directory path>
```

Verifying Agent Removal

After completing the uninstallation, verify the following.

In the vSOC Application:

Verify that the agent no longer appears in the Agent Management table.
Verify that no error messages related to the removed agent appear in logs.

On the Windows Host:

Verify that the agent service no longer appears in the Services console.
Verify that no agent-related processes are running in Task Manager.
Verify that the agent installation directory has been removed, if cleanup was performed.

On the Linux Host:

Verify that no agent container is running.
BASH
```
docker ps | grep <agent name> 
```
Expect the command to return no output.
Verify that the agent image has been removed, if cleanup was performed.
BASH
```
docker images | grep <agent name>
```
Expect the command to return no output.

Troubleshooting

Issue: The agent remains connected after the service is stopped

SOLUTION

Wait a few minutes for the timeout to expire.
Refresh the Agent Management page.
Verify that the correct service or container was stopped.

Issue: The Delete button is unavailable (greyed out) in the vSOC application

SOLUTION

Verify that Agent Management permissions are assigned to you.
Contact a vSOC administrator to request the required permissions.

Issue: The Windows agent service does not stop

SOLUTION

Press Ctrl + Shift + Esc to open Task Manager.
End the agent process manually.
Restart the host if the agent process cannot be terminated.

Issue: The Linux agent container does not stop

SOLUTION

Run the following command to force stop the container.
BASH
```
docker kill <agent name>
```
Run the following command to restart the Docker service, if the container does not stop.
BASH
```
sudo systemctl restart docker
```

Issue: The agent reappears after deletion

SOLUTION

Verify that the agent service or container is fully stopped before deletion.
Check for any configured auto-restart policies.
Verify that no scheduled tasks restart the agent.

RELATED ARTICLES