Unenrolling devices from your account

If the required permissions are associated with your user role, you can submit an Unenroll Device request to unenroll one or more devices from your account. After a device is unenrolled, its device record remains visible in the console, but no further information is collected from the device, and no device actions can be requested.

You can submit an Unenroll Device request from the the Devices page or a device's Device Details page. You can also select devices in a policy group, device group, device group folder, or device report and submit a request for all selected devices. Alternatively, if you want to unenroll a large number of devices at one time, you can upload a file of device identifiers and submit a single Unenroll Device request.

For more information about unenrolling devices, visit the Learning Hub. To access the Learning Hub, click (Help and Support) on the quick access toolbar and then click Resources > The Learning Hub.

If you unenroll a device in error, you can re-enroll it.

On Windows and Mac devices, the Unenroll Device action has the following effect:

  • After a 72-hour waiting period has elapsed, the Secure Endpoint Agent is removed on the next agent connection.
  • The device's database record and device information are retained, but you no longer have the ability to manage the device in Absolute, and its device information is no longer updated in the console.

On Chromebook devices, the Unenroll Device action unenrolls the device and sets the Agent status and the Chromebook > Extension to Disabled. Note that it doesn't remove the Absolute for Chromebooks extension from the device.

If there's a possibility that you may want to re-enroll a Chromebook device at a later date, don't use an Unenroll Device request to unenroll it. You will not be able to re-enroll the device without contacting Absolute Technical Support.

You can use other methods to unenroll a Chromebook and remove the Chromebook extension. Learn more

The Unenroll Device feature is supported on Windows and Mac devices with an active Secure Endpoint Agent that is regularly connecting to the Absolute Monitoring Center. It is also supported on Chromebook devices that have a Chromebooks < Extension with a status of Pending or Installed.

The Unenroll Device feature is not supported on Disabled The operating condition of a device's Secure Endpoint Agent. Possible values are Active (indicates that the device's agent has connected to the Absolute Monitoring Center), Inactive (indicates one of the following: the device was moved to another account; the device was unenrolled, but it is now set to be reactivated; or the device had Persistence enabled at the factory, but it has not yet called in to the Absolute Monitoring Center), and Disabled (indicates that the agent is either flagged for removal or removed from the unenrolled device). Inactive and Disabled devices do not consume a license. or Inactive The operating condition of a device's Secure Endpoint Agent. Possible values are Active (indicates that the device's agent has connected to the Absolute Monitoring Center), Inactive (indicates one of the following: the device was moved to another account; the device was unenrolled, but it is now set to be reactivated; or the device had Persistence enabled at the factory, but it has not yet called in to the Absolute Monitoring Center), and Disabled (indicates that the agent is either flagged for removal or removed from the unenrolled device). Inactive and Disabled devices do not consume a license. devices, or devices with an open theft report.

If there are outstanding security actions pending on a device, such as a Delete File or Wipe request, these actions are canceled by an Unenroll Device request.

To submit a request to unenroll one or more devices from your account:

  1. Log in to the Secure Endpoint Console as a user with the Perform permission for Unenroll Device.

  2. Do one of the following:

    On the device's Device Details page, click Unenroll.

    1. From the navigation bar, open a page that supports the Unenroll Device action.
    2. In the work area, use the search field or filters to find the devices you want to unenroll.

    3. In the results grid, select each device you want to include in the request. To select all devices, select the Select All checkbox in the result grid header. To select consecutive devices, select the first device and then hold down the Shift key and select the last device. You can select up to 350,000 devices. To remove all selections, click Clear all.

    4. Depending on the page you're on, click Unenroll or > Unenroll.

    Alternatively, you can upload a file of device identifiers and submit a request.

  3. [Optional] At the top of the dialog, click Unenroll - <date> and enter a request name that will help you identify and track this request in Action Requests.
  4. [Optional] Click Add description (optional) and enter a description for the request.
  5. If you want to exclude devices that have been reported missing from the Unenroll request, select the Exclude missing devices checkbox.
  6. In Review device(s), review the list of devices that have been selected for the Unenroll Device action.

    The Review devices section is not shown for bulk Unenroll requests.

  7. Under Confirmation, select the checkbox to acknowledge that this request can't be canceled once you save it.

  8. To complete the request, click Unenroll x devices.

    The Unenroll Device request is submitted and the Agent Status of each device is set to Disabled. For Chromebooks, the Chromebook Extension is also set to Disabled. Three events are logged to Event History in quick succession: Device unenroll requested, Device disabled, and Agent status updated.

    In Action Requests, the action status of the Unenroll Device request is updated to Completed almost immediately, unless the request requires dual approval. If the request fails to complete for any reason, such as insufficient permissions, the action status is set to Failed and the reason is displayed in the Action > Status details column. A Device unenroll failed event is logged to Event History.

  9. [Optional] To force the request to be immediately sent to a Windows device, you can start an agent call using the Persistence Status Monitor. Learn more

    The Persistence Status Monitor tool must be run locally on a device. You can't run the tool remotely from the Secure Endpoint Console.

After the waiting period has elapsed, you may want to confirm that the Secure Endpoint Agent is removed from an unenrolled Windows device, and Persistence Absolute Persistence® technology is embedded in the BIOS of most Windows devices during the manufacturing process. The Persistence module is activated during theSecure Endpoint Agent’s first connection to the Absolute Monitoring Center. This software checks the status of the agent and initiates self-healing to restore the agent if it's missing, damaged, or tampered with. is deactivated.

If you have physical access to the unenrolled device, you can run the Persistence Status Monitor tool at the command line to do the following:

  • Start an agent call to remove the agent
  • Determine how many reboots are required to deactivate Persistence
  • Verify that Persistence is deactivated

To download the tool, go to Settings > Utilities.

For detailed instructions about running Persistence Status Monitor commands, see the user guide included in the downloaded zip package.