Vendor-neutral endpoint offboarding

Prove the agent is actually gone.

Use these 24 checks when replacing an RMM, ending a client relationship, retiring an endpoint, or closing a pilot. A successful uninstall is more than a command returning zero: the device, management record, remote-access path, credentials, scheduled work, and retained evidence must reconcile to the approved end state.

Open the full client-offboarding guide Use the offboarding evidence register Open the vendor exit plan Plan an RMM migration Print this checklist

1. Authorize the removal

  1. Record the customer, endpoint scope, business reason, requested completion date, and person authorized to approve removal.
  2. Confirm whether the device is being retired, transferred, re-enrolled, migrated, or temporarily disconnected.
  3. Identify evidence that must be retained before uninstall, including inventory, alerts, jobs, audit history, patch state, and exceptions.
  4. Define the rollback or re-enrollment path if removal targets the wrong device or interrupts an approved service.

2. Reconcile the target

  1. Match the management record to a durable device identifier, tenant, site, hostname, serial number, and current user or owner.
  2. Check for duplicate, stale, cloned, reimaged, or previously retired records before selecting the uninstall target.
  3. List every related agent, remote-support component, updater, service, driver, browser extension, credential, and integration.
  4. Pause or close scheduled scripts, patch jobs, automation policies, maintenance windows, alert routes, and open tickets that depend on the device.

3. Execute with evidence

  1. Use the vendor-supported uninstall method and record the actor, command or workflow, target, start time, completion time, and result.
  2. Capture whether tamper protection, an uninstall token, local elevation, reboot, or manual cleanup was required.
  3. Stop the rollout when the tool targets an unexpected tenant, device count, component, or privilege boundary.
  4. Retain the failure message and device state when removal fails; do not repeatedly run a destructive command without diagnosing the cause.

4. Remove access and artifacts

  1. Verify that agent and remote-support services, processes, scheduled tasks, startup entries, drivers, and listening ports are absent or explicitly retained.
  2. Review remaining install directories, logs, caches, certificates, configuration files, firewall rules, package records, and registry or preference entries.
  3. Revoke device tokens, API credentials, service accounts, certificates, technician access, unattended-access grants, and integration secrets tied to the endpoint.
  4. Confirm that removed software cannot be relaunched by a software-deployment policy, legacy startup job, image, script, or another management platform.

5. Verify both sides

  1. Confirm locally that the agent no longer runs, checks in, starts after reboot, or accepts remote commands.
  2. Confirm in the management console that the endpoint is offline or retired for the expected reason and no longer receives jobs.
  3. Reconcile the last check-in, uninstall time, console state, network observations, and device evidence; investigate conflicts instead of assuming success.
  4. Test that unrelated endpoint protections, backup, identity, networking, line-of-business software, and the replacement management agent still operate as intended.

6. Close and monitor

  1. Record exceptions for unreachable devices, offline assets, legal holds, shared components, failed removals, and devices awaiting customer action.
  2. Assign an owner and due date to every exception, with a compensating control and a clear condition for final closure.
  3. Monitor for unexpected check-ins, credential use, automation runs, service recreation, or re-enrollment during a defined post-removal period.
  4. Close the change only when scope, evidence, access revocation, residual artifacts, replacement coverage, customer handoff, and exception status are reconciled.

Definition of removed

An RMM agent is removed when the authorized target no longer runs or checks in, management and remote-access credentials are revoked, residual components are understood, replacement controls remain healthy, retained records satisfy the handoff requirement, and every unreachable or failed device has an owned exception. A successful uninstall exit code alone is not closure evidence; record the result, exception owner, and final acceptance in the RMM vendor exit plan.