Agent Policies Configuration
Policies are handled via the ‘Endpoint Security’ section (‘Security Controls' tab)
Admins can configure agent's tracking behavior by modifying the policies
Policies should be configured at the global level, from which they will be automatically inherited by all customers
It is also possible to override the global policies at the individual customer level, if tenant-specific configurations are required
Admins can define exclusions to prevent false positives detections. Please refer to this article for more details
It is highly recommended to define these policies prior to agent deployment to ensure consistent behavior across all environments
Please note:
SentinelOne agent cannot enforce encryption—it only reports disk encryption status—so enforcement must be configured separately (e.g., using BitLocker for Windows devices)
When SentinelOne Firewall / Network Control is enabled, it becomes the active firewall on the endpoint and overrides the native Windows Firewall. Existing Windows Firewall or GPO rules become inactive, even if no SentinelOne rules are configured.
SentinelOne Agent Installation Instructions
Follow this article for complete installation guidelines.
Follow this article in case you wish to migrate existing licenses.
Please refer to the SentinelOne Deployment Checklist for guidance on a proper deployment process.
Please note:
Co-managed admins cannot deploy agents (to avoid impacting MSP costs), so the 'Upgrade' button is grayed out for them.
Uninstallation Process for SentinelOne Agents
1. Automatic Procedure - Single Device:
Admins can initiate an automatic uninstallation process for SentinelOne agents directly from the dashboard:
Go to the ‘Devices’ tab
Verify the view is filtered as ‘Agent Status’ equals ‘Active’
Devices with One Agent Installed (SentinelOne Agent):
Locate the relevant device and click on the ‘Remove Agent’ button
Approve the uninstall request by clicking on the ‘Uninstall’ button
Once the uninstall process is triggered, the device moves to the 'Pending Uninstall' status
Once the uninstall process is complete, the agent is deleted and the device is removed from the list
Please note:
Automatic removal of the agent from the device requires 'acknowledgment' from the device itself. If the device is no longer reachable, it might be required to manually decommission the agent directly from the SentinelOne console.
Devices with Two Agents Installed (both Guardz and SentinelOne)
Locate the relevant device and click on the ‘Remove Agent’ button
Select the relevant agent
Approve the uninstall request by clicking on the ‘Uninstall’ button
During the uninstall process, the device will be visible under both the ‘Active’ and the ‘Pending Uninstall’ statuses (as it had 2 agents)
Once the process is complete, the device will remain under ‘Active’ status, reflecting only the agent that remains installed
Each action such as 'Uninstall requested' or 'Uninstall finished' will be recorded in the Audit Log, visible in the right side of drawer.
Uninstalling the Windows Agent Using the SentinelOneInstaller Package
Although removing agents directly through the Guardz platform is the recommended approach, admins can alternatively uninstall agents using the installer package. Refer to this article for additional details.
2. Automatic Procedure - all Devices:
Admins can initiate an automatic uninstallation process for all SentinelOne agents of a specific customer:
Select the relevant customer
Go to the ‘Security Controls’ tab and open the ‘Endpoint Security’ section
Click on the ‘Deploy’ button and scroll down
Click on the ‘Uninstall agent from all devices’ option
Click on ‘Uninstall’ to approve the request
Uninstalling an agent that's Offline, Decommissioned, or no Longer in a Managed site
The steps above cover a device that's currently online and visible in your agent list. If the device is offline, has been marked decommissioned, or its site no longer exists in the console, use one of the paths below instead.
Finding the uninstall passphrase for an offline or decommissioned device
By default, devices that have been offline for more than 21 days are hidden from the standard agent view. To find one:
Go to Sentinels (agent management).
Open the Filters panel.
Toggle Decommissioned agents to Yes.
The device will now appear. Open it to copy its uninstall passphrase.
You don't need Safe Mode
A common assumption is that uninstalling requires rebooting into Safe Mode first. In almost all cases it doesn't — running the SentinelOne installer package directly is enough. See Uninstalling the Windows Agent Using the SentinelOneInstaller Package for the full walkthrough. Standard command:
SentinelOneInstaller.exe -c -k "PASSPHRASE" -t <site_token>
Uninstalling when the site itself has been deleted
If the site has been removed from the console, there's no site token to supply. Drop the -t argument and uninstall with the passphrase alone:
SentinelOneInstaller.exe -c -k "PASSPHRASE"
If the installer package itself is missing (for example, it no longer appears in Add/Remove Programs after a failed attempt), you can get it from:
Guardz console → Security Controls → Endpoint Security → Deploy (at the Single Customer scope), or
SentinelOne console → Sentinels → Packages
If you have no passphrase and no console access at all, use the local CLI uninstall — it doesn't need Console connectivity:
Windows:
msiexec /quiet /norestart /x Agent_version.msi UNINSTALL_KEY="PASSPHRASE"macOS / Linux:
sudo sentinelctl unprotect --passphrase "PASSPHRASE"thensudo sentinelctl uninstall --local
If uninstall fails with Error 1603 during a console migration
This means the agent is currently managed by a SentinelOne console that Guardz doesn't have visibility into (for example, a previous distributor's console). Guardz Support can only act on devices in a Guardz-managed console. Contact SentinelOne Support directly and reference "Moving Agents from one Management Console to another Management Console."