Uninstall User Agent via GPO

Introduction

Uninstalling the Kabeen agent follows the reverse logic of the deployment described in the official Deploy User Agent via GPO documentation. It is best performed using the same GPO that was used for the initial installation, to guarantee a clean and consistent removal across the entire fleet.

Prerequisites

• Administrator access to the Active Directory domain
• Edit rights on the GPO used for the initial deployment of the Kabeen agent
• The network share containing the original MSI must remain accessible during the uninstallation phase (Windows Installer may need it for certain rollback operations)
• Users must sign back in to their workstation for the GPO to apply

Method 1 — Uninstall via the Deployment GPO (recommended)

Step 1 — Remove the MSI Package from the GPO

1. Open the Group Policy Management console.
2. Locate the GPO used to deploy the Kabeen agent under Group Policy Objects.
3. Right-click the GPO > Edit.
4. Navigate to User Configuration > Policies > Software Settings > Software Installation.
5. Right-click the Kabeen package > All Tasks > Remove.
6. In the dialog that appears, select Immediately uninstall the software from users and computers.
7. Click OK.

⚠️ Important: do not choose the option "Allow users to continue using the software, but prevent new installations" — this would leave the agent in place on workstations where it has already been deployed.

Step 2 — Remove the Configuration Registry Keys

The agent configuration (API key, structure, team) remains in the registry as long as the GPO keys are not removed. For a complete cleanup:

1. In the GPO editor, navigate to User Configuration > Preferences > Windows Settings > Registry.
2. For each of the three keys created during deployment (ApiKey, Structure, Team):
   • Right-click the key > Properties
   • Change the Update action to Delete
   • Keep the HKEY_CURRENT_USER hive and the SOFTWARE\Policies\Kabeen\Configuration path
   • Click OK

Alternatively, create a targeted deletion entry on the parent key to simplify the GPO:

Step 3 — Force GPO Application

The uninstallation will run at the user's next logon. To speed up the rollout:

• On a single workstation: open an elevated PowerShell prompt and run gpupdate /force, then sign out and sign back in.
• At scale: schedule a sign-out or reboot through your software distribution tool (SCCM, Intune, etc.).

Step 4 — Verification

After the GPO is applied and users have signed back in, verify on a sample of workstations:

• The Kabeen entry no longer appears in Settings > Apps > Installed apps (or Control Panel > Programs and Features).
• The Kabeen.exe and proxy.exe processes are no longer present in Task Manager. Starting with agent version 1.3.2, these processes are automatically terminated by the installer during uninstallation.
• The installation folder (C:\Program Files\Kabeen or C:\Program Files (x86)\Kabeen) has been removed.
• The registry keys under HKEY_CURRENT_USER\SOFTWARE\Policies\Kabeen have been removed.
• In the Kabeen platform, under the Agent Tracking menu, the uninstalled workstations move to offline status and then disappear from the inventory after the retention period.

Step 5 — Delete or Unlink the GPO

Once uninstallation is confirmed across the entire fleet (allow one to two weeks depending on user sign-in frequency, and longer for roaming workstations):

1. In Group Policy Management, locate the GPO links on the relevant OUs.
2. Right-click each link > Delete.
3. Optional: delete the GPO from Group Policy Objects.

⚠️ Do not delete or unlink the GPO before uninstallation is effective across the entire fleet. Without the GPO in place, remaining workstations will never receive the uninstall instruction.