Uninstalling Windows and Linux Agents

Last updated: December 12, 2025

Overview

Uninstalling agents from Windows and Linux hosts involves two phases: stopping the agent service or container on the host, and removing the agent registration from the vSOC application.

Uninstalling Windows Agents

Phase 1 - Stopping the Agent Service

1. Log in to the Windows host where the agent is installed.

2. Press Windows + R to open the Run dialog box.

3. Enter services.msc and click OK to open the Windows Services management console.

   

4. Locate the D3 agent service, right-click the service, and select Stop from the context menu.

Phase 2 - Removing Agent from D3 vSOC

1. Log in to the D3 vSOC application.

2. Navigate to the Configurations > Agent Management module.

3. Locate the agent, verify that the status is Disconnected, then select the agent record.

4. Click on the Delete ( ) button, then the Yes button in the confirmation dialog.

   

5. (Optional) Remove the agent installation files from the host.

   1. Navigate to the agent installation directory, typically C:\Program Files\D3Security\Agent\ or a similar path.

   2. Delete the agent directory and its contents.

   3. Remove agent-related Windows Registry entries, if applicable.

Uninstalling Linux Agents

Phase 1 - Stopping the Docker Container

1. Run the following command to connect to the Linux host where the agent is installed.

   Bash

   ssh username@hostname 
   

2. Navigate to the directory containing the agent Docker Compose file.

   Bash

   cd /<agent directory path>
   

   Replace <agent directory path> with the actual path containing the agent directory.

3. Run the following command to stop and remove the agent container.

   Bash

   docker compose down <agent name>
   

   Replace <agent-name> with the actual name of the agent container.

4. Run the following command to stop all agents defined in the Docker Compose file.

   Bash

   docker compose down
   

5. Run the following command to verify that the container has stopped.

   Bash

   docker ps -a | grep <agent name>
   

   The container should no longer appear in the container list.

Phase 2 - Removing Agent from D3 vSOC

Follow steps 1-4 from above.

5. (Optional) Clean up Docker resources.

   1. Run the following command to remove the stopped container.

      Bash

      docker rm <agent name>
      

   2. Run the following command to remove the agent image and free disk space.

      Bash

      docker rmi <agent image name>
      

   3. Run the following command to remove unused volumes.

      Bash

      docker volume prune
      

   4. Run the following command to delete the agent configuration files.

      Bash

      rm -rf /<agent directory path>
      

Verifying Agent Removal

After completing the uninstallation, verify the following.

In the vSOC Application:

• Verify that the agent no longer appears in the Agent Management table.

• Verify that no error messages related to the removed agent appear in logs.

On the Windows Host:

• Verify that the agent service no longer appears in the Services console.

• Verify that no agent-related processes are running in Task Manager.

• Verify that the agent installation directory has been removed, if cleanup was performed.

On the Linux Host:

• Verify that no agent container is running.

  Bash

  docker ps | grep <agent name> 
  

  Expect the command to return no output.

• Verify that the agent image has been removed, if cleanup was performed.

  Bash

  docker images | grep <agent name>
  

  Expect the command to return no output.

Troubleshooting