Unenrolment takes a device out of management. Do it remotely from the device panel whenever you can; the manual route exists for devices that are already out of reach.

Feature/Functionality

Overview

Remote unenrolment has two conditions, and both have to hold:

1. The device is enrolled and still present in your fleet.
2. The device shows as Online.

Miss either one and the action is not offered.

How to use — unenrol remotely

Open the device, then click Actions > Unenroll.

Management is removed immediately on macOS. On Windows it takes a short while longer.

How to use — when the device is offline

An offline device cannot be sent a command, so there is nothing to remove. You have two options:

• Wait for the device to come back online, then unenrol it normally.
• Mark it as unenrolled, which records that the device is no longer managed. Use this when the device is gone for good and you have already lost contact with it. Then remove management on the device itself.

Marking a device as unenrolled changes your records, not the device. If that machine ever reconnects, it is still carrying the profile and the agent.

How to use — remove the agent from a Mac whose MDM is off

If someone removed the enrolment profile from a Mac, the Factorial IT agent can still be running on it and reporting in. That Mac can no longer be unenrolled, so you remove the agent instead.

1. Open the device.
2. Click Actions > Advanced > Remove Factorial IT Agent, then Remove agent.

The removal waits until the Mac is switched on and connected to the internet. At its next check-in, the agent is removed and the device stops being managed. The Mac stays in your inventory, and you can enrol it again.

This action is for macOS only, and scripts must be enabled on the Mac.

How to use — uninstall by hand

Sometimes you have the device in front of you but not in the platform. In that case, remove the two pieces by hand: the management profile first, then the agent.

On Windows you need administrator rights on the device.

Remove the management account:

1. Open Start > Settings > Accounts.
2. Go to Access work or school.

3. Find the entry for the MDM in the list of accounts managing the device — it appears as Managed by Fleet MDM or similar.
4. Select it and click Disconnect.

5. Follow the prompts to the end.

Then remove the agent:

1. Search for Control Panel in the taskbar and open it.
2. Go to Programs > Programs and Features.
3. Right-click Fleet osquery and choose Uninstall.
4. Follow the prompts.

On macOS the profile lives in System Settings:

1. Open System Settings > General > Device Management.
2. Select the profile named [Your Company] enrollment and click the – button.

3. Click Remove.

4. Enter the session password.

The agent is still there after the profile is gone. Download the unenrolment package, then right-click it and open it to finish the job.

Troubleshooting and FAQ

Troubleshooting

• The Unenroll action is greyed out. The device is offline. Wait for it to reconnect, or mark it as unenrolled if it is never coming back.
• Windows still shows the device as managed after unenrolling. Windows applies the removal with a delay. If it persists, check Access work or school on the device itself — the account may need removing by hand.
• The macOS profile cannot be removed. It is locked. A locked profile is removed from the platform, not from the device.
• A Mac keeps reporting after its profile was removed. The agent is still installed. Use Actions > Advanced > Remove Factorial IT Agent. The removal only happens once the Mac is online and scripts are enabled.
• The device reappears in the fleet after being unenrolled. The agent was never removed. Uninstall Fleet osquery on Windows, or run the unenrolment package on macOS.

FAQ

1. Does unenrolling erase the device?
   No. It removes management and leaves data, apps and accounts untouched. Use a wipe if you need the data gone.
    
2. What is the difference between unenrolling and marking as unenrolled?
   The first removes management from the device. The second only updates your records, for devices you can no longer reach.
    
3. Does removing the agent from a Mac delete it from the inventory?
   No. The Mac stays in your inventory and can be enrolled again.
    
4. Can an unenrolled device be enrolled again?
   Yes, through any of the normal enrolment methods.
    
5. Why does Windows need two separate removals?
   The management account and the agent are separate pieces of software. Removing one leaves the other in place.