Uninstalling Takumi Agent

info

The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.

Uninstalling is one command. Run it while you're logged in to the Mac's desktop:

sudo /Applications/TakumiAgent.app/Contents/Helpers/takumi-agent-endpoint uninstall --system --untrust-ca

Deleting the app isn't enough

The system extension and the network configuration stay behind when you delete the app. Always run the command above first.

What the command does

The command runs these steps in order:

1. Removes the system extension. macOS may show one confirmation prompt.
2. Reports the removal, so the console shows the device as Removed instead of Offline.
3. Removes the background service and its files, including the trust settings for shells and apps (/etc/takumi-agent-endpoint/env.sh and the variables it sets).
4. Removes the device certificate from the System keychain (--untrust-ca).
5. Leaves the app itself. Drag /Applications/TakumiAgent.app to the Trash in Finder afterwards.

Terminal windows and apps that were open during the uninstall keep the old trust settings until you reopen them.

Users with a moved or symlinked home folder

If a user's home folder is a symlink (for example, moved to another volume), the command skips that user's files and prints which file to delete by hand. Everything else is still removed.

If step 1 fails, nothing is removed. The command stops and tells you why. Troubleshooting lists the causes and what to do.

About --untrust-ca

Removing the device certificate needs an administrator to approve a macOS prompt, just like trusting it did. Without the flag, or if the prompt is declined, everything else is still removed and the command prints how to delete the certificate in Keychain Access yourself. The private key is already deleted, so nothing can sign with the leftover certificate.

What the console shows afterwards

The device shows Removed, and its detail has an Agent removed locally row with the value System uninstall · <when>. Its verdict is Not protected. It doesn't show Offline, so a deliberate removal isn't confused with a machine that's switched off.

It stays Removed until you decommission it in the console. After that it shows Revoked and drops out of the Removed filter.

Enrolling again

Installing again with a new enrollment key creates a new device ID. It shows up in the console as a separate row and reads Protected. The old row stays Removed until you decommission it.

Uninstalling doesn't decommission the old device on the server. Decommission it in the console if you no longer need it.