Uninstall

Use this page to take the client off machines: one developer’s laptop, a rollout wave, or the whole estate. The client installs and runs at user scope, so a removal runs per machine, as the user the client was installed for. Remove it through the same route that installed it.

Installed with	Remove with
The developer path	Remove it from one machine
An Intune platform script or Win32 app	Microsoft Intune
A Jamf Pro policy	Jamf Pro
Ansible or a pipeline step	Ansible
A container image or a CI job	Containers and continuous integration

What a removal takes off the machine

A removal has three levels. A fleet rollback normally uses the third.

Level	Command	What it removes	What it leaves
Uninstall	openlatch uninstall	The client’s entry in every agent’s configuration, restoring each agent as it was before the install. The client stops, and so does its startup entry	The state directory, the binaries, the PATH line, and the relay CA, still trusted, so a reinstall raises no dialog
Purge	openlatch uninstall --purge	The above, plus the state directory, with the configuration, the local records and the encrypted credential files, and the relay CA with its entry in the user’s trust store	The binaries, the PATH line
Full removal	The purge, then delete the binaries	Everything the install placed	The enrollment marker, if a fleet recipe left one

A relay certificate your device management trusts machine-wide is never removed by the client, at any level: remove it from the profile or Group Policy Object that installed it, once no machine needs it.

openlatch uninstall leaves settings OpenLatch did not write untouched. A purge is local to the machine: it deletes the machine’s host credential from disk, and the credential is not revoked on the platform. Revoke and clean up in the console covers revocation.

Before you remove (optional)

A purge deletes the local records, and events the platform has not yet received go with them; the client warns you with a count before it deletes them. Keep a copy first if your retention policy needs one.

What to keep	How
The local records of a machine	Run openlatch doctor --rescue --yes on it. It writes a redacted ZIP archive to the current directory, or to the path given with --output
An agent’s record in the console	Export as JSON, in the agent’s actions menu. Find and read an agent shows where
The audit trail	Export on the Audit Trail page, as CSV or JSON. Review the audit trail covers filters

Without a terminal, openlatch doctor --rescue builds the archive only when --yes is given, so keep the flag in a script.

Remove it from one machine

Use this route on a machine you can open a terminal on, typically a developer path install. Sign out first, so that the machine’s host credential is revoked on the platform while the machine is online, then purge:

openlatch system auth logout
openlatch uninstall --purge

Signing out revokes this machine’s credential only. When the platform cannot be reached, the client keeps the credential to revoke it later, but the purge deletes it, so the revocation never happens: cut the host off in the console instead, as Revoke and clean up in the console describes.

Then delete the two files the install placed:

macOS and Linux

rm -f "$HOME/.local/bin/openlatch" "$HOME/.local/bin/openlatch-hook"

The install also added a PATH line to your shell profile, with this comment on the line before it:

# openlatch installer

Delete the comment and the line after it, unless other tools rely on that directory being on the PATH. Leave the directory itself: other software may use it.

Windows

Remove-Item -Recurse -Force "$env:LOCALAPPDATA\openlatch\bin"

The directory belongs to the client, so you can remove it whole. Remove its entry from your user Path too, under Edit environment variables for your account.

To unwire one agent and keep the others, openlatch uninstall --agent takes the agent type. It narrows the hook removal only: the client still stops for the whole machine, so the other agents are left pointed at a client that no longer runs. Use it before you reinstall, not as a way to switch one agent off.

Roll back a fleet

A fleet rollback has four steps, in this order:

1. Stop the install. Remove the install policy or assignment for the machines you roll back, so the tool does not install the client again.
2. Remove the client. Deliver the purge and the file deletion below through the same tool, as the same user the install ran as. The purge also removes the relay CA from each user’s trust store.
3. Revoke in the console. Cut the hosts off in one bulk action, which covers machines that were offline during step 2. Revoke and clean up in the console shows how.
4. If you shipped your organization’s relay certificate, remove its machine-wide trust: unassign the Intune Trusted certificate profile, remove the Jamf Pro configuration profile from scope, or delete the certificate from the Group Policy Object. Then delete the bundle from your secret store.

The scripts below do not sign out. Revocation runs once, from the console, so a machine that cannot reach the platform at removal time is still cut off. The platform script, Jamf and Ansible recipes keep the enrollment marker the install left, so an install that still reaches a machine skips it; delete the marker only on a machine you will enroll again. The Win32 app is the exception, below.

--yes skips the confirmation prompt. Without a terminal, the uninstall does not prompt anyway, but keep the flag so the script behaves the same when someone runs it by hand. openlatch uninstall exits 0 when the removal is done. It exits non-zero before anything is touched when the purge target is not the client’s own directory (OL-1300) or an agent type is unknown, and after it starts when the client cannot be stopped or the directory cannot be deleted. Report that exit code to the tool, as the scripts below do. --json prints a summary with the agents removed and any warnings.

The uninstall also tells the platform that the machine was uninstalled, when the client is running and can reach the platform. The console does not show that as a state yet, so track progress from the tool’s own report, then from the licensed hosts table, where an uninstalled machine shows no new activity.

Microsoft Intune

Run the script with the logged-on credentials, as the install did. Run as SYSTEM, it would look in the SYSTEM profile and find nothing to remove, so the script refuses SYSTEM. It is safe to run again on a machine the client has already left.

# Platform script, user context. Runs silently and cannot prompt.
if ([Security.Principal.WindowsIdentity]::GetCurrent().IsSystem) {
  Write-Output "run this script with the logged-on credentials"; exit 1
}

$bin = "$env:LOCALAPPDATA\openlatch\bin"
$openlatch = "$bin\openlatch.exe"
if (-not (Test-Path $openlatch)) { exit 0 }

& $openlatch uninstall --purge --yes
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

Remove-Item -Recurse -Force $bin
exit 0

$ErrorActionPreference does not stop the script when a native command fails, so the script reads $LASTEXITCODE and returns it, and Intune reports the failure. The user Path keeps an entry for the deleted directory, which Windows skips once the directory is gone.

The script runs the purge, so it removes the relay CA and its entry in the user’s trust store. The Trusted certificate profile is separate: unassign it once no machine in its groups runs the client.

For the Win32 app, use this script as the wrapper the app’s Uninstall command runs, with one more line before its last: delete openlatch-enrolled from %LOCALAPPDATA%, because the app’s detection rule reads that file and Intune treats the app as removed only once it is gone. Then replace the app’s Required assignment with Uninstall for the users you roll back, so Intune runs the wrapper and does not install the app again.

Jamf Pro

A Jamf policy normally runs its scripts as root, and the client was installed for the user at the console. The script therefore finds that user and runs the removal as them, through launchctl asuser and sudo -u, as the install did. Run as root without that step, the removal would look in root’s home directory and find nothing to remove. With nobody logged in, it exits with an error, and the policy runs again at the next check-in.

#!/bin/zsh
# A Jamf policy normally runs as root: remove the client as the console user instead.
set -eu

user=$(stat -f%Su /dev/console)
if [[ -z "$user" || "$user" == "root" || "$user" == "loginwindow" ]]; then
  echo "nobody is logged in at the console; the next check-in retries"
  exit 1
fi
uid=$(id -u "$user")
home=$(dscacheutil -q user -a name "$user" | sed -n 's/^dir: //p')
as_user() { launchctl asuser "$uid" sudo -H -u "$user" "$@"; }

bin="$home/.local/bin"
if [[ ! -x "$bin/openlatch" ]]; then exit 0; fi

as_user "$bin/openlatch" uninstall --purge --yes
as_user rm -f "$bin/openlatch" "$bin/openlatch-hook"

set -e stops the script on the first command that fails, so the policy log records the uninstall’s exit code. Set the policy’s Execution Frequency to Ongoing, triggered by Recurring Check-in, so a machine whose user was not logged in is removed at a later check-in. Remove the install policy’s scope from the same machines first.

The purge removes the relay CA and its entry in the console user’s login keychain. A computer-level configuration profile that trusts your certificate stays until you remove the computers from its scope.

Ansible

- name: Remove OpenLatch, as the user who runs the agents
  hosts: agent_machines
  become: true
  become_user: "{{ openlatch_user }}" # Never root.
  tasks:
    - name: Purge the client and its local state
      ansible.builtin.command: "{{ ansible_env.HOME }}/.local/bin/openlatch uninstall --purge --yes"
      args:
        removes: "{{ ansible_env.HOME }}/.local/bin/openlatch"

    - name: Delete the installed files
      ansible.builtin.file:
        path: "{{ ansible_env.HOME }}/.local/bin/{{ item }}"
        state: absent
      loop:
        - openlatch
        - openlatch-hook

Run the play as the user the client was installed for, as the install play does. The removes argument skips the purge on a machine the client has already left, so a rerun is safe. Run it against a sample of the wave first and read the task output there, as for the install.

The purge removes the relay CA and its trust entry for the user the play runs as. Linux has no machine-wide trust step to undo.

Containers and continuous integration

There is nothing to remove from an ephemeral runner or a container: the client lives only as long as the job. Delete the install step from the pipeline, or the install layer from the image, and the next job runs without it. Delete the key the jobs enrolled with once no job uses it.

Nothing to remove on the machine for the relay certificate. Delete the relay certificate secret from the pipeline once no job uses it.

Revoke and clean up in the console

Do this once the machines are uninstalled, in this order:

Step	What to do	Why
1. Cut the hosts off	Select the hosts in the licensed hosts table, choose Remove hosts, then Cut it off, and confirm with Cut off host. Read licensing and usage covers the choice	Their credentials stop working on their next call, including on a machine that was offline at removal time, and they stop counting as licensed hosts. A host you cut off comes back only if someone enrolls it again
2. Delete the wave’s key	Choose Delete on the key once its wave needs no more enrollments. Manage API keys covers deletion	The key can only enroll hosts. A machine on the current client holds its own host credential, so deleting the key disconnects no machine
3. Delete the agents, if you need them gone	Delete agent, in the agent’s actions menu. Find and read an agent covers deletion	Deletion erases the agent with every session and event recorded for it. Export first if you need the record

To keep a machine’s history and let it return later, choose Let it come back on its own instead of Cut it off: the host stops counting now and counts again the next time it reports. Uninstall before you delete an agent: an agent deleted while its client still runs comes back with the next event.

In short

• Remove the client through the route that installed it, as the user it was installed for. A removal run as root or SYSTEM finds nothing to remove.
• A full removal is openlatch uninstall --purge, then the two installed files. Keep a openlatch doctor --rescue --yes archive or a console export first if you need the records.
• A fleet rollback stops the install, delivers the purge, reports its exit code, and keeps the enrollment marker so the machine is not enrolled again.
• Revoke from the console: cut the hosts off in one bulk action, delete the wave’s key, and delete agents last.
• A plain openlatch uninstall keeps the relay CA, still trusted; --purge removes it and its trust entry. A certificate trusted machine-wide stays until you remove it in your device management.