title | description | ms.date | ms.topic |
---|---|---|---|
Uninstall the sensor |
This article describes how to uninstall the Microsoft Defender for Identity sensor from domain controllers. |
01/30/2023 |
how-to |
This article describes how to uninstall the Microsoft Defender for Identity sensor from domain controllers for the following scenarios:
- Uninstall a sensor from a domain controller
- Remove an orphaned sensor
- Remove a duplicate sensor
The following steps describe how to uninstall a sensor from a domain controller.
- Sign in to the domain controller with administrative privileges.
- From the Windows Start menu, select Settings > Control Panel > Add/ Remove Programs.
- Select the sensor installation, select Uninstall, and follow the instructions to remove the sensor.
Important
We recommend removing the sensor from the domain controller before demoting the domain controller.
This scenario can occur when a domain controller was deleted without first uninstalling the sensor, and the sensor still appears in the Microsoft Defender portal.
-
In Microsoft Defender XDR, go to Settings and then Identities. Select the Sensors tab, which displays all your Defender for Identity sensors.
-
Locate the orphaned sensor and select Delete (trash can icon).
This scenario may occur after an in-place sensor upgrade, and the sensor appears twice in the Microsoft Defender portal.
- In Microsoft Defender XDR, go to Settings and then Identities. Select the Sensors tab, which displays all your Defender for Identity sensors.
- Locate the duplicate sensor. It will be the one whose status is set to Unknown. Then, at the end of the row, select Delete (trash can icon).
Use the following command to perform a silent uninstall of the Defender for Identity sensor:
Syntax:
"Azure ATP sensor Setup.exe" [/quiet] [/Uninstall] [/Help]
Installation options:
[!div class="mx-tableFixed"]
Name Syntax Mandatory for silent uninstallation? Description Quiet /quiet Yes Runs the uninstaller displaying no UI and no prompts. Uninstall /uninstall Yes Runs the silent uninstallation of the Defender for Identity sensor from the server. Help /help No Provides help and quick reference. Displays the correct use of the setup command including a list of all options and behaviors.
Examples:
To silently uninstall the Defender for Identity sensor from the server:
"Azure ATP sensor Setup.exe" /quiet /uninstall