Skip to content
Run it

Uninstalling Beacon

Remove the agent on Windows, macOS and Linux, decide what happens to the device identity, and revoke the device in the console.

Removing the agent and revoking the device are two different operations, on two different systems. Skip the second and the tenant keeps a record that will never check in again. Skip the first and you have a service running on a host you thought was clean.

Run them in this order: stop the agent, remove it, then revoke the device in the console. The agent keeps local state until you say otherwise, so revocation is not undone by a host that was wiped.

Windows

Remove the MSI if that is how it was installed:

msiexec /x alyria-<version>-windows-x64.msi /qn

The uninstall stops the AlyriaBeacon service, removes the service registration, removes %ProgramFiles%\Alyria, and takes the install directory off the machine PATH. %ProgramData%\Alyria stays, on purpose. It holds the device identity and the state that a reinstall resumes from. The folder belongs to the service account, so an administrator cannot simply delete it: take ownership first, then remove it.

takeown /F "$env:ProgramData\Alyria" /R /A /D Y
icacls "$env:ProgramData\Alyria" /reset /T /C /Q
Remove-Item -LiteralPath "$env:ProgramData\Alyria" -Recurse -Force

Do that only after the device is revoked, because it discards the identity that says which host this was.

macOS

Remove the agent and its configuration profiles through the MDM that distributed them, and approve the system extension removal. A profile that stays behind keeps the privacy grants in place for whatever is installed next.

Linux

Remove the package, then the state:

sudo systemctl disable --now alyria
sudo apt remove alyria        # or your repository's equivalent
sudo rm -rf /var/lib/alyria

/var/lib/alyria holds the device identity, the trust material and the event spool. Delete it after revocation, not before, and export the chain first if it is evidence you need.

Revoking the device

The console lists each device with a status: Active, Awaiting approval or Revoked. Revocation is the tenant-side state for a host you no longer trust, and it is what stops the tenant waiting for a device that is gone. Do it after the agent is stopped, so you are not chasing a last heartbeat from a service you already removed.

If the host was never enrolled there is nothing to revoke. If it was enrolled and the disk was destroyed, revoke it anyway; the record outlives the hardware.

When a laptop changes hands

  1. Stop and remove the agent on the host.
  2. Confirm it is gone: sc query AlyriaBeacon on Windows, systemctl status alyria on Linux, the MDM inventory on macOS.
  3. Revoke the device in the console.
  4. Remove the local state directory if the disk is being reused.
  5. Keep what you exported from the audit trail. Uninstalling does not export anything for you; see Exporting the audit trail.

The short version

Stop the service, remove the package, remove the device identity from the disk, revoke the device in the console. Four steps, two systems, and the third one is the step people skip.

← Back to docs