# Uninstalling Takumi Agent {#uninstall}

Uninstalling is one command. Run it **while you're logged in to the Mac's desktop**:

```sh
sudo /Applications/TakumiAgent.app/Contents/Helpers/takumi-agent-endpoint uninstall --system --untrust-ca
```

:::warning Deleting the app isn't enough
The system extension and the network configuration stay behind when you delete the app. Always run the command above first.
:::

## What the command does {#order}

The command runs these steps in order:

1. **Removes the system extension.** macOS may show one confirmation prompt.
2. **Reports the removal**, so the console shows the device as **Removed** instead of Offline.
3. **Removes the background service and its files**, including the trust settings for shells and apps (`/etc/takumi-agent-endpoint/env.sh` and the variables it sets).
4. **Removes the device certificate from the System keychain** (`--untrust-ca`).
5. **Leaves the app itself.** Drag `/Applications/TakumiAgent.app` to the Trash in Finder afterwards.

Terminal windows and apps that were open during the uninstall keep the old trust settings until you reopen them.

:::note Users with a moved or symlinked home folder
If a user's home folder is a symlink (for example, moved to another volume), the command skips that user's files and prints which file to delete by hand. Everything else is still removed.
:::

**If step 1 fails, nothing is removed.** The command stops and tells you why. [Troubleshooting](/docs/t/endpoint/references/troubleshooting.md#uninstall-stops) lists the causes and what to do.

## About `--untrust-ca` {#untrust-ca}

Removing the device certificate needs an administrator to approve a macOS prompt, just like trusting it did. Without the flag, or if the prompt is declined, everything else is still removed and the command prints how to delete the certificate in Keychain Access yourself. The private key is already deleted, so nothing can sign with the leftover certificate.

## What the console shows afterwards {#after}

The device shows **Removed**, and its detail has an **Agent removed locally** row with the value `System uninstall · <when>`. Its verdict is **Not protected**. It doesn't show Offline, so a deliberate removal isn't confused with a machine that's switched off.

It stays Removed until you [decommission it](/docs/t/endpoint/features/managing-devices.md#decommission) in the console. After that it shows **Revoked** and drops out of the Removed filter.

## Enrolling again {#re-enrolment}

Installing again with a new enrollment key creates a **new device ID**. It shows up in the console as a separate row and reads **Protected**. The old row stays Removed until you decommission it.

Uninstalling doesn't decommission the old device on the server. Decommission it in the console if you no longer need it.