Press CTRL+K to open search

Uninstalling Endpoint Security (HX) xAgent software

  • Published on Sep 8, 2026
  • 10 minute(s) read
Prev Next
Skip to main content

You can uninstall Endpoint Security (HX) xAgent software individually on your endpoint hosts or using software management utilities, such as BigFix and SCCM (in Windows environments) or Casper (in macOS environments). Refer to the documentation provided for the utility.

If you enable a Removal Protection password policy for host sets in your environment, you must enter the removal password to authorize the agent uninstall process. See Configuring the Agent Removal Protection Password  for more information on setting up an agent uninstall password.

Important

If you run the uninstall audit on a host set that has the Removal Protection policy enabled, the uninstall audit will fail. To successfully run the uninstall audit, disable the Removal Protection policy before running the uninstall audit.

This section describes how to uninstall the xAgent software on a single endpoint host and covers the following topics:

Uninstalling Password-Protected xAgent Software

If you need to uninstall a password protected Endpoint Security (HX) xAgent running on your Windows endpoints, you can use the Endpoint Security (HX) Windows Program Manager or the Windows Installer. Only authorized users can uninstall the xAgent software.

Note

Endpoint Security (HX) xAgent versions 26 or later support the Removal Protection Password for Windows endpoints only.

Important

Endpoint Security (HX) xAgent removal protection is disabled if Trend Micro AV is running.

This section covers the following topics:

Using Windows Program Manager to uninstall a password-protected xAgent

This section describes how to uninstall a password-protected agent from your Windows endpoint using the Windows Program Manager.

Important

A reboot is necessary after uninstalling Trellix Endpoint Security (HX) xAgent version 29.

Note

Artifacts that remain in the C:\Windows\FireEye folder after the agent software has been uninstalled will be deleted the next time the endpoint host is rebooted.

If a Windows xAgent uninstall attempt fails because the binary is missing or corrupt or because the 

ProgramData/FireEye
or 
Program Files/FireEye
directories are missing or corrupt, reinstall the agent using command-line commands (
msiexec /x <agent software installation msi file> /qn UNINSTALL_PASSWORD=password
) and then uninstall it.

To uninstall the Windows xAgent using the Windows Program Manager:

  1. In the Windows Control Panel, select Programs and Features. Depending on your version of Windows, you might have to select Programs before you can select Programs and Features.

  2. Locate  FireEye Endpoint Agent in the program list and right-click and select Uninstall.

  3. Select Yes when prompted to confirm that you want to uninstall the agent software and to similar confirmation prompts.

  4. When prompted, enter the uninstall password and click OK. If you are not authorized to remove the agent software from the Windows host or if you enter an incorrect password, the uninstall process will fail.

Using Command-Line to uninstall a password-protected xAgent

This section describes how to uninstall password-protection Endpoint Security (HX) xAgent software from your Windows endpoint using the command line.

To uninstall the Windows xAgent using the Command Line:

msiexec.exe /x <agent software installation msi file>|<product identifier #> UNINSTALL_PASSWORD=<password>

  1. Open a command line prompt on your Windows host.

  2. Use the msiexec /x command to uninstall the password-protected xAgent software by specifying the name of the agent installation .msi executable file on the host endpoint and appending the /x command with UNINSTALL_PASSWORD=<password>.

  3. When prompted to confirm that you want to uninstall the xAgent software, select Yes.

Uninstalling a Password-Protected xAgent in Silent Mode

To uninstall the Windows xAgent in silent mode:

You can also use the command line to uninstall the xAgent software silently (without any user prompting) by inputting the password as a property to msiexec. If this property is missing or if the xAgent uninstall password is incorrect, the uninstall process will fail.

msiexec /x <agent software installation msi file> /qn UNINSTALL_PASSWORD=password

  1. Open a command line prompt on your Windows host.

  2. Use the msiexec /x and /qn commands to uninstall the password-protected xAgent software in silent mode. Specify the name of the xAgent installation .msi executable file on the host endpoint and appending the /x command with UNINSTALL_PASSWORD=<password>.

    msiexec /x <agent software installation msi file>|<product identifier #>/qn UNINSTALL_PASSWORD=<password>

Uninstalling Undisguised Windows xAgent Software

This section describes how to uninstall undisguised Endpoint Security (HX) xAgent software running on your Windows endpoint.

To uninstall undisguised Windows xAgent software:

  1. In the Windows Control Panel, select Programs and Features. Depending on your version of Windows, you might have to select Programs before you can select Programs and Features.

  2. Right-click on the FireEye Endpoint Agent you want to uninstall and select Uninstall.

  3. Select Yes when prompted to confirm that you want to uninstall the agent software and to similar confirmation prompts.

    Important

    A reboot is necessary after uninstalling Trellix Endpoint Security (HX) xAgent version 29.

    Note

    Artifacts that remain in the C:\Windows\FireEye folder after the xAgent software has been uninstalled will be deleted the next time the endpoint host is rebooted.

    If a Windows xAgent uninstall attempt fails because the binary is missing or corrupt or because the 

    ProgramData/FireEye
    or 
    Program Files/FireEye
    directories are missing or corrupt, reinstall the xAgent using command-line commands (
    msiexec /i xagt.msi /qn
    ) and then uninstall it.

Uninstalling disguised Windows xAgent software

This section describes how to uninstall disguised Endpoint Security (HX) xAgent software running on your Windows endpoint.

To uninstall disguised Windows xAgent software:

  1. Locate the .msi installation file for the xAgent software. This must be for the same xAgent version that is installed on the host endpoint.

  2. Run the .msi file, selecting the Remove option when prompted.

  3. Confirm the software removal by responding Yes or clicking Remove as necessary.

    Important

    A reboot is necessary after uninstalling Trellix Endpoint Security (HX) xAgent version 29.

    Note

    Artifacts that remain in the C:\Windows\FireEye folder after the xAgent software has been uninstalled will be deleted the next time the endpoint host is rebooted.

    If a Windows xAgent uninstall attempt fails because the binary is missing or corrupt or because the 

    ProgramData/FireEye
    or 
    Program Files/FireEye
    directories are missing or corrupt, reinstall the agent using command-line commands (
    msiexec /i xagt.msi /qn
    ) and then uninstall it.

Uninstalling Windows xAgent software

The table below lists the options for uninstalling Endpoint Security (HX) xAgent software on your Windows hosts.

Uninstall Option

Description

/x

Uninstall the software installed by the named installation *.msi executable file.

If the Removal Protection Password is enabled, you must enter this password to authorize the Endpoint Security (HX) xAgent uninstall process by appending the /x command with UNINSTALL_PASSWORD=<password>.

Only authorized users can uninstall the xAgent software. See Configurin g the Agent Removal Protection Password for more information.

/qn /qb /qr /qf

Set the user interface level for the uninstall process:

  • /qn: no user interface

  • /qb: basic user interface

  • /qr: reduced user interface

  • /qf: full user interface

/l*v

Enable agent logging for the uninstall process.

Uninstalling macOS xAgent software

This section describes how to uninstall the Endpoint Security (HX) xAgent software running on your macOS endpoints.

Important

If your organization uses JAMF or BigFix with the remove-helper option, uninstalling the agent will not remove the system extension.

Note

Uninstalling the agent with the remove-helper option, when your organization uses JAMF or BigFix activates a local permission prompt requiring the approval of a user with administrative rights.

To uninstall macOS xAgent software:

  1. Launch the Terminal and enter the following command to run the uninstall script.

    sudo /Library/FireEye/xagt/uninstall.tool

    Enter the administrator password when prompted.

  2. Enter the following command to verify that no xagt processes are running.

    ps aux | grep xagt

    Note

    If xagt processes are running on the endpoint, perform one of the following steps:

    • If all the agent artifacts still remain on the endpoint, run the uninstall script again.

    • If all the agent artifacts have been removed from the endpoint, manually terminate the xagt processes.

To uninstall the system extension:

  1. Log in to the terminal as an administrator.

  2. Run the uninstall script.

  3. Enter the following command:

    uninstall.tool--remove-helper

  4. Confirm that the system extension should be removed.

  5. Drag the system extension to the trash to complete the uninstallation of the agent.

Uninstalling Linux xAgent software

To uninstall Endpoint Security (HX) xAgent software version on your Linux endpoint, you must first determine which uninstall option to use based on the file type you used to install the xAgent software on your Linux endpoint.

The following table shows the specific uninstall command that corresponds to each supported xAgent software installation file type.

File Type

Uninstall Command

Compatible Linux Systems

.rpm

rpm -e <installation_filename.rpm>

RHEL, CentOS, Amazon Linux AMI, and SUSE

.deb

dpkg --purge <installation_filename.deb>

Ubuntu

.run

<binary path>uninstall.sh

RHEL and CentOS

Important

The Endpoint Security (HX) xAgent software installation .rpm and .deb files do not include an uninstall script.

This section includes the following topics:

Uninstalling the Linux xAgent on RHEL-Based Systems

Follow the steps in this section if you need to uninstall the xAgent software from your Linux endpoint running a support RHEL-based operating system, including

  • RHEL versions 6.8, 6.9, 6.10, 7.2, 7.3, 7.4, 7.5, 7.6, 8 (64-bit)

  • CentOS versions 6.8, 6.9, 6.10, 7.2, 7.3, 7.4, 7.5, 7.6 (64-bit)

  • Amazon Linux AMI version 2018.3 (64-bit)

To uninstall Linux xAgent software on your RHEL-based system:

username@localhost:~$ yum list xagt

The example below identifies the xagt-30.0.1-1.el6.x86_64.rpm file as the file that was used to install the xAgentsoftware on the Linux endpoint. You can see the Linux OS bit-architecture, the xAgent software version, and the software status.

xagt.x86_64

30.0.1-1.e16

installed

  1. Open a Terminal session on your Linux endpoint running Endpoint Security (HX) xAgent software version .

  2. Type the following command to identify the .rpm or .run that was used to install the Endpoint Security (HX) xAgent software version on your Linux endpoint.

  3. Run the correct uninstall command for the file type you identified in Step 3 to remove the Endpoint Security (HX) xAgent software version from your Linux endpoint.

    • If the .rpm file was used to install the Endpoint Security (HX) xAgent software version on your Linux endpoint, use the rpm -e command to uninstall the xAgent software from your Linux endpoint.

      username@localhost:~$ sudo rpm -e <installation_filename.rpm>

    • If the .run file was used to install the Endpoint Security (HX) xAgent software version on your Linux endpoint, use the binary path and uninstall script to remove the xAgent software from your Linux endpoint.

      username@localhost:~$ sudo /opt/fireeye/bin/uninstall.sh

Uninstalling the Linux xAgent on SUSE System

Follow the steps in this section if you need to uninstall the xAgent software from your Linux endpoint running SUSE Enterprise Linux version 11.4, 12.2, 12.3, or 15.

To uninstall Linux xAgent software on your Linux endpoint running a supported SUSE version:

  1. Open a Terminal session on your Linux endpoint running Endpoint Security (HX) xAgent software version .

  2. Type the following command to identify the .rpm that was used to install the Endpoint Security (HX) xAgent software version on your Linux endpoint.

  3. username@localhost:~$ rpm -qa | grep xagt

    The example below identifies the xagt-30.0.1-1.sle11.x86_64.rpm file as the file that was used to install the xAgent software on the Linux endpoint. You can see the Linux OS bit-architecture, the xAgent software version, and the software status.

    xagt.x86_64

    30.0.1-1.sle11

    installed

  4. Run the rpm -e command to remove the Endpoint Security (HX) xAgent software version from your Linux endpoint.

    username@localhost:~$ sudo rpm -e <installation_filename.rpm>

Uninstalling the Linux xAgent on an Ubuntu System

Follow the steps in this section if you need to uninstall the xAgent software from your Linux endpoint running Ubuntu version 14.04, 16.04, or 18.04.

To uninstall Linux xAgent software on your Linux endpoint running a support Ubuntu version:

username@localhost:~$ dpkg -l | grep xagt

The example below identifies the xagt-30.0.0-1.ubuntu12_amd64.deb file as the file that was used to install the xAgentsoftware on the Linux endpoint. You can see the Linux OS bit-architecture, the xAgent software version, and the software status.

xagt.amd64

30.0.0-1.ubuntu12

installed

username@localhost: ~$ sudo dpkg --purge <installation_filename.deb>

  1. Open a Terminal session on your Linux endpoint running Endpoint Security (HX) xAgent software version .

  2. Type the following command to identify the .deb that was used to install the Endpoint Security (HX) xAgent software version on your Linux endpoint.

  3. Run the dpkg -purge command to remove the Endpoint Security (HX) xAgent software version from your Linux endpoint.

:
Related articles
  • Uninstalling the Linux xAgent on RHEL-Based Systems
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 36 Administrator Guide > Appendices > Alternate methods for installing and uninstalling the xAgent > Uninstalling Endpoint Security (HX) xAgent software > Uninstalling Linux xAgent software
  • Uninstalling disguised Windows xAgent software
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 36 Administrator Guide > Appendices > Alternate methods for installing and uninstalling the xAgent > Uninstalling Endpoint Security (HX) xAgent software
  • Uninstalling Undisguised Windows xAgent Software
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 36 Administrator Guide > Appendices > Alternate methods for installing and uninstalling the xAgent > Uninstalling Endpoint Security (HX) xAgent software